WO2021082647A1 - 一种联合学习系统、训练结果聚合的方法及设备 - Google Patents

一种联合学习系统、训练结果聚合的方法及设备 Download PDF

Info

Publication number
WO2021082647A1
WO2021082647A1 PCT/CN2020/109930 CN2020109930W WO2021082647A1 WO 2021082647 A1 WO2021082647 A1 WO 2021082647A1 CN 2020109930 W CN2020109930 W CN 2020109930W WO 2021082647 A1 WO2021082647 A1 WO 2021082647A1
Authority
WO
WIPO (PCT)
Prior art keywords
training
aggregation
node
result
tee
Prior art date
Application number
PCT/CN2020/109930
Other languages
English (en)
French (fr)
Inventor
胡文博
厉丹阳
张秦涛
马新建
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2021082647A1 publication Critical patent/WO2021082647A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G06N20/20—Ensemble learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning

Definitions

  • This application relates to the technical field of artificial intelligence (AI), and specifically relates to a joint learning system, a method and equipment for aggregating training results.
  • AI artificial intelligence
  • Federated Learning is a model training solution in which cloud devices can jointly train models with multiple terminal devices and solve privacy issues at the same time.
  • Joint learning has multiple rounds of training. Each round screens multiple terminal devices to participate in the training according to certain rules, which solves the problem of a small amount of end-to-side sample data to a certain extent.
  • user privacy data is used locally on the end side without uploading to the cloud side, which can solve the problem of privacy leakage.
  • the training results obtained from each end-side training must be uploaded to the cloud side, and the cloud side aggregates the training results uploaded by multiple end-sides, and then sends the aggregated results to the end-side.
  • joint learning uses a secure aggregation (SA) method to ensure that the training results will not be leaked.
  • SA secure aggregation
  • SS secret sharing
  • the terminal device in the user set U uses the following process for each aggregation: the terminal device in the user set U generates a symmetric key pair locally, and sends the public key with the signature to the cloud device, and the cloud device receives the user set U1 (U1 ⁇ U) public key, and broadcast the public key list to all terminal devices in U1.
  • the terminal device in U1 divides the training result into corresponding number of shares according to the number of terminal devices in the public key list, and randomly adds a noise vector b to each share, and uses the public keys of different terminal devices. Encrypt each share with noise b.
  • the terminal device sends the ciphertext of each share with noise b to the cloud device.
  • the cloud device has received the ciphertext of the user set U2 (U2 ⁇ U1).
  • the cloud device sends the received ciphertext to the terminal device in U2.
  • the terminal device in U2 uses its own key to decrypt the ciphertext encrypted with its own public key, calculates the intermediate result y, and sends it to the cloud device.
  • the device has received the intermediate result y of the user set U3 (U3 ⁇ U2).
  • the cloud device broadcasts the list of U3 users. If the number of terminal devices in U3 is less than the minimum number of terminal devices required for aggregation calculation t, then the aggregation is terminated. If the number of terminal devices in U3 is not less than t, the terminal device that receives the list returns a signature To the cloud device; the cloud device has collected the signature of the user set U4 (U4 ⁇ U3).
  • the cloud device broadcasts the signature list of the terminal device in U4 to determine the surviving users.
  • the surviving users refer to the terminal devices that are not offline. If the number of surviving users in U4 is less than t, the aggregation is terminated. If the number of surviving users in U4 is not less than t, the surviving users will generate the plaintext of noise b, and regenerate the share ciphertext encrypted with their own public key for the dropped users, and encrypt the plaintext of noise b with their own public key.
  • the ciphertext of the share is first sent to the cloud device, and then the private key corresponding to the ciphertext generated for the dropped user is sent to the cloud device.
  • the cloud device uses the received private key to decrypt the ciphertext of the dropped user, generates the intermediate result of the dropped user, and uses the plaintext of noise b to denoise the intermediate result of the user set U3, and uses the intermediate result of the dropped user and The intermediate results of the surviving users after denoising are calculated, and the plaintext of the aggregation result is obtained, and the aggregation process ends.
  • the embodiments of the present application provide a joint learning system and a method for aggregating training results, which can reduce communication overhead and improve computing efficiency on the premise of ensuring the privacy of training data.
  • the embodiments of the present application also provide corresponding equipment.
  • the first aspect of the application provides a joint learning system.
  • the joint learning system includes M aggregation nodes and N training nodes. Both M and N are positive integers.
  • the N training nodes are configured with the same training model, and M aggregations
  • a first rich execution environment (REE) and a first trusted execution environment (trusted execution environment, TEE) are configured in the nodes, and the first aggregation node is included in the M aggregation nodes.
  • the first aggregation node receives P first training results for the training model sent by P training nodes, where the first training results are obtained by the training node encrypting the second training results, and the second training results are training node training From the training model, P is a positive integer, and P ⁇ N.
  • the first aggregating node schedules the P first training results from the first REE of the first aggregating node to the first TEE of the first aggregating node; the first aggregating node is in the first TEE of the first aggregating node; Decrypt the P first training results in a TEE to obtain P second training results; the first aggregation node aggregates the P second training results in the first TEE to obtain the first aggregation result, The first aggregation result is used to update the training model or used for the next level of aggregation.
  • the aggregation node and the training node may be on different computer equipment, or on the same computer equipment.
  • the aggregation node can be a server or other computing device, and the training node can be a server, or it can be, for example, a mobile phone, a computer, a personal computer (PC), a tablet, Terminal equipment such as smart watches and smart bracelets.
  • the aggregation node and the training node may be different virtual machines (VM) on the computer device.
  • VM virtual machines
  • the first TEE can be a secure area separated from the main processor of the aggregation node, or it can be a TEE chip independent of the main processor.
  • the first TEE provides external security services and can guarantee the code and data loaded in it. It is protected in terms of confidentiality and integrity.
  • the first REE and the first TEE run in parallel. Compared with the first TEE, the first REE is not as safe as the first TEE.
  • the first training result received by the aggregation node from the outside world will reach the first REE first, and then To be scheduled from the first REE to the first TEE, the scheduling process can be implemented based on the communication between the REE and the TEE.
  • the training node uses the training data to train the training model to obtain the second training result, and encrypts the second training result to obtain the first training result.
  • the first aggregation result may be an average value of P second training results or a weighted average value.
  • the second training result can be a gradient, which is the derivative of the weight in the training model.
  • the first polymerization result may be a polymerization gradient obtained after gradient polymerization.
  • M>1 it may be because there are many training nodes, and one aggregation node may not be able to process too much data. At this time, multiple aggregation nodes are needed to form a hierarchical aggregation structure.
  • the first-level aggregation nodes are trained The training results of the nodes are aggregated at one level, and then the first aggregated results are aggregated by the next level of aggregation node.
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data, and the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • the M aggregation nodes further include a second aggregation node.
  • the second aggregation node receives Q encrypted first aggregation results sent by the Q first aggregation nodes, where Q is a positive integer greater than 1;
  • the second aggregation node schedules the encrypted Q first aggregation results from the first REE of the second aggregation node to the first TEE for decryption, so as to obtain Q first aggregation results;
  • the second aggregation node aggregates the Q first aggregation results in the first TEE to obtain a second aggregation result, and the second aggregation result is used for updating the training model or for the next level of aggregation .
  • the second aggregation node is a second-level aggregation node. If there are only two aggregation levels, the second aggregation result obtained after aggregation by the second aggregation node can be used to update the training model. If there is a third level or more in the structure, the second aggregation result will be passed to the third level.
  • the aggregation operation is performed in the first TEE in the aggregation node of each aggregation level, thereby ensuring the privacy of the aggregation results of each level.
  • the hierarchical aggregation method is more conducive to efficient aggregation in scenarios where there are many training nodes.
  • the process of updating the training model can be to use the aggregate gradient to update the weight on the training model.
  • the process of weight update can be to subtract the aggregate gradient generated in this round from the current weight of the current round to obtain the updated weight.
  • the updated weight is used In the next round of training, the training model after updating the weights is the updated training model.
  • a second TEE is respectively configured in the N training nodes, for each first training node in the N training nodes;
  • the first training node trains the training model in the second TEE of the first training node, and encrypts the training result to obtain the training result of the first training node.
  • the training result of a training node is one of the N first training results.
  • a second TEE is configured in the training node, and the model is trained in the second TEE to ensure that the training model will not leak, and the privacy of the training model can be ensured.
  • the first training node before the first training node trains the training model in the second TEE of the first training node, the first training node is in the first training node.
  • the encrypted training model is decrypted in the second TEE of a training node to obtain the decrypted training model.
  • the first training node decrypts the encrypted training model in the second TEE, which can further ensure the privacy of the training model.
  • the first training node adds noise to training data; the first training node uses the training data after adding noise to train the training model.
  • the process of adding noise can be called differential privacy processing in the industry.
  • Adding noise can be understood as adding a small change to the training data, while minimizing the impact on the use of training data. , To minimize the effect of identifying individual data in the data source, thereby effectively avoiding training data leakage.
  • noise is added to the training data to make it difficult for the training model to reverse the original training data, thereby ensuring that the training model is difficult to record the training data, thereby further ensuring the privacy of the training data.
  • the first training node sends the training result of the first training node in response to the first indication information of the random response strategy; the first training node responds to the random response The second instruction information of the strategy deletes the training result of the first training node.
  • the random response strategy may be pre-configured.
  • the random response strategy may include first indication information or second indication information.
  • the first indication information may be 1, and the second indication information may be 1.
  • the indication information can be 0.
  • the first indication information may be true, and the second indication information may be false.
  • the random response strategy may be equivalent to secondary differential privacy processing, and the first training node determines whether to send the training result to the first aggregation node according to the random response strategy.
  • the random response strategy can be changed periodically.
  • the first indication information indicates to send the training result
  • the second indication information indicates not to send the training result, so that the first aggregation node cannot continuously get the same result.
  • the training result of a training node can further prevent the training data from being deduced from the training model, thereby further ensuring the privacy of the training data.
  • the joint learning system further includes a control node that receives the training model; the control node sends the training model to the N training nodes.
  • control node can select a suitable training node for the training model according to the requirements of the training model, and then send the training model to these suitable training nodes.
  • the joint learning system further includes a scheduling device
  • the control node Sending, by the control node, aggregation node demand information for the aggregation node to the scheduling device, where the demand information includes the number of aggregation nodes required and/or aggregation level information;
  • the scheduling device determines the M aggregation nodes used for aggregation according to the aggregation node demand information.
  • control node may determine the number of aggregation nodes and/or aggregation level information, etc. according to the number of selected training nodes.
  • the scheduling device may configure corresponding M aggregation nodes for this training model from the aggregation resources according to the demand information.
  • the second aspect of the present application provides a method for aggregating training results.
  • the method is applied to a joint learning system.
  • the joint learning system includes M aggregation nodes and N training nodes. Both M and N are positive integers, and the N training
  • the same training model is configured on the nodes, the first REE and the first TEE are configured in the M aggregation nodes, and the first aggregation node is included in the M aggregation nodes;
  • the method may include: the first aggregation node receives the P first training results for the training model sent by P training nodes, where the first training result is obtained by encrypting the second training result by the training node, and the second training result is the training P is a positive integer obtained by the node training the training model, and P ⁇ N; the first aggregation node schedules the P first training results from the first REE of the first aggregation node to the first In the first TEE of the aggregation node; the first aggregati
  • the aggregation node and the training node may be on different computer devices, or on the same computer device.
  • the aggregation node may be a server or other computing devices
  • the training node may be a server or terminal devices such as mobile phones, computers, and PCs.
  • the aggregation node and the training node may be different VMs on the computer device.
  • TEE can be a secure area separated from the main processor of the aggregation node, or it can be a TEE chip independent of the main processor. TEE provides external security services to ensure the confidentiality and confidentiality of the code and data loaded in it.
  • the first training result received by the aggregation node from the outside world will reach the first REE first, and then be scheduled to the first REE from the first REE. TEE.
  • the training node uses the training data to train the training model to obtain the second training result, and encrypts the second training result to obtain the first training result.
  • the first aggregation result may be an average value of P second training results or a weighted average value.
  • the second training result can be a gradient, which is the derivative of the weight in the training model.
  • the first polymerization result may be a polymerization gradient obtained after gradient polymerization.
  • the value of M can be 1, or other larger values.
  • one aggregation node can aggregate the training results of N training nodes.
  • the first aggregation result is the final aggregation result, which can be directly used to update the training model.
  • M>1 it may be because there are many training nodes, and one aggregation node may not be able to process too much data.
  • multiple aggregation nodes are needed to form a hierarchical aggregation structure.
  • the first-level aggregation nodes are trained The training results of the nodes are aggregated at one level, and then the first aggregated results are aggregated by the next level of aggregation node.
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data.
  • the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • the M aggregation nodes further include a second aggregation node, and the method further includes:
  • the first aggregation node sends the encrypted first aggregation result to the second aggregation node, and the encrypted first aggregation result is used by the second aggregation node in the first TEE of the second aggregation node
  • the first aggregation result is obtained by decryption, and the Q first aggregation results from the Q first aggregation nodes are used by the second aggregation node to aggregate in the first TEE of the second aggregation node to obtain the second aggregation
  • the second aggregation result is used to update the training model or used in the next level of aggregation, and Q is a positive integer greater than 1.
  • the second aggregation node is a second-level aggregation node. If there are only two aggregation levels, the second aggregation result obtained after aggregation by the second aggregation node can be used to update the training model. If there is a third level or more in the structure, the second aggregation result will be passed to the third level. In this possible implementation, no matter how many aggregation levels there are, the aggregation operation is performed in the first TEE at the aggregation node of each aggregation level, thereby ensuring the privacy of the aggregation results of each level, and through multiple aggregation levels. Stage polymerization can also improve the efficiency of polymerization.
  • the third aspect of the present application provides a method for aggregating training results, which is applied to a joint learning system.
  • the joint learning system includes M aggregation nodes and N training nodes, where M and N are both positive integers, and N training nodes are used.
  • the same training model is configured, the first rich execution environment REE and the first trusted execution environment TEE are configured in the M aggregation nodes, the M aggregation nodes include the first aggregation node, and the N training The nodes are respectively configured with second TEEs.
  • the method may include: the first training node compares all the training nodes in the second TEE of the first training node.
  • the training model is trained; the first training node encrypts the training result in the second TEE to obtain the first training result of the first training node; the first training node sends the first training node to the first training node.
  • the aggregation node sends the first training result, and the first training result is used by the first aggregation node to aggregate results in the first TEE.
  • a second TEE is configured in the training node, and the second TEE can be understood by referring to the description of the first TEE in the first aspect. Training the model in the second TEE can ensure that the training model will not be leaked, and the privacy of the training model can be ensured.
  • the method may further include:
  • the first training node decrypts the encrypted training model in the second TEE of the first training node to obtain the decrypted training model.
  • the training node is equipped with a second TEE, which can ensure that the training model is trained in the second TEE without leakage, and the privacy of the training model is ensured.
  • the method may further include:
  • the first training node uses the training data added with noise to train the training model.
  • the process of adding noise can be called differential privacy processing in the industry.
  • Adding noise can be understood as adding a small change to the training data, while minimizing the impact on the use of training data. , To minimize the effect of identifying individual data in the data source, thereby effectively avoiding training data leakage.
  • noise is added to the training data to make it difficult for the training model to reverse the original training data, thereby ensuring that the training model is difficult to record the training data, thereby further ensuring the privacy of the training data.
  • the method may further include:
  • the first training node deletes the training result of the first training node in response to the second indication information of the random response strategy.
  • the random response strategy may be pre-configured.
  • the random response strategy may include first indication information or second indication information.
  • the first indication information may be 1, and the second indication information may be 1.
  • the indication information can be 0.
  • the first indication information may be true, and the second indication information may be false.
  • the random response strategy may be equivalent to secondary differential privacy processing, and the first training node determines whether to send the training result to the first aggregation node according to the random response strategy.
  • the random response strategy can be changed periodically.
  • the first indication information indicates to send the training result
  • the second indication information indicates not to send the training result, so that the first aggregation node cannot continuously get the same result.
  • the training result of a training node can further prevent the training data from being deduced from the training model, thereby further ensuring the privacy of the training data.
  • the fourth aspect of the present application provides an aggregation node, which has the function of implementing the foregoing second aspect or any one of the possible implementation methods of the second aspect. Or this function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above functions, for example: a receiving unit, a processing unit, and a sending unit.
  • the fifth aspect of the present application provides a training node, which has the function of realizing the foregoing third aspect or any one of the possible implementation methods of the third aspect. Or this function can be realized by hardware, or by hardware executing corresponding software.
  • the hardware or software includes one or more units corresponding to the above functions, for example: a receiving unit, a processing unit, and a sending unit.
  • a sixth aspect of the present application provides a computer device that includes at least one processor, a memory, an input/output (input/output, I/O) interface, and a computer executable that is stored in the memory and can run on the processor Instruction, when the computer-executed instruction is executed by the processor, the processor executes the method described in the foregoing second aspect or any one of the possible implementation manners of the second aspect.
  • the seventh aspect of the present application provides a computer device that includes at least one processor, a memory, an input/output (input/output, I/O) interface, and a computer executable that is stored in the memory and can run on the processor Instruction, when the computer-executed instruction is executed by the processor, the processor executes the method described in the foregoing third aspect or any one of the possible implementation manners of the third aspect.
  • the eighth aspect of the present application provides a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes any of the above-mentioned second or second aspects.
  • One possible implementation is the method described.
  • a ninth aspect of the present application provides a computer-readable storage medium storing one or more computer-executable instructions.
  • the processor executes any of the aforementioned third aspect or the third aspect.
  • One possible implementation is the method described.
  • the tenth aspect of the present application provides a computer program product that stores one or more computer-executable instructions.
  • the processor executes any one of the above-mentioned second aspect or the second aspect. A possible way to achieve this.
  • the eleventh aspect of the present application provides a computer program product storing one or more computer-executable instructions.
  • the processor executes the third aspect or any of the third aspects. One possible way to achieve this.
  • a twelfth aspect of the present application provides a chip system, which includes a processor for supporting training nodes to implement the above-mentioned second aspect or any one of the possible implementations of the second aspect.
  • the chip system may also include a memory, and the memory is used to store program instructions and data necessary for training the node.
  • the chip system can be composed of chips, or include chips and other discrete devices.
  • a thirteenth aspect of the present application provides a chip system, which includes a processor for supporting training nodes to implement the functions involved in the third aspect or any one of the possible implementation manners of the third aspect.
  • the chip system may also include a memory, and the memory is used to store program instructions and data necessary for training the node.
  • the chip system can be composed of chips, or include chips and other discrete devices.
  • the fourth, sixth, eighth, tenth and twelfth aspects or the technical effects brought by any one of the possible implementation methods can be referred to the technologies brought about by the second aspect or the different possible implementation methods of the second aspect The effect will not be repeated here.
  • the fifth, seventh, ninth, eleventh and thirteenth aspects or the technical effects brought by any one of the possible implementations can be referred to the third aspect or the different possible implementations of the third aspect. The technical effect will not be repeated here.
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data, and the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • FIG. 1 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • Fig. 2 is a schematic diagram of a scenario embodiment of a joint learning system provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of an embodiment of a method for aggregating training results provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another embodiment of a method for aggregating training results provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of an embodiment of an aggregation node provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of an embodiment of a training node provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of another embodiment of a computer device provided by an embodiment of the present application.
  • the embodiments of the present application provide a joint learning system and a method for aggregating training results, which can reduce communication overhead and improve computing efficiency on the premise of ensuring the privacy of training data.
  • the embodiments of the present application also provide corresponding equipment. Detailed descriptions are given below.
  • the joint learning system is a system in which aggregation nodes combine with training nodes to implement model training.
  • the training node can be a terminal device, a computer device such as a server, or a virtual machine on the computer device.
  • the training results can be aggregated hierarchically.
  • each aggregation node is configured with a first trusted execution environment (TEE), and the first EE can be a piece separated from the main processor of the aggregation node
  • TEE trusted execution environment
  • the security area may also be a TEE chip independent of the main processor.
  • the first TEE provides security services to the outside, which can ensure that the code and data loaded therein are protected in terms of confidentiality and integrity.
  • the rich execution environment (REE) runs in parallel with the first TEE. Compared with the first TEE, the first REE is not as safe as the first TEE.
  • the training node can also be configured with TEE. In the embodiment of this application, the TEE on the training node is called the second TEE. Whether on the aggregation node or the training node, the structure of REE and TEE are the same. It is understood with reference to a schematic structural diagram of the computer device shown in FIG. 1.
  • the computer device shown in Figure 1 is deployed with System, the system includes REE and TEE, REE and TEE run on Operating system and a TEE operating system (e.g. open source operating system). Operating system and TEE OS are divided into user mode and kernel mode. Multiple client applications (CA) are deployed in the user state on the REE side, such as facial recognition CA and fingerprint recognition CA. Multiple trusted applications (TAs) are deployed in the user state on the TEE side, such as fingerprint recognition TA, face recognition TA, and so on. Deployed in the kernel state on the REE side Components, the kernel state on the TEE side deploys trusted core components.
  • the CA in the REE and the TA in the TEE form a similar client/server architecture.
  • the CA is the client and the TA is the server.
  • the CA initiates the access operation.
  • the two communicate through the REE communication agent, the hardware layer message channel and the TEE
  • the agents exchange data, and the three establish a secure communication channel for CA and TA, ensuring the security of data transmission to a certain extent.
  • the CA calls the TEE client API (application program interface) to communicate with the corresponding TA;
  • the TA calls the TEE internal API (internal API) to use the programming resources provided by the TEE to implement related functions.
  • the joint learning system provided by the embodiments of the present application may have multiple scenarios.
  • the following describes the joint learning system for different scenarios.
  • the training node is a terminal device, and there is a scenario for the aggregation node.
  • Fig. 2 is a schematic diagram of a scenario embodiment of a joint learning system provided by an embodiment of the application.
  • the training nodes in the joint learning system can be terminal devices such as mobile phones, tablets, laptops, personal computers, smart watches, smart bracelets, etc.
  • the first aggregation node communicates with the plurality of training nodes through a network.
  • the first TEE and the first REE configured on the first aggregation node can be understood with reference to the description of the TEE and REE in FIG. 1 above.
  • each training node can use its own training data to train the training model to obtain the training result, then encrypt the training result, and send the encrypted training result through the network To the first aggregation node.
  • the first training result After the first aggregation node receives the encrypted first training result, the first training result will first enter the first REE.
  • the first training result can be dispatched from the first REE to the first TEE for decryption, and then the first training result can be decrypted in the first TEE.
  • the second training result obtained after decryption is aggregated to obtain the first aggregation result.
  • the process of scheduling the first training result from the first REE to the first TEE can be understood as the CA side initiates an access operation, and the first training result is passed through the REE communication agent, the message channel of the hardware layer, and The TEE communication agent transfers to the first TEE.
  • the first aggregation result is the aggregation result used for the current round of training model update.
  • the first aggregation node can use the first aggregation result to update the training model, and then send the updated training model to each training node, and start the next round of training when the training is not over. It may also be that the first aggregation node sends the first aggregation result to each training node, and each training node updates the local training model, and starts the next round of training when the training is not over.
  • the second training result can be a gradient, which is the derivative of the weight in the training model.
  • the first polymerization result may be a polymerization gradient obtained after gradient polymerization.
  • the process of updating the training model can be to use the aggregate gradient to update the weight on the training model.
  • the process of weight update can be to subtract the aggregate gradient generated in this round from the current weight of the current round to obtain the updated weight.
  • the updated weight is used In the next round of training, the training model after updating the weights is the updated training model.
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data, and the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • the training node is a server, and the aggregation node has a scene.
  • FIG. 3 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the application.
  • the training node in the joint learning system can be a data center device such as a server.
  • the first aggregation node communicates with the plurality of training nodes through a network.
  • This scenario embodiment is different from the scenario embodiment corresponding to FIG. 2 above except that the training node is different.
  • the other ideas and processes are basically the same as the embodiment corresponding to FIG. 2 above. You can refer to the embodiment corresponding to FIG. 2 for understanding, and will not be repeated here Go into details.
  • the training node is a terminal device, and the aggregation node has multiple hierarchical scenarios.
  • Fig. 4 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the application.
  • the training nodes in the joint learning system can be understood with reference to Figure 2.
  • the second-level aggregation node can be called the second aggregation node, and the first TEE and the first REE are also configured on the second aggregation node.
  • the first TEE and the first REE on the second aggregation node please refer to the figure 1 Understand the corresponding content.
  • the training results of every 100 training nodes will be aggregated through a first aggregation node.
  • the 50 first aggregation nodes will get 50 first aggregation results, and the 50 first aggregation nodes will send the 50 first aggregation results to the second aggregation node at the second level.
  • the second aggregation node dispatches the 50 first aggregation results from the first REE of the second aggregation node to the first TEE for decryption, and performs an aggregation operation on the decrypted aggregation results to obtain the second aggregation result.
  • the process of scheduling the first aggregation result by the second aggregation node can be understood by referring to the process of scheduling the first training result in the scenario shown in FIG. 2 above.
  • the second aggregation result is the aggregation result used for the current round of training model update.
  • the second aggregation node can use the second aggregation result to update the training model, and then send the updated training model to each training node, and start the next round of training without the end of the training. It may also be that the second aggregation node sends the second aggregation result to each training node, and each training node updates the local training model, and starts the next round of training without the end of the training.
  • the training node is a server, and the aggregation node has multiple hierarchical aggregation scenarios.
  • FIG. 5 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the application.
  • the training node in the joint learning system can be a data center device such as a server.
  • the first aggregation node communicates with the plurality of training nodes through a network.
  • the related content of the first TEE and the first REE on the second aggregation node can be understood by referring to the related content corresponding to FIG. 1.
  • This scenario embodiment is different from the scenario embodiment corresponding to FIG. 4 above, except that the training node is different.
  • the other ideas and processes are basically the same as the embodiment corresponding to FIG. 4 above. You can refer to the embodiment corresponding to FIG. 4 for understanding and will not be repeated here Go into details.
  • the scenarios described in FIGS. 2 to 5 above are all scenarios where the aggregation node and the training node are not on the same computer device.
  • Computer devices in this scenario usually have high computing power and high communication capabilities. You can configure multiple virtual machines on the computer device, set one or more of them as aggregation nodes, and set other VMs as training node.
  • VM0 to VMx, VM(x+1) to VMn are all training nodes, and VMk and VMp are the first-level aggregation nodes, which may also be referred to as the first aggregation nodes.
  • VMq is a second-level aggregation node, and may also be referred to as a second aggregation node.
  • x, n, k, p, and q are all positive integers.
  • the aggregation level may have only one level, or there may be three or more levels.
  • the joint learning system in the form of a virtual machine described in Figure 6 only describes the situation where the aggregation node and the training node are both located on one computer device. It is also possible that these aggregation nodes and the training node are located on two or more different computer devices.
  • the joint composition is similar to the joint learning system in a computer device in Figure 6.
  • TEEs can also be configured in the training nodes.
  • the training node trains the training model in the second TEE and encrypts the training result. In this way, training the model in the second TEE can ensure that the training model will not be leaked, and the privacy of the training model can be ensured.
  • the training node may decrypt the encrypted training model in the second TEE to obtain the decrypted training model. In this way, the training node will not know the training model, thereby further ensuring the privacy of the training model.
  • the training node may also add noise to the training data; use the training data after adding noise to train the training model.
  • the process of adding noise can be called differential privacy processing in the industry. Adding noise can be understood as adding a small change to the training data to minimize the impact on the use of training data. The effect of single data recognition, thereby effectively avoiding training data leakage. Adding noise to the training data makes it difficult for the training model to reverse the original training data, thereby ensuring that it is difficult for the training model to record the training data, thereby further ensuring the privacy of the training data.
  • the training node sends the training result of the first training node in response to the first indication information of the random response strategy; the training node deletes the training result of the first training node in response to the second indication information of the random response strategy The training result of the first training node.
  • the random response strategy may be pre-configured.
  • the random response strategy may include first indication information or second indication information.
  • the first indication information may be 1 and the second indication information may be 0.
  • the first indication information may be true, and the second indication information may be false.
  • the random response strategy may be equivalent to secondary differential privacy processing, and the first training node determines whether to send the training result to the first aggregation node according to the random response strategy.
  • the random response strategy can be changed periodically.
  • the first indication information indicates to send the training result
  • the second indication information indicates not to send the training result, so that the first aggregation node cannot continuously get the same result.
  • the training result of a training node can further prevent the training data from being deduced from the training model, thereby further ensuring the privacy of the training data.
  • the training nodes in the scenarios shown in Figures 3 and 5 above may be servers in data centers, and these data centers may be bank data centers, hospital data centers, school data centers, and so on.
  • FIG. 7 is a schematic diagram of another scenario embodiment of a joint learning system provided by an embodiment of the application.
  • the training nodes in the joint learning system are located in the first data center, the second data center, and the third data center.
  • the center will be introduced as an example. If the model to be trained is a model for mass recognition, the first data center, the second data center, and the third data center may be data centers of several large hospitals, for example.
  • the joint learning system also includes a control node and a scheduling device, the control node can communicate with the model holding node, and receive the model training request of the model holding node and the training model that needs to be trained.
  • control node After the control node receives the training model, if the training node has been determined in advance, it can send the training model to the training node. If the training node is not determined in advance, the training node can be selected through the coordination device in each data center.
  • the coordination device and the control node in each data center can establish a trusted connection in advance, for example, a trusted gateway (trusted gateway) is configured.
  • a trusted gateway trusted gateway
  • the coordination device in each data center and the scheduling device in the aggregation center may also establish a trustworthy connection in advance, and the control node and the scheduling device in the aggregation center may also establish a trustworthy connection in advance.
  • the control node can determine which data type training node needs to be held according to the training model, and the number of training nodes needed, and then send the demand information for the training node to the coordination device in the data center, and the coordination device is based on the training node Determine the training node in the respective data, and then send the training model that needs to be trained to the determined training node. If the control node needs N training nodes, the data center side will provide N training nodes, N is a positive integer, usually The value of N will be at least tens, mostly hundreds or thousands.
  • the training model received by the training node may be an encrypted training model, and the key used to decrypt the training model may be pre-negotiated with the control node.
  • the training node puts the training model into the second TEE, and uses the key to decrypt the training model to obtain the plaintext of the training model. Then, the training node uses the training data to train the decrypted training model, and the training result is obtained.
  • the training result is encrypted.
  • the encrypted training result can be called the first training result, and the training result before encryption can be called the first training result. 2.
  • the training node may send the first training result to the scheduling device in the aggregation center through the coordination device.
  • the control node may also send the demand information for the aggregation node to the scheduling device in advance, and the demand information for the aggregation node may be the number of aggregation nodes required, the information of the aggregation level, and so on.
  • the scheduling device will prepare the corresponding number and level of aggregation nodes according to the demand information of the aggregation nodes. For example, if M aggregation nodes are required, the aggregation node level needs to be one or two layers. When the aggregation level is one layer, M's The value can be 1. When the aggregation level is two, M is usually an integer greater than 2.
  • the scheduling device After receiving the first training result, the scheduling device will schedule P first training results among the N first training results to a first aggregation node.
  • the first aggregation node After receiving the P first training results, the first aggregation node will Scheduling the P first training results into the first TEE of the first aggregation node; decrypting the P first training results in the first TEE to obtain P second training results; then , The first aggregation node aggregates the P second training results to obtain a first aggregation result, and the first aggregation result is used to update the training model or used in the next level of aggregation.
  • the processes of the Q first aggregation nodes performing aggregation are basically the same. They all perform the decryption and aggregation processes in the first TEE, and Q is a positive integer greater than 1.
  • the Q first aggregation nodes send the Q first aggregation results to the second aggregation node, and the second aggregation node schedules the encrypted Q first aggregation results from the first REE of the second aggregation node to the Decryption is performed in the first TEE of the second aggregation node to obtain Q first aggregation results; the second aggregation node aggregates the Q first aggregation results to obtain a second aggregation result, the second aggregation result Used to update the training model or used for the next level of aggregation.
  • the terminal device can also be operated using the centralized processing procedure described in Figure 7 above, and the terminal device can be divided by region. For example, the terminal equipment in Beijing is divided into the first data center, the terminal equipment in Shanghai is divided into the second data center, and the terminal equipment in Shenzhen is divided into the third data center. Through the terminal equipment of these three regions, the model used for "take-away ordering" is trained.
  • the specific training process and training principle can be understood with reference to the corresponding description in the above-mentioned Figure 7 part.
  • the key for decryption between the aggregation node and the training node may be pre-negotiated.
  • FIG. 8 is a schematic diagram of an embodiment of a method for aggregating training results provided by an embodiment of the present application.
  • an embodiment of a method for aggregating training results may include:
  • the first training node trains the training model.
  • the first training node is any one of the N training nodes.
  • the first training node encrypts the training result to obtain the first training result.
  • the first training node sends the first training result to the first aggregation node, and accordingly, the first aggregation node receives P first training results for the training model sent by the P training nodes.
  • the first aggregation node is an aggregation node at the first level among the M aggregation nodes.
  • P N
  • P N
  • the first aggregation node schedules the P first training results from the first REE of the first aggregation node to the first TEE of the first aggregation node.
  • the first aggregation node decrypts the P first training results in the first TEE to obtain P second training results.
  • the first aggregation node aggregates the P second training results in the first TEE to obtain a first aggregation result, where the first aggregation result is used to update the training model or is used for the next level of aggregation .
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data.
  • the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • the method may further include:
  • the first aggregation node sends the encrypted first aggregation result to the second aggregation node, and the encrypted first aggregation result is used by the second aggregation node in the first TEE of the second aggregation node
  • the first aggregation result is obtained by decryption, and the Q first aggregation results from the Q first aggregation nodes are used by the second aggregation node to aggregate in the first TEE of the second aggregation node to obtain the second aggregation
  • the second aggregation result is used to update the training model or used in the next level of aggregation, and Q is a positive integer greater than 1.
  • the aggregation operation is performed in the first TEE in the aggregation node of each aggregation level, thereby ensuring the privacy of the aggregation results of each level, and through multi-level aggregation
  • the efficiency of polymerization can also be improved.
  • the second aggregation node also updates the training model according to the second aggregation result, or the second aggregation node sends the encrypted second aggregation result to the N training nodes, so that the N training nodes according to the second aggregation result Update the training model.
  • the process of updating the training model can be to use the aggregate gradient to update the weight on the training model.
  • the process of weight update can be to subtract the aggregate gradient generated in this round from the current weight of the current round to obtain the updated weight.
  • the updated weight is used In the next round of training, the training model after updating the weights is the updated training model.
  • the above step 101 includes: the first training node trains the training model in the second TEE, and encrypts the training results to The first training result is obtained, and the training result of the first training node is one of the N first training results.
  • a second TEE is configured in the training node, and the model is trained in the second TEE to ensure that the training model will not be leaked, and the privacy of the training model is ensured.
  • the first training node before the first training node trains the training model in the second TEE, decrypts the encrypted training model in the second TEE to obtain the decryption After the training model.
  • the first training node decrypts the encrypted training model in the second TEE, which can further ensure the privacy of the training model.
  • step 101 it may further include: adding noise to the training data by the first training node; and training the training model by the first training node using the training data after adding noise.
  • the process of adding noise can be called differential privacy processing in the industry.
  • Adding noise can be understood as adding a small change to the training data to minimize the impact on the use of training data. The effect of single data recognition, thereby effectively avoiding training data leakage.
  • noise is added to the training data to make it difficult for the training model to reverse the original training data, thereby ensuring that the training model is difficult to record the training data, thereby further ensuring the privacy of the training data.
  • the first training node sends the training result of the first training node in response to the first indication information of the random response strategy; the first training node responds to the second indication of the random response strategy The information deletes the training result of the first training node.
  • the random response strategy may be pre-configured.
  • the random response strategy may include first indication information or second indication information.
  • the first indication information may be 1 and the second indication information may be 0.
  • the first indication information may be true, and the second indication information may be false.
  • the random response strategy may be equivalent to secondary differential privacy processing, and the first training node determines whether to send the training result to the first aggregation node according to the random response strategy.
  • the random response strategy can be changed periodically.
  • the first indication information indicates to send the training result
  • the second indication information indicates not to send the training result, so that the first aggregation node cannot continuously get the same result.
  • the training result of a training node can further prevent the training data from being deduced from the training model, thereby further ensuring the privacy of the training data.
  • the control node and the training node will negotiate the encryption key for the training model.
  • the aggregation node will negotiate with the training node the key used to encrypt the training result.
  • the first aggregation node and the second aggregation node will also negotiate the key used to encrypt the first aggregation result.
  • the key used to encrypt the training model can also be negotiated between the model holding node and the control node.
  • the model holding node uses the public key of the control node to encrypt the training model, and sends the encrypted model to the control node.
  • the control node uses the private key to decrypt the training model, and then the control node re-encrypts the training model with the key negotiated with the training node, and then sends the training model to the training node.
  • the training node has pre-negotiated the key with the control node, and the training node can use the key to decrypt the training model. If the training node is configured with a second TEE, the training node can decrypt the training model in the second TEE to obtain the plaintext of the training model.
  • the training node performs model training in the second TEE to obtain the second training result, encrypts the second training result, and obtains the first training result. Then the training node uses the key negotiated with the aggregation node to encrypt and sends each first aggregation node. After the first aggregation node decrypts the first training result in the first TEE, the aggregation operation is performed to obtain the first aggregation result. Taking only one aggregation node as an example, the first aggregation node uses the first aggregation result to update the training model. If the training does not end, the first aggregation node can encrypt the updated aggregation model with a key before sending it to each training node.
  • the first aggregation node encrypts the first aggregation result and sends it to each training node, and the training node uses the first aggregation result to update the local training model. If the training reaches the convergence condition and the model training ends, the first aggregation node may send the updated training model to the control node, and the control node sends the updated training model to the model holding node.
  • another embodiment of the method for aggregating training results provided in the embodiment of the present application may include:
  • the control node generates an asymmetric key pair, and synchronizes the public key A.pubkey to the model holding node, the aggregation node, and the training node.
  • the training node generates a symmetric key C.key, and uses A.pubkey to encrypt C.key.
  • the training node sends the C.key encrypted with A.pubkey to the control node and the aggregation node.
  • the aggregation node stores the symmetric key C.key of each training node in the first TEE, and the control node also stores the C.key.
  • the model holding node generates an asymmetric key pair including the public key O.pubkey and the private key O.privkey.
  • the model holding node uses A.pubkey to encrypt the training model.
  • the model holding node will use A.pubkey to encrypt the training model and the public key O.pubkey to send to the control node.
  • the control node uses A.pubkey to decrypt the encrypted training model to obtain the plaintext of the training model, and saves the public key O.pubkey.
  • the control node uses C.key to encrypt the training model.
  • the control node sends the training model encrypted with C.key to the training node.
  • the training model encrypted with C.key can also be sent to the aggregation node.
  • the training node uses C.key to decrypt the training model in the second TEE to obtain the plaintext of the training model.
  • the training node uses the training data to train the training model to obtain the second training result, and uses C.key to encrypt the second training result to obtain the first training result.
  • the training node sends the first training result to the aggregation node.
  • the aggregation node uses the C.key in the first TEE to decrypt the first training result, and performs an aggregation operation on multiple training results to obtain the first aggregation result.
  • the first aggregation result is used to update the training model.
  • the aggregation node can encrypt the trained model and send it to the control node using C.key.
  • the control node uses C.key to decrypt the trained model.
  • the control node uses O.pubkey to encrypt the trained model.
  • the control node sends the trained model encrypted with O.pubkey to the model holding node.
  • the model holding node uses O.privkey to decrypt to obtain the plaintext of the trained model.
  • the aggregation node provided by the embodiment of the present application is applied to a joint learning system.
  • the joint learning system further includes N training nodes, where N is a positive integer, and the aggregation node is configured with a first rich node.
  • the execution environment REE and the first trusted execution environment TEE, the aggregation node 30 may include:
  • the receiving unit 301 is configured to receive P first training results for the training model sent by the P training nodes, where the first training results are obtained by encrypting the second training results by the training nodes, so The second training result is obtained by training the training model by the training node, P is a positive integer, and P ⁇ N;
  • the processing unit 302 is used to:
  • the encrypted first training result is transmitted from the training node to the aggregation node, which can ensure that the training result will not be leaked during the transmission process.
  • the first aggregation node decrypts the first training result in the first TEE, and then aggregates, which can ensure that the training result will not be leaked during the aggregation process.
  • the transmission and aggregation of training results will not be leaked to ensure the privacy of the data.
  • the training node and the aggregation node only need to transmit the encrypted training results once to achieve the aggregation of the training results, which reduces the communication overhead and improves the computational efficiency.
  • the aggregation node 30 may further include:
  • the sending unit 303 is configured to send the encrypted first aggregation result to the second aggregation node, where the encrypted first aggregation result is used by the second aggregation node in the first TEE of the second aggregation node
  • the first aggregation result is obtained by decryption
  • the Q first aggregation results from the Q first aggregation nodes are used by the second aggregation node to aggregate in the first TEE of the second aggregation node to obtain the second aggregation
  • the second aggregation result is used to update the training model or used in the next level of aggregation, and Q is a positive integer greater than 1.
  • the training node provided by the embodiment of the present application is applied to a joint learning system
  • the joint learning system further includes M aggregation nodes, where M is a positive integer, and the same training model is configured on the N training nodes
  • the first rich execution environment REE and the first trusted execution environment TEE are configured in the M aggregation nodes
  • the second TEE is configured in the training node
  • the training node 40 may include:
  • the processing unit 401 is used to:
  • the sending unit 402 is configured to send the first training result to the first aggregation node, where the first training result is used by the first aggregation node to aggregate results in the first TEE.
  • a second TEE is configured in the training node, and the second TEE can be understood by referring to the description of the first TEE in the first aspect. Training the model in the second TEE can ensure that the training model will not be leaked, and the privacy of the training model can be ensured.
  • the processing unit 401 is further configured to decrypt the encrypted training model in the second TEE of the first training node to obtain the decrypted training model.
  • processing unit 401 is further configured to:
  • the training model is trained using the training data added with noise.
  • the sending unit 402 is configured to send the training result of the first training node in response to the first indication information of the random response strategy
  • the processing unit 401 is configured to delete the training result of the first training node in response to the second indication information of the random response strategy.
  • FIG. 12 shows a schematic diagram of a possible logical structure of the computer device 50 involved in the above-mentioned embodiments provided by the embodiments of this application.
  • the computer device 50 may be the aforementioned aggregation node or a training node.
  • the computer device 50 includes a processor 501, a communication interface 502, a memory 503, and a bus 504.
  • the processor 501, the communication interface 502, and the memory 503 are connected to each other through a bus 504.
  • the processor 501 is used to control and manage the actions of the computer device 50.
  • the processor 501 is used to execute steps 101, 102, 104 to 106 in FIG. Describe the other processes of the technology.
  • the communication interface 502 is used to support the computer device 50 to communicate.
  • the memory 503 is used to store the program code and data of the computer device 50.
  • the processor 501 may be a central processing unit, a general-purpose processor, a digital signal processor, an application specific integrated circuit, a field programmable gate array, or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute various exemplary logical blocks, modules, and circuits described in conjunction with the disclosure of this application.
  • the processor may also be a combination that implements computing functions, for example, a combination of one or more microprocessors, a combination of a digital signal processor and a microprocessor, and so on.
  • the bus 504 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc.
  • PCI Peripheral Component Interconnect
  • EISA Extended Industry Standard Architecture
  • the present application also provides a chip system that includes a processor for supporting the aforementioned aggregation node or training node to realize its related functions, for example, receiving or processing the data involved in the aforementioned method embodiment.
  • the chip system further includes a memory, and the memory is used to store necessary program instructions and data of the terminal device.
  • the chip system can be composed of chips, or include chips and other discrete devices.
  • a computer-readable storage medium is also provided, and computer-executable instructions are stored in the computer-readable storage medium.
  • the device executes the above-mentioned figure. The method described in part of the embodiment from 8 to 9.
  • a computer program product in another embodiment, includes computer-executable instructions, and the computer-executable instructions are stored in a computer-readable storage medium; at least one processor of the device can be accessed from a computer.
  • the read storage medium reads the computer-executed instruction, and at least one processor executes the computer-executed instruction to make the device execute the method described in the above-mentioned partial embodiments of FIGS. 8-9.
  • the disclosed system, device, and method may be implemented in other ways.
  • the device embodiments described above are merely illustrative, for example, the division of the units is only a logical function division, and there may be other divisions in actual implementation, for example, multiple units or components may be combined or It can be integrated into another system, or some features can be ignored or not implemented.
  • the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solutions of the embodiments.
  • the functional units in the various embodiments of the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solutions of the embodiments of the present application are essentially or the part that contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium.
  • Including several instructions to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code .

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Artificial Intelligence (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种联合学习系统，应用于人工智能AI技术领域。该联合学习系统包括M个聚合节点(30)和N个训练节点(40)，M个聚合节点(30)中都配置有TEE和REE，M个聚合节点(30)中包括第一聚合节点。第一聚合节点接收P个训练节点(40)发送的针对训练模型的P个加密的第一训练结果，P≤N；第一聚合节点将P个第一训练结果调度到第一聚合节点的第一TEE中进行解密并聚合，以得到第一聚合结果，第一聚合结果用于更新训练模型或者用于下一级聚合。所述系统中训练结果的传输和聚合都不会被泄露，保证了数据的隐私性，而且训练节点(40)和聚合节点(30)只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。

Description

一种联合学习系统、训练结果聚合的方法及设备
本申请要求于2019年10月29日提交中国专利局、申请号为201911041366.2、发明名称为“一种联合学习系统、训练结果聚合的方法及设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及人工智能(artificial intelligence,AI)技术领域，具体涉及一种联合学习系统、训练结果聚合的方法及设备。
背景技术
联合学习(Federated Learning)是一种模型训练方案，云设备可以联合多个终端设备共同训练模型，同时解决隐私问题。联合学习有多轮训练过程，每轮按照一定的规则筛选多个终端设备共同参与训练，一定程度上解决了端侧样本数据量较少的问题。联合学习过程中用户隐私数据在端侧本地使用，无需上传到云侧，可以解决隐私泄露问题。每个端侧训练得到的训练结果要上传到云侧，云侧对多个端侧上传的训练结果进行聚合，然后再将聚合后的结果下发给端侧。
考虑到通过训练结果可以反推出来训练数据，如果训练结果在从终端设备传输到云设备的过程中泄露或者在云设备执行聚合操作前泄露都会导致训练数据泄露。所以联合学习利用安全聚合(secure aggregation，SA)方法来保证训练结果不会泄露。SA方法中使用秘密共享(secret sharing，SS)的方式来对训练结果进行加密，从而保证训练结果的安全性。
采用SS的方式，每一次聚合需要执行以下过程：用户集U中的终端设备在本地生成对称密钥对，并将带有签名的公钥发送给云设备，云设备收到了用户集U1(U1∈U)的公钥，并将公钥列表广播给U1中的所有终端设备。U1中的终端设备根据公钥列表中终端设备的数量将训练结果切分为对应数量的共享片(share)，并为每一个share随机加上一个噪声向量b，分别使用不同终端设备的公钥加密各个带有噪声b的share。终端设备将各个带有噪声b的share的密文发送给云设备。云设备收到了用户集U2(U2∈U1)的密文。云设备将收到的密文下发给U2中的终端设备，U2中的终端设备使用自己的密钥解密出使用自己公钥加密的密文，计算出中间结果y并发送给云设备，云设备收到了用户集U3(U3∈U2)的中间结果y。云设备广播U3用户的名单，如果U3中终端设备的数量小于要求实现聚合计算的最少终端设备数量t则终止聚合，如果U3中终端设备的数量不小于t,则收到名单的终端设备返回签名给云设备；云设备收集到了用户集U4(U4∈U3)的签名。云设备广播U4中终端设备的签名列表以确定存活用户，存活用户指的是没有掉线的终端设备。如果U4中存活用户的数量少于t则终止聚合。如果U4中存活用户的数量不少于t，则存活用户将生成噪声b的明文，并为掉线用户重新生成采用自身公钥加密的share密文，将噪声b的明文和采用自身公钥加密的share密文先发送给云设备，再将为掉线用户生成的密文对应的私钥送给云设备。云设备采用接收到的私钥解密掉线用户的密文，生成掉线用户的中间结果，并使用噪声b的明文对用户集U3的中间结果进行去噪处理，使用掉线用户的中间结果和存活用户去噪后的中间结果进行计算，得到聚合结果明文，聚合流程结束。
由上述SS的方式可知，实现一次聚合需要每个参与计算的终端设备与云设备进行多轮通信，并且终端设备也要切分训练数据以及计算中间结果，导致通信开销大，计算效率低下。
发明内容
本申请实施例提供一种联合学习系统以及训练结果聚合的方法，可以在保证训练数据隐私性的前提下降低通信开销，提高计算效率。本申请实施例还提供了相应的设备。
本申请第一方面提供一种联合学习系统，该联合学习系统包括M个聚合节点和N个训练节点，M和N都为正整数，N个训练节点上配置有相同的训练模型，M个聚合节点中都配置有第一富执行环境(rich execution environment，REE)和第一可信执行环境(trusted execution environment，TEE)，M个聚合节点中包括第一聚合节点。
第一聚合节点接收P个训练节点发送的针对该训练模型的P个第一训练结果，该第一训练结果是训练节点对第二训练结果进行加密得到的，该第二训练结果是训练节点训练该训练模型得到的，P为正整数，且P≤N。所述第一聚合节点将所述P个第一训练结果从所述第一聚合节点的第一REE中调度到到所述第一聚合节点的第一TEE中；第一聚合节点在所述第一TEE中解密所述P个第一训练结果，以得到P个第二训练结果；第一聚合节点在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
该第一方面中，聚合节点和训练节点可以是在不同的计算机设备上，也可以是在同一计算机设备上。当聚合节点和训练节点在不同的计算机设备上时，聚合节点可以是服务器或者其他计算设备，训练节点可以是服务器，也可以是例如手机、电脑、个人计算机(personal computer，PC)、平板电脑、智能手表、智能手环等终端设备。当聚合节点和训练节点在同一计算机设备上时，聚合节点和训练节点可以是该计算机设备上的不同虚拟机(virtual machine，VM)。第一TEE可以是在聚合节点的主处理器内分离出的一块安全区域，也可以是一个独立于主处理器的TEE芯片，第一TEE对外提供安全服务，能够保证在其中加载的代码和数据在机密性和完整性方面受到保护。第一REE与第一TEE是并行运行的，相对于第一TEE来说，第一REE没有第一TEE的安全性高，聚合节点从外界接收的第一训练结果会先到达第一REE，然后从第一REE中被调度到第一TEE中，调度过程可以基于REE和TEE的通信来实现。训练节点采用训练数据对训练模型进行训练会得到第二训练结果，对该第二训练结果进行加密就得到第一训练结果。第一聚合结果可以是P个第二训练结果的平均值或者加权后的平均值。第二训练结果可以梯度，梯度是训练模型中权重的导数。第一聚合结果可以是梯度聚合后得到的聚合梯度。M的取值可以是1，也可以是其他更大的数值。当M＝1时，一个聚合节点就可以对N个训练节点的训练结果进行聚合，这时，第一聚合结果就是最终的聚合结果，可以直接用于更新训练模型。当M＞1时，可能是因为有很多个训练节点，一个聚合节点可能无法处理太多的数据，这时就需要多个聚合节点来组成分级聚合结构，先由第一级的聚合节点对训练节点的训练结果进行一级聚合，然后再由下一级聚合节点对第一聚合结果进行聚合。
由该第一方面可知，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然 后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
在第一方面的一种可能的实现方式中，M个聚合节点中还包括第二聚合节点。
所述第二聚合节点接收Q个所述第一聚合节点发送的加密后的Q个第一聚合结果，Q为大于1的正整数；
所述第二聚合节点将所述加密后的Q个第一聚合结果从所述第二聚合节点的第一REE调度到第一TEE中进行解密，以得到Q个第一聚合结果；
所述第二聚合节点在所述第一TEE中聚合所述Q个第一聚合结果，以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合。
该种可能的实现方式中，第二聚合节点是第二层级的聚合节点，若聚合层级只有两层，则该第二聚合节点聚合后得到的第二聚合结果可以用于更新训练模型，若聚合结构中还有第三层级或者更多层级，则该第二聚合结果会被传递给第三层级。该种可能的实现方式中，无论有多少个聚合层级，在每个聚合层级的聚合节点中都是在第一TEE中执行聚合操作，从而保证了每一层级聚合结果的隐私性，另外，通过分层聚合的方式更有利于训练节点较多的场景下实现高效聚合。
在第一方面的一种可能的实现方式中，若M＝1，则第一聚合节点还根据第一聚合结果更新训练模型，或者第一聚合节点向N个训练节点发送加密后的第一聚合结果，从而使N个训练节点根据第一聚合结果更新训练模型。
更新训练模型的过程可以是用聚合梯度更新训练模型上的权重，权重更新的过程可以是用本轮当前的权重减去本轮产生的聚合梯度，得到更新后的权重，该更新后的权重用于下一轮训练，更新权重后的训练模型就是更新后的训练模型。
在第一方面的一种可能的实现方式中，所述N个训练节点中分别配置有第二TEE，针对所述N个训练节点中的每个第一训练节点；
所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练，并对训练得到的结果进行加密，以得到所述第一训练节点的训练结果，所述第一训练节点的训练结果为所述N个第一训练结果中的一个。
该种可能的实现方式中，训练节点中配置有第二TEE，在第二TEE中训练模型，可以确保训练模型不会泄露，确保了训练模型的隐私性。
在第一方面的一种可能的实现方式中，所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练之前，所述第一训练节点在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
该种可能的实现方式中，第一训练节点在第二TEE中对加密的训练模型进行解密，可以进一步确保训练模型的隐私性。
在第一方面的一种可能的实现方式中，所述第一训练节点在训练数据中加入噪声；所述第一训练节点使用加入噪声后的训练数据对所述训练模型进行训练。
该种可能的实现方式中，加入噪声的过程在行业内的学名可以称为差分隐私处理，加 入噪声可以理解为是在训练数据中加入一点微小的改动，在最小化影响训练数据使用的情况下，最大限度减少对数据源中单个数据的识别的效果，从而有效的避免训练数据泄露。该种可能的实现方式中，通过在训练数据中加入噪声使得训练模型难以反推出原本的训练数据，由此保证训练模型难以记录训练数据，从而进一步保证了训练数据的隐私性。
在第一方面的一种可能的实现方式中，所述第一训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；所述第一训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
该种可能的实现方式中，随机响应策略可以是预先配置好的，例如：该随机响应策略可以包括第一指示信息或第二指示信息，例如：该第一指示信息可以是1，该第二指示信息可以是0。该第一指示信息可以是ture，该第二指示信息可以是false。第一训练节点得到训练结果后，可以根据第一指示信息或第二指示信息确定是否发送训练结果。随机响应策略可以相当于二次差分隐私处理，第一训练节点根据随机响应策略确定是否将训练结果发送给第一聚合节点。随机响应策略是可以周期性变化的，可以在本训练周期是第一指示信息指示发送训练结果，在下一个训练周期是第二指示信息指示不发送训练结果，这样使第一聚合节点不能连续得到同一个训练节点的训练结果可以进一步防止从训练模型反推出训练数据，从而进一步保证了训练数据的隐私性。
在第一方面的一种可能的实现方式中，所述联合学习系统还包括控制节点，所述控制节点接收所述训练模型；所述控制节点向所述N个训练节点发送所述训练模型。
该种可能的实现方式中，控制节点可以根据训练模型的需求，为该训练模型选择合适的训练节点，再将训练模型发送到这些合适的训练节点上。
在第一方面的一种可能的实现方式中，所述联合学习系统还包括调度装置，
所述控制节点向所述调度装置发送对于聚合节点的聚合节点需求信息，所述需求信息包括需要所述聚合节点的数量和/或聚合层级信息；
所述调度装置根据所述聚合节点需求信息确定用于聚合的所述M个聚合节点。
该种可能的实现方式中，控制节点可以根据所选择的训练节点的数量来确定聚合节点的数量和/或聚合层级信息等。调度装置可以根据该需求信息，从聚合资源中为本次训练模型配置相应的M个聚合节点。
本申请第二方面提供一种训练结果聚合的方法，该方法应用于联合学习系统，该联合学习系统包括M个聚合节点和N个训练节点，M和N都为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一REE和第一TEE，M个聚合节点中包括第一聚合节点；该方法可以包括：第一聚合节点接收所述P个训练节点发送的针对所述训练模型的P个第一训练结果，所述第一训练结果是所述训练节点对第二训练结果进行加密得到的，所述第二训练结果是所述训练节点训练所述训练模型得到的，P为正整数，且P≤N；第一聚合节点将所述P个第一训练结果从所述第一聚合节点的第一REE中调度到所述第一聚合节点的第一TEE中；第一聚合节点在所述第一TEE中解密所述P个第一训练结果，以得到P个所述第二训练结果；第一聚合节点在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
该第二方面中，聚合节点和训练节点可以是在不同的计算机设备上，也可以是在同一计算机设备上。当聚合节点和训练节点在不同的计算机设备上时，聚合节点可以是服务器或者其他计算设备，训练节点可以是服务器，也可以是例如手机、电脑、PC等终端设备。当聚合节点和训练节点在同一计算机设备上时，聚合节点和训练节点可以是该计算机设备上的不同VM。TEE可以是在聚合节点的主处理器内分离出的一块安全区域，也可以是一个独立于主处理器的TEE芯片，TEE对外提供安全服务，能够保证在其中加载的代码和数据在机密性和完整性方面受到保护。REE与TEE是并行运行的，相对于TEE来说，REE没有TEE的安全性高，聚合节点从外界接收的第一训练结果会先到达第一REE，然后从第一REE中被调度到第一TEE中。训练节点采用训练数据对训练模型进行训练会得到第二训练结果，对该第二训练结果进行加密就得到第一训练结果。第一聚合结果可以是P个第二训练结果的平均值或者加权后的平均值。第二训练结果可以梯度，梯度是训练模型中权重的导数。第一聚合结果可以是梯度聚合后得到的聚合梯度。M的取值可以是1，也可以是其他更大的数值。当M＝1时，一个聚合节点就可以对N个训练节点的训练结果进行聚合，这时，第一聚合结果就是最终的聚合结果，可以直接用于更新训练模型。当M＞1时，可能是因为有很多个训练节点，一个聚合节点可能无法处理太多的数据，这时就需要多个聚合节点来组成分级聚合结构，先由第一级的聚合节点对训练节点的训练结果进行一级聚合，然后再由下一级聚合节点对第一聚合结果进行聚合。
由该第二方面可知，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且，训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
在第二方面的一种可能的实现方式中，所述M个聚合节点中还包括第二聚合节点，所述方法还包括：
所述第一聚合节点向所述第二聚合节点发送加密后的第一聚合结果，所述加密后的第一聚合结果被所述第二聚合节点在所述第二聚合节点的第一TEE中解密得到所述第一聚合结果，来自于Q个第一聚合节点的Q个第一聚合结果用于所述第二聚合节点在所述第二聚合节点的第一TEE中聚合以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合，Q为大于1的正整数。
该种可能的实现方式中，第二聚合节点是第二层级的聚合节点，若聚合层级只有两层，则该第二聚合节点聚合后得到的第二聚合结果可以用于更新训练模型，若聚合结构中还有第三层级或者更多层级，则该第二聚合结果会被传递给第三层级。该种可能的实现方式中，无论有多少个聚合层级，在每个聚合层级的聚合节点中都是在第一TEE中执行聚合操作，从而保证了每一层级聚合结果的隐私性，而且通过多级聚合还可以提高聚合的效率。
本申请第三方面提供一种训练结果聚合的方法，该方法应用于联合学习系统，该联合学习系统包括M个聚合节点和N个训练节点，M和N都为正整数，N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一富执行环境REE和第一可信执行环境TEE，所 述M个聚合节点中包括第一聚合节点，所述N个训练节点中分别配置有第二TEE，针对所述N个训练节点中的每个第一训练节点，该方法可以包括：所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练；所述第一训练节点在所述第二TEE中对训练得到的结果进行加密，以得到所述第一训练节点的第一训练结果；所述第一训练节点向第一聚合节点发送所述第一训练结果，所述第一训练结果用于所述第一聚合节点在第一TEE中进行结果聚合。
第三方面中，训练节点中配置有第二TEE，第二TEE可以参阅第一方面中对第一TEE的描述进行理解。在第二TEE中训练模型，可以确保训练模型不会泄露，确保了训练模型的隐私性。
在第三方面的一种可能的实现方式中，所述第一训练节点在所述第一训练节点的第二TEE中对训练模型进行训练之前，所述方法还可以包括：
所述第一训练节点在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
训练节点中配置有第二TEE，这样可以确保训练模型在第二TEE中被训练，不会泄露，确保了训练模型的隐私性。
在第三方面的一种可能的实现方式中，该方法还可以包括：
所述第一训练节点在训练数据中加入噪声；
所述第一训练节点使用加入噪声后的训练数据对所述训练模型进行训练。
该种可能的实现方式中，加入噪声的过程在行业内的学名可以称为差分隐私处理，加入噪声可以理解为是在训练数据中加入一点微小的改动，在最小化影响训练数据使用的情况下，最大限度减少对数据源中单个数据的识别的效果，从而有效的避免训练数据泄露。该种可能的实现方式中，通过在训练数据中加入噪声使得训练模型难以反推出原本的训练数据，由此保证训练模型难以记录训练数据，从而进一步保证了训练数据的隐私性。
在第三方面的一种可能的实现方式中，该方法还可以包括：
所述第一训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；
所述第一训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
该种可能的实现方式中，随机响应策略可以是预先配置好的，例如：该随机响应策略可以包括第一指示信息或第二指示信息，例如：该第一指示信息可以是1，该第二指示信息可以是0。该第一指示信息可以是ture，该第二指示信息可以是false。第一训练节点得到训练结果后，可以根据第一指示信息或第二指示信息确定是否发送训练结果。随机响应策略可以相当于二次差分隐私处理，第一训练节点根据随机响应策略确定是否将训练结果发送给第一聚合节点。随机响应策略是可以周期性变化的，可以在本训练周期是第一指示信息指示发送训练结果，在下一个训练周期是第二指示信息指示不发送训练结果，这样使第一聚合节点不能连续得到同一个训练节点的训练结果可以进一步防止从训练模型反推出训练数据，从而进一步保证了训练数据的隐私性。
本申请第四方面提供一种聚合节点，该聚合节点具有实现上述第二方面或第二方面任意一种可能实现方式的方法的功能。或该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元，例如：接收单元、处理单元和发送单元。
本申请第五方面提供一种训练节点，该训练节点具有实现上述第三方面或第三方面任意一种可能实现方式的方法的功能。或该功能可以通过硬件实现，也可以通过硬件执行相应的软件实现。该硬件或软件包括一个或多个与上述功能相对应的单元，例如：接收单元、处理单元和发送单元。
本申请第六方面提供一种计算机设备，该计算机设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当所述计算机执行指令被所述处理器执行时，所述处理器执行如上述第二方面或第二方面任意一种可能的实现方式所述的方法。
本申请第七方面提供一种计算机设备，该计算机设备包括至少一个处理器、存储器、输入/输出(input/output，I/O)接口以及存储在存储器中并可在处理器上运行的计算机执行指令，当所述计算机执行指令被所述处理器执行时，所述处理器执行如上述第三方面或第三方面任意一种可能的实现方式所述的方法。
本申请第八方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当所述计算机执行指令被处理器执行时，所述处理器执行如上述第二方面或第二方面任意一种可能的实现方式所述的方法。
本申请第九方面提供一种存储一个或多个计算机执行指令的计算机可读存储介质，当所述计算机执行指令被处理器执行时，所述处理器执行如上述第三方面或第三方面任意一种可能的实现方式所述的方法。
本申请第十方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当所述计算机执行指令被所述处理器执行时，所述处理器执行上述第二方面或第二方面任意一种可能实现方式的方法。
本申请第十一方面提供一种存储一个或多个计算机执行指令的计算机程序产品，当所述计算机执行指令被所述处理器执行时，所述处理器执行上述第三方面或第三方面任意一种可能实现方式的方法。
本申请第十二方面提供了一种芯片系统，该芯片系统包括处理器，用于支持训练节点实现上述第二方面或第二方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存训练节点必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
本申请第十三方面提供了一种芯片系统，该芯片系统包括处理器，用于支持训练节点实现上述第三方面或第三方面任意一种可能的实现方式中所涉及的功能。在一种可能的设计中，芯片系统还可以包括存储器，存储器，用于保存训练节点必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
其中，第四、第六、第八、第十和第十二方面或者其中任一种可能实现方式所带来的 技术效果可参见第二方面或第二方面不同可能实现方式所带来的技术效果，此处不再赘述。
其中，第五、第七、第九、第十一和第十三方面或者其中任一种可能实现方式所带来的技术效果可参见第三方面或第三方面不同可能实现方式所带来的技术效果，此处不再赘述。
本申请实施例提供的联合学习系统以及训练结果聚合的方法，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
附图说明
图1是本申请实施例提供的计算机设备的一结构示意图；
图2是本申请实施例提供的联合学习系统的一场景实施例示意图；
图3是本申请实施例提供的联合学习系统的另一场景实施例示意图；
图4是本申请实施例提供的联合学习系统的另一场景实施例示意图；
图5是本申请实施例提供的联合学习系统的另一场景实施例示意图；
图6是本申请实施例提供的联合学习系统的另一场景实施例示意图；
图7是本申请实施例提供的联合学习系统的另一场景实施例示意图；
图8是本申请实施例提供的训练结果聚合的方法的一实施例示意图；
图9是本申请实施例提供的训练结果聚合的方法的另一实施例示意图；
图10是本申请实施例提供的聚合节点的一实施例示意图；
图11是本申请实施例提供的训练节点的一实施例示意图；
图12是本申请实施例提供的计算机设备的另一实施例示意图。
具体实施方式
下面结合附图，对本申请的实施例进行描述，显然，所描述的实施例仅仅是本申请一部分的实施例，而不是全部的实施例。本领域普通技术人员可知，随着技术发展和新场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
本申请实施例提供一种联合学习系统以及训练结果聚合的方法，可以在保证训练数据隐私性的前提下降低通信开销，提高计算效率。本申请实施例还提供了相应的设备。以下分别进行详细说明。
联合学习系统简单来说就是聚合节点结合训练节点实现模型训练的系统。训练节点可以是终端设备，也可以是服务器等类型的计算机设备，还可以是计算机设备上的虚拟机。聚合节点可以有一个，也可以有多个，聚合节点有多个时可以分层级聚合训练结果。无论是聚合节点有一个还是有多个，每个聚合节点上都配置有第一可信执行环境(trusted execution environment，TEE)，第一EE可以是在聚合节点的主处理器内分离出的一块安全区域，也可以是一个独立于主处理器的TEE芯片，第一TEE对外提供安全服务，能够保证在其中加载的代码和数据在机密性和完整性方面受到保护。第一富执行环境(rich execution environment，REE)与第一TEE是并行运行的，相对于第一TEE来说，第一REE没有第一TEE的安全性高。训练节点上也可以配置有TEE，本申请实施例中，训练节点上的TEE称为第二TEE，无论是在聚合节点上，还是在训练节点上，REE与TEE的结构都是相同的，下面结合图1所示的计算机设备的一结构示意图进行理解。
该图1所示的计算机设备上部署有
Figure PCTCN2020109930-appb-000001
系统，该系统包含REE和TEE，REE和TEE上分别运行有
Figure PCTCN2020109930-appb-000002
操作系统和一种TEE操作系统(例如开源的
Figure PCTCN2020109930-appb-000003
操作系统)。
Figure PCTCN2020109930-appb-000004
操作系统和TEE OS又分为用户态和内核态。REE侧的用户态内部署了多个客户端应用(client application,CA)，例如人脸识别CA、指纹识别CA等。TEE侧的用户态内部署了多个可信应用(trusted application，TA)，例如指纹识别TA、人脸识别TA等。REE侧的内核态内部署了
Figure PCTCN2020109930-appb-000005
组件，TEE侧的内核态则部署了可信核心组件。REE中的CA与TEE中的TA构成了类似client/server的架构，CA作为客户端，TA作为服务端，由CA端发起访问操作，两者通过REE通信代理、硬件层的消息通道以及TEE通信代理交互数据，三者为CA和TA建立了安全的通信通道，一定程度上确保了数据传输的安全性。具体的，CA调用TEE客户端API(application program interface)来和对应的TA实现通信；TA调用TEE内部API(internal API)来使用TEE提供的编程资源实现相关功能。
上述描述了本申请实施例提供的联合学习系统可以有多种场景，下面分别针对不同场景的联合学习系统进行介绍。
1、训练节点是终端设备，聚合节点有一个的场景。
图2为本申请实施例提供的联合学习系统的一场景实施例示意图。
如图2所示，该联合学习系统中训练节点可以为手机、平板电脑、笔记本电脑、个人电脑、智能手表、智能手环等终端设备。第一聚合节点与多个训练节点之间通过网络通信。第一聚合节点上配置的第一TEE和第一REE可以参阅上述图1中TEE和REE的描述进行理解。
每个训练节点上都存储有相同的训练模型，每个训练节点可以使用各自的训练数据对训练模型进行训练，从而得到训练结果，然后对该训练结果加密，将加密后的训练结果通过网络发送给第一聚合节点。
第一聚合节点接收到加密后的第一训练结果后，该第一训练结果会先进入第一REE，可以将该第一训练结果从第一REE中调度到第一TEE中解密，然后在第一TEE中对解密后得到第二训练结果进行聚合，得到第一聚合结果。将该第一训练结果从第一REE中调度到第一TEE中的过程结合上述图1的架构可以理解为CA端发起访问操作，将第一训练结果通过REE通信代理、硬件层的消息通道以及TEE通信代理传递到第一TEE中。
因为该场景中，只需要一个第一聚合节点就可以完成聚合，所以该第一聚合结果就是用于本轮训练模型更新的聚合结果。
第一聚合节点可以使用该第一聚合结果，更新训练模型，然后再将更新后的训练模型发送给各训练节点，在训练没结束的情况下开始下一轮训练。也可以是第一聚合节点将第一聚合结果发送给各训练节点，由各训练节点各自更新本地的训练模型，在训练没结束的情况下开始下一轮训练。
第二训练结果可以梯度，梯度是训练模型中权重的导数。第一聚合结果可以是梯度聚合后得到的聚合梯度。更新训练模型的过程可以是用聚合梯度更新训练模型上的权重，权重更新的过程可以是用本轮当前的权重减去本轮产生的聚合梯度，得到更新后的权重，该更新后的权重用于下一轮训练，更新权重后的训练模型就是更新后的训练模型。
本申请实施例提供的联合学习系统，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
2、训练节点是服务器，聚合节点有一个的场景。
图3为本申请实施例提供的联合学习系统的另一场景实施例示意图。
如图3所示，该联合学习系统中训练节点可以为服务器等数据中心设备。第一聚合节点与多个训练节点之间通过网络通信。
该场景实施例与上述图2对应的场景实施例只是训练节点不同，其他思想与过程与上述图2对应的实施例基本相同，可以参阅上述图2对应的实施例进行理解，此处不再重复赘述。
3、训练节点是终端设备，聚合节点有多个分层级的场景。
图4为本申请实施例提供的联合学习系统的另一场景实施例示意图。
如图4所示，该联合学习系统中的训练节点可以参阅图2部分进行理解。该联合学习系统中的聚合节点有多个，而且做了层级划分。虽然图4中只示出了两个层级，但不应将其理解为是对层级数量的限定，实际上也可以是三层或者更多层级。
第二层级的聚合节点可以称为第二聚合节点，第二聚合节点上也配置有第一TEE和第一REE，该第二聚合节点上的第一TEE和第一REE的相关内容可以参阅图1所对应的相关内容进行理解。
该场景下，以有5000个训练节点为例，每100个训练节点的训练结果会通过一个第一聚合节点来聚合。这样，第一聚合节点有50个。50个第一聚合节点会得到50个第一聚合结果，这50个第一聚合节点将这50个第一聚合结果发送给第二层级的第二聚合节点。第二聚合节点将这50个第一聚合结果从该第二聚合节点的第一REE中调度到第一TEE中解密，并对解密后的聚合结果执行聚合操作，得到第二聚合结果。第二聚合节点种调度第一聚合结果的过程可以参阅上述图2所示场景中调度第一训练结果的过程进行理解。
因为该场景中有两个层级，所以第二聚合结果就是用于本轮训练模型更新的聚合结果。
第二聚合节点可以使用该第二聚合结果，更新训练模型，然后再将更新后的训练模型 发送给各训练节点，在训练没结束的情况下开始下一轮训练。也可以是第二聚合节点将第二聚合结果发送给各训练节点，由各训练节点各自更新本地的训练模型，在训练没结束的情况下开始下一轮训练。
本申请实施例中，虽然只示出了两个聚合层级，但无论有多少个聚合层级，在每个聚合层级的聚合节点中都是在TEE中执行聚合操作，从而保证了每一层级聚合结果的隐私性，另外，通过分层聚合的方式更有利于训练节点较多的场景下实现高效聚合。
4、训练节点是服务器，聚合节点有多个分层级聚合的场景。
图5为本申请实施例提供的联合学习系统的另一场景实施例示意图。
如图5所示，该联合学习系统中训练节点可以为服务器等数据中心设备。第一聚合节点与多个训练节点之间通过网络通信。该第二聚合节点上的第一TEE和第一REE的相关内容可以参阅图1所对应的相关内容进行理解。
该场景实施例与上述图4对应的场景实施例只是训练节点不同，其他思想与过程与上述图4对应的实施例基本相同，可以参阅上述图4对应的实施例进行理解，此处不再重复赘述。
上述图2至图5所描述的场景都是聚合节点与训练节点不在同一个计算机设备上的场景，下面结合图6描述聚合节点和训练节点在同一个计算机设备上的场景。这种场景下的计算机设备通常都具有高计算能力与高通信能力，可以在该计算机设备上配置多个虚拟机，将其中的一个或多个VM设置为聚合节点，将其他的VM设置为训练节点。
如图6所示，VM0至VMx，VM(x+1)至VMn都是训练节点，VMk和VMp是第一层级的聚合节点，也可以称为第一聚合节点。VMq是第二层级的聚合节点，也可以称为第二聚合节点。其中，x＞1，n＞(x+1)，且x、n、k、p和q都为正整数。当然，此处只是以两层聚合层级为例进行举例，实际上，聚合层级可以只有一级，也可以有三级或更多级。
关于虚拟机作为聚合节点时的工作过程可以参阅上述图4所描述的过程进行理解。
图6所描述的虚拟机形式的联合学习系统只描述了聚合节点和训练节点都位于一个计算机设备上的情况，还可能是这些聚合节点和训练节点位于两个或多个不同的计算机设备上，共同组成类似于图6中一个计算机设备中的联合学习系统。
上述图2至图6中都只介绍了第一聚合节点和第二聚合节点中配置了TEE，实际上训练节点中也可以配置TEE。
一种可能的实施例中，当训练节点中配置有第二TEE时，训练节点在第二TEE中对训练模型进行训练，并对训练得到的结果进行加密。这样在第二TEE中训练模型，可以确保训练模型不会泄露，确保了训练模型的隐私性。
一种可能的实施例中，当训练节点中配置有第二TEE时，训练节点可以在第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。这样训练节点也不会获知该训练模型，从而进一步确保了训练模型的隐私性。
一种可能的实施例中，为了避免通过训练模型的记录反推出训练数据，训练节点还可以对训练数据进行加入噪声；使用加入噪声后的训练数据对所述训练模型进行训练。
加入噪声的过程在行业内的学名可以称为差分隐私处理，加入噪声可以理解为是在训练数据中加入一点微小的改动，在最小化影响训练数据使用的情况下，最大限度减少对数 据源中单个数据的识别的效果，从而有效的避免训练数据泄露。通过在训练数据中加入噪声使得训练模型难以反推出原本的训练数据，由此保证训练模型难以记录训练数据，从而进一步保证了训练数据的隐私性。
一种可能的实施例中，所述训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；所述训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
随机响应策略可以是预先配置好的，例如：该随机响应策略可以包括第一指示信息或第二指示信息，例如：该第一指示信息可以是1，该第二指示信息可以是0。该第一指示信息可以是ture，该第二指示信息可以是false。第一训练节点得到训练结果后，可以根据第一指示信息或第二指示信息确定是否发送训练结果。随机响应策略可以相当于二次差分隐私处理，第一训练节点根据随机响应策略确定是否将训练结果发送给第一聚合节点。随机响应策略是可以周期性变化的，可以在本训练周期是第一指示信息指示发送训练结果，在下一个训练周期是第二指示信息指示不发送训练结果，这样使第一聚合节点不能连续得到同一个训练节点的训练结果可以进一步防止从训练模型反推出训练数据，从而进一步保证了训练数据的隐私性。
上述图3和图5所示场景中的训练节点可以是数据中心中的服务器，这些数据中心可以是银行数据中心、医院数据中心、学校数据中心等。
上述几个场景中都只简单介绍了聚合节点在TEE中进行聚合的，下面结合图7所示的场景，进一步介绍本申请实施例提供的联合学习系统。
图7为本申请实施例提供的联合学习系统的另一场景实施例示意图。
如图7所示，该联合学习系统中的训练节点位于第一数据中心、第二数据中心和第三数据中心，当然也不限于只有这三个数据中心，该场景中只是以这三个数据中心为例进行介绍。若要训练的模型是肿块识别的模型，则第一数据中心、第二数据中心和第三数据中心例如可以是几家大医院的数据中心。
该联合学习系统中还包括控制节点和调度装置，该控制节点可以与模型持有节点通信，接收模型持有节点的模型训练请求和需要训练的训练模型。
控制节点接收到训练模型后，若是提前已经确定好了训练节点，则可以向训练节点发送训练模型。若是提前没有确定好训练节点，则可以通过每个数据中心中的协调装置来选择训练节点。
每个数据中心中的协调装置与控制节点可以预先建立可信任连接，例如：都配置了可信任网关(trusted gateway)。每个数据中心中的协调装置与聚合中心中的调度装置也可以预先建立可信任连接，控制节点与聚合中心中的调度装置也可以预先建立可信任连接。
控制节点可以根据训练模型确定需要持有哪种数据类型的训练节点，以及所需要训练节点的数量，然后将这些对训练节点的需求信息发送给数据中心中的协调装置，协调装置根据对训练节点的需求信息确定各自数据中的训练节点，然后将需要训练的训练模型发送给确定的训练节点，如控制节点需要N个训练节点，则数据中心侧会提供N个训练节点，N是正整数，通常N的取值都会是至少几十，大多是成百上千。
训练节点接收到的训练模型可以是加密的训练模型，对训练模型解密所使用的密钥可以是与控制节点预先协商好的。训练节点将该训练模型放入第二TEE中，并使用密钥解密该训练模型，得到该训练模型的明文。然后，训练节点使用训练数据对解密后的训练模型进行训练，会得到训练结果，对该训练结果进行加密，加密后的训练结果可以称为第一训练结果，加密前的训练结果可以称为第二训练结果。训练节点可以通过协调装置将该第一训练结果发送给聚合中心中的调度装置。
控制节点还可以预先向调度装置发送对聚合节点的需求信息，对聚合节点的需求信息可以是需要聚合节点的数量，以及聚合层级的信息等。调度装置会根据对聚合节点的需求信息准备好相应数量以及层级的聚合节点，例如：需要M个聚合节点，需要聚合节点的层级是一层或两层，在聚合层级是一层时，M的取值可以为1，当聚合层级是两层时，M通常是大于2的整数。
调度装置接收到第一训练结果后，会将N个第一训练结果中的P个第一训练结果调度给一个第一聚合节点，该第一聚合节点接收到P个第一训练结果后，会将所述P个第一训练结果调度到所述第一聚合节点的第一TEE中；在所述第一TEE中解密所述P个第一训练结果，以得到P个第二训练结果；然后，第一聚合节点聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
若只有一个第一聚合节点时，N＝P。若有Q个第一聚合节点时，P＜N。Q个第一聚合节点执行聚合的过程基本相同，都是在第一TEE中执行解密以及聚合的过程，Q为大于1的正整数。
Q个第一聚合节点将Q个第一聚合结果发送给第二聚合节点，第二聚合节点将所述加密后的Q个第一聚合结果从第二聚合节点的第一REE中调度到所述第二聚合节点的第一TEE中进行解密，以得到Q个第一聚合结果；所述第二聚合节点聚合所述Q个第一聚合结果，以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合。
上述描述了以训练节点是数据中心中的服务器的场景，实际上，终端设备也是可以采用上述图7所描述的中心化的处理过程进行操作的，可以采用地域的划分方式划分终端设备。例如：将北京的终端设备划分到第一数据中心，将上海的终端设备划分到第二数据中心，将深圳的终端设备划分到第三数据中心。通过这三个区域的终端设备来训练用于“外卖点餐”的模型。具体的训练过程和训练原理都可以参阅上述图7部分的相应描述进行理解。
聚合节点与训练节点之间解密的密钥可以是预先协商好的。
以上多个场景实施例对联合学习系统做了介绍，基于上述联合学习系统，下面结合附图介绍本申请实施例梯度的训练结果聚合的方法。
图8是本申请实施例提供的训练结果聚合的方法的一实施例示意图。
如图8所示，本申请实施例提供的训练结果聚合的方法的一实施例可以包括：
101、第一训练节点对训练模型进行训练。
第一训练节点为N个训练节点中的任意一个。
102、第一训练节点对训练得到的结果进行加密，以得到第一训练结果。
103、第一训练节点向第一聚合节点发送所述第一训练结果，相应地，第一聚合节点接收所述P个训练节点发送的针对训练模型的P个第一训练结果。
除只有一个聚合节点的情况外，第一聚合节点是M个聚合节点中位于第一层级的一个聚合节点。当只有一个聚合节点时，P＝N，当有多个聚合节点时，P＜N。
104、第一聚合节点将所述P个第一训练结果从所述第一聚合节点的第一REE中调度到所述第一聚合节点的第一TEE中。
105、第一聚合节点在所述第一TEE中解密所述P个第一训练结果，以得到P个第二训练结果。
106、第一聚合节点在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
本申请实施例中，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且，训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
一种可能的实施例中，当所述M个聚合节点中还包括第二聚合节点时，上述步骤106之后，该方法还可以包括：
所述第一聚合节点向所述第二聚合节点发送加密后的第一聚合结果，所述加密后的第一聚合结果被所述第二聚合节点在所述第二聚合节点的第一TEE中解密得到所述第一聚合结果，来自于Q个第一聚合节点的Q个第一聚合结果用于所述第二聚合节点在所述第二聚合节点的第一TEE中聚合以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合，Q为大于1的正整数。
本申请实施例中，无论有多少个聚合层级，在每个聚合层级的聚合节点中都是在第一TEE中执行聚合操作，从而保证了每一层级聚合结果的隐私性，而且通过多级聚合还可以提高聚合的效率。
一种可能的实施例中，若M＝1，则第一聚合节点还根据第一聚合结果更新训练模型，或者第一聚合节点向N个训练节点发送加密后的第一聚合结果，从而使N个训练节点根据第一聚合结果更新训练模型。
若M＞1，则第二聚合节点还根据第二聚合结果更新训练模型，或者第二聚合节点向N个训练节点发送加密后的第二聚合结果，从而使N个训练节点根据第二聚合结果更新训练模型。
更新训练模型的过程可以是用聚合梯度更新训练模型上的权重，权重更新的过程可以是用本轮当前的权重减去本轮产生的聚合梯度，得到更新后的权重，该更新后的权重用于下一轮训练，更新权重后的训练模型就是更新后的训练模型。
一种可能的实施例中，若训练节点配置有第二TEE，则上述步骤101包括：第一训练节点在第二TEE中对所述训练模型进行训练，并对训练得到的结果进行加密，以得到所述第一训练结果，所述第一训练节点的训练结果为所述N个第一训练结果中的一个。
本申请实施例中，训练节点中配置有第二TEE，在第二TEE中训练模型，可以确保训练模型不会泄露，确保了训练模型的隐私性。
一种可能的实施例中，所述第一训练节点在第二TEE中对所述训练模型进行训练之前，所述第一训练节点在第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
第一训练节点在第二TEE中对加密的训练模型进行解密，可以进一步确保训练模型的隐私性。
一种可能的实施例中，在步骤101之前，还可以包括：第一训练节点在训练数据中加入噪声；所述第一训练节点使用加入噪声后的训练数据对所述训练模型进行训练。
加入噪声的过程在行业内的学名可以称为差分隐私处理，加入噪声可以理解为是在训练数据中加入一点微小的改动，在最小化影响训练数据使用的情况下，最大限度减少对数据源中单个数据的识别的效果，从而有效的避免训练数据泄露。该种可能的实现方式中，通过在训练数据中加入噪声使得训练模型难以反推出原本的训练数据，由此保证训练模型难以记录训练数据，从而进一步保证了训练数据的隐私性。
一种可能的实施例中，所述第一训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；所述第一训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
随机响应策略可以是预先配置好的，例如：该随机响应策略可以包括第一指示信息或第二指示信息，例如：该第一指示信息可以是1，该第二指示信息可以是0。该第一指示信息可以是ture，该第二指示信息可以是false。第一训练节点得到训练结果后，可以根据第一指示信息或第二指示信息确定是否发送训练结果。随机响应策略可以相当于二次差分隐私处理，第一训练节点根据随机响应策略确定是否将训练结果发送给第一聚合节点。随机响应策略是可以周期性变化的，可以在本训练周期是第一指示信息指示发送训练结果，在下一个训练周期是第二指示信息指示不发送训练结果，这样使第一聚合节点不能连续得到同一个训练节点的训练结果可以进一步防止从训练模型反推出训练数据，从而进一步保证了训练数据的隐私性。
上述模型训练执行之前，控制节点会与训练节点之间协商加密训练模型的密钥。聚合节点会与训练节点之间协商加密训练结果所使用的密钥，要是多级聚合的情形，第一聚合节点与第二聚合节点之间也会协商加密第一聚合结果所使用的密钥。模型持有节点与控制节点之间也可以协商加密训练模型所使用的密钥。
例如可以是：模型持有节点使用控制节点的公钥加密训练模型，并将加密后的模型发送给控制节点。控制节点使用私钥解密该训练模型，然后控制节点用与训练节点协商好的密钥重新加密训练模型，再将训练模型发送给训练节点。训练节点已预先与控制节点协商的密钥，则训练节点可以使用该密钥解密该训练模型。若训练节点配置有第二TEE，则训练节点可以在第二TEE中解密该训练模型，以得到训练模型的明文。然后训练节点在第二TEE中执行模型训练，以得到第二训练结果，对该第二训练结果进行加密，得到第一训练结果。然后训练节点使用与聚合节点协商好的密钥加密后发送各第一聚合节点，第一聚合节点在第一TEE中解密该第一训练结果后，执行聚合操作，得到第一聚合结果。以只有一个聚合节点为例，第一聚合节点使用第一聚合结果更新训练模型，若训练没有结束，则第一聚合节点可以将更新后的聚合模型使用密钥加密后再发送给各训练节点，也可以是第一聚合节点 将第一聚合结果加密后发送给各训练节点，由训练节点使用第一聚合结果更新本地的训练模型。若训练达到收敛条件，模型训练结束，则第一聚合节点可以将更新后的训练模型发送给控制节点，由控制节点发送给模型持有节点。
上述密钥协商的过程的一个示例可以参阅图9的示例进行理解。
如图9所示，本申请实施例提供的训练结果聚合的方法的另一实施例可以包括：
201、控制节点生成非对称密钥对，将公钥A.pubkey同步给模型持有节点、聚合节点和训练节点。
202、训练节点生成对称密钥C.key，并使用A.pubkey加密C.key。
203、训练节点向控制节点和聚合节点发送使用A.pubkey加密的C.key。
204、聚合节点将各个训练节点的对称密钥C.key存储在第一TEE中，控制节点也存储C.key。
205、模型持有节点生成包括公钥O.pubkey和私钥O.privkey的非对称密钥对。
206、模型持有节点使用A.pubkey加密训练模型。
207、模型持有节点将使用A.pubkey加密训练模型和公钥O.pubkey发送给控制节点。
208、控制节点使用A.pubkey对加密的训练模型进行解密，以得到训练模型的明文，并保存公钥O.pubkey。
209、控制节点使用C.key加密训练模型。
210、控制节点将使用C.key加密后的训练模型发送给训练节点。
也可以将该使用C.key加密后的训练模型发送给聚合节点。
211、训练节点在第二TEE中使用C.key解密该训练模型，得到训练模型的明文。
212、训练节点使用训练数据对训练模型进行训练，得到第二训练结果，使用C.key加密第二训练结果，以得到第一训练结果。
213、训练节点向聚合节点发送第一训练结果。
214、聚合节点在第一TEE中使用C.key解密第一训练结果，并对多个训练结果执行聚合操作，以得到第一聚合结果。
第一聚合结果用于更新训练模型。
215、若模型训练结束，聚合节点可以将训练好的模型使用C.key加密发送给控制节点。
216、控制节点使用C.key解密训练好的模型。
217、控制节点使用O.pubkey加密该训练好的模型。
218、控制节点向模型持有节点发送使用O.pubkey加密该训练好的模型。
219、模型持有节点使用O.privkey解密，以得到该训练好的模型的明文。
由该实施例可知，只需要通过少量的协商就可以确保训练数据和训练模型的隐私性，极大的降低了通信开销，提高了计算效率。
以上介绍了联合学习系统和训练结果聚合的方法，下面结合附图介绍本申请实施例提供的聚合节点和训练节点。
如图10所示，本申请实施例提供的聚合节点应用于联合学习系统，所述联合学习系统还包括N个训练节点，所述N都为正整数，所述聚合节点中配置有第一富执行环境REE和第一 可信执行环境TEE，该聚合节点30可以包括：
接收单元301，用于接收所述P个训练节点发送的针对所述训练模型的P个第一训练结果，所述第一训练结果是所述训练节点对第二训练结果进行加密得到的，所述第二训练结果是所述训练节点训练所述训练模型得到的，P为正整数，且P≤N；
处理单元302用于：
将所述P个第一训练结果从所述第一聚合节点的第一REE中调度到所述第一聚合节点的第一TEE中；
在所述第一TEE中解密所述P个第一训练结果，以得到P个所述第二训练结果；
在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
本申请实施例中，从训练节点到聚合节点传输的是加密的第一训练结果，可以确保训练结果传输过程中不会被泄露。第一聚合节点在第一TEE中对第一训练结果进行解密，然后再聚合，可以确保聚合过程中训练结果不会被泄露。训练结果传输和聚合都不会被泄露保证了数据的隐私性，而且，训练节点和聚合节点只需要传输一次加密的训练结果就可以实现训练结果的聚合，降低了通信开销，提高了计算效率。
一种可能的实施例中，该聚合节点30还可以包括：
发送单元303，用于向所述第二聚合节点发送加密后的第一聚合结果，所述加密后的第一聚合结果被所述第二聚合节点在所述第二聚合节点的第一TEE中解密得到所述第一聚合结果，来自于Q个第一聚合节点的Q个第一聚合结果用于所述第二聚合节点在所述第二聚合节点的第一TEE中聚合以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合，Q为大于1的正整数。
需要说明的是，上述聚合节点30的各单元之间的信息交互、执行过程等内容，由于与本申请方法实施例基于同一构思，其带来的技术效果与本发明方法实施例相同，具体内容可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
参阅图11，本申请实施例提供的训练节点应用于联合学习系统，所述联合学习系统还包括M个聚合节点，所述M为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一富执行环境REE和第一可信执行环境TEE，所述训练节点中配置有第二TEE，该训练节点40可以包括：
处理单元401用于：
在所述第一训练节点的第二TEE中对所述训练模型进行训练；
在所述第二TEE中对训练得到的结果进行加密，以得到所述第一训练节点的第一训练结果；
发送单元402，用于向第一聚合节点发送所述第一训练结果，所述第一训练结果用于所述第一聚合节点在第一TEE中进行结果聚合。
本申请实施例中，训练节点中配置有第二TEE，第二TEE可以参阅第一方面中对第一TEE的描述进行理解。在第二TEE中训练模型，可以确保训练模型不会泄露，确保了训练模型的隐私性。
一种可能的实施例中，处理单元401还用于在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
一种可能的实施例中，所述处理单元401还用于：
在训练数据中加入噪声；
使用加入噪声后的训练数据对所述训练模型进行训练。
一种可能的实施例中，所述发送单元402，用于响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；
所述处理单元401，用于响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
需要说明的是，上述训练节点40的各单元之间的信息交互、执行过程等内容，由于与本申请方法实施例基于同一构思，其带来的技术效果与本发明方法实施例相同，具体内容可参见本申请前述所示的方法实施例中的叙述，此处不再赘述。
图12所示，为本申请的实施例提供的上述实施例中所涉及的计算机设备50的一种可能的逻辑结构示意图。该计算机设备50可以是上述聚合节点，也可以是训练节点。计算机设备50包括：处理器501、通信接口502、存储器503以及总线504。处理器501、通信接口502以及存储器503通过总线504相互连接。在本申请的实施例中，处理器501用于对计算机设备50的动作进行控制管理，例如，处理器501用于执行图8中的步骤101、102、104至106和/或用于本文所描述的技术的其他过程。通信接口502用于支持计算机设备50进行通信。存储器503，用于存储计算机设备50的程序代码和数据。
其中，处理器501可以是中央处理器单元，通用处理器，数字信号处理器，专用集成电路，现场可编程门阵列或者其他可编程逻辑器件、晶体管逻辑器件、硬件部件或者其任意组合。其可以实现或执行结合本申请公开内容所描述的各种示例性的逻辑方框，模块和电路。所述处理器也可以是实现计算功能的组合，例如包含一个或多个微处理器组合，数字信号处理器和微处理器的组合等等。总线504可以是外设部件互连标准(Peripheral Component Interconnect，PCI)总线或扩展工业标准结构(Extended Industry Standard Architecture，EISA)总线等。所述总线可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
本申请还提供了一种芯片系统，该芯片系统包括处理器，用于支持上述聚合节点或训练节点实现其所涉及的功能，例如，例如接收或处理上述方法实施例中所涉及的数据。在一种可能的设计中，所述芯片系统还包括存储器，所述存储器，用于保存终端设备必要的程序指令和数据。该芯片系统，可以由芯片构成，也可以包含芯片和其他分立器件。
在本申请的另一实施例中，还提供一种计算机可读存储介质，计算机可读存储介质中存储有计算机执行指令，当设备的至少一个处理器执行该计算机执行指令时，设备执行上述图8至图9部分实施例所描述的方法。
在本申请的另一实施例中，还提供一种计算机程序产品，该计算机程序产品包括计算机执行指令，该计算机执行指令存储在计算机可读存储介质中；设备的至少一个处理器可以从计算机可读存储介质读取该计算机执行指令，至少一个处理器执行该计算机执行指令 使得设备执行上述图8至图9部分实施例所描述的方法。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请实施例的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请实施例所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请实施例各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请实施例的具体实施方式，但本申请实施例的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请实施例揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请实施例的保护范围之内。因此，本申请实施例的保护范围应以所述权利要求的保护范围为准。

Claims (21)

  1. 一种联合学习系统，其特征在于，所述联合学习系统包括M个聚合节点和N个训练节点，所述M和N都为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一可信执行环境TEE，所述M个聚合节点中包括第一聚合节点；
    所述第一聚合节点接收所述P个训练节点发送的针对所述训练模型的P个第一训练结果，所述第一训练结果是所述训练节点对第二训练结果进行加密得到的，所述第二训练结果是所述训练节点训练所述训练模型得到的，P为正整数，且P≤N；
    所述第一聚合节点将所述P个第一训练结果从所述第一聚合节点的第一富执行环境REE中调度到所述第一聚合节点的第一TEE中；
    所述第一聚合节点在所述第一TEE中解密所述P个第一训练结果，以得到P个所述第二训练结果；
    所述第一聚合节点在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
  2. 根据权利要求1所述的联合学习系统，其特征在于，所述M个聚合节点中还包括第二聚合节点；
    所述第二聚合节点接收Q个所述第一聚合节点发送的加密后的Q个第一聚合结果，Q为大于1的正整数；
    所述第二聚合节点将所述加密后的Q个第一聚合结果从所述第二聚合节点的第一REE调度到第一TEE中进行解密，以得到Q个第一聚合结果；
    所述第二聚合节点在所述第一TEE中聚合所述Q个第一聚合结果，以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合。
  3. 根据权利要求1或2所述的联合学习系统，其特征在于，所述N个训练节点中分别配置有第二TEE，针对所述N个训练节点中的每个第一训练节点；
    所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练，并对训练得到的结果进行加密，以得到所述第一训练节点的训练结果，所述第一训练节点的训练结果为所述N个第一训练结果中的一个。
  4. 根据权利要求3所述的联合学习系统，其特征在于，所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练之前，所述第一训练节点在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
  5. 根据权利要求1-4任一项所述的联合学习系统，其特征在于，
    所述第一训练节点在训练数据中加入噪声；
    所述第一训练节点使用加入噪声后的训练数据对所述训练模型进行训练。
  6. 根据权利要求3所述的联合学习系统，其特征在于，
    所述第一训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；
    所述第一训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
  7. 根据权利要求1-6任一项所述的联合学习系统，其特征在于，所述联合学习系统还包括控制节点和调度装置，
    所述控制节点向所述调度装置发送对于聚合节点的需求信息，所述需求信息包括需要所述聚合节点的数量和/或聚合层级信息；
    所述调度装置根据所述需求信息确定用于聚合的所述M个聚合节点。
  8. 根据权利要求1-7任一项所述的联合学习系统，其特征在于，所述第二训练结果为用于聚合的梯度，所述聚合结果为聚合后的梯度，所述聚合后的梯度用于更新所述训练模型的权重。
  9. 一种训练结果聚合的方法，其特征在于，所述方法应用于联合学习系统，所述联合学习系统包括M个聚合节点和N个训练节点，所述M和N都为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一可信执行环境TEE，所述M个聚合节点中包括第一聚合节点；所述方法包括：
    所述第一聚合节点接收所述P个训练节点发送的针对所述训练模型的P个第一训练结果，所述第一训练结果是所述训练节点对第二训练结果进行加密得到的，所述第二训练结果是所述训练节点训练所述训练模型得到的，P为正整数，且P≤N；
    所述第一聚合节点将所述P个第一训练结果从所述第一聚合节点的第一富执行环境REE中调度到所述第一聚合节点的第一TEE中；
    所述第一聚合节点在所述第一TEE中解密所述P个第一训练结果，以得到P个所述第二训练结果；
    所述第一聚合节点在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
  10. 根据权利要求9所述的方法，其特征在于，所述M个聚合节点中还包括第二聚合节点，所述方法还包括：
    所述第一聚合节点向所述第二聚合节点发送加密后的第一聚合结果，所述加密后的第一聚合结果被所述第二聚合节点在所述第二聚合节点的第一TEE中解密得到所述第一聚合结果，来自于Q个第一聚合节点的Q个第一聚合结果用于所述第二聚合节点在所述第二聚合节点的第一TEE中聚合以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合，Q为大于1的正整数。
  11. 一种训练结果聚合的方法，其特征在于，所述方法应用于联合学习系统，所述联合学习系统包括M个聚合节点和N个训练节点，所述M和N都为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一可信执行环境TEE，所述M个聚合节点中包括第一聚合节点，所述N个训练节点中分别配置有第二TEE，针对所述N个训练节点中的每个第一训练节点，所述方法包括：
    所述第一训练节点在所述第一训练节点的第二TEE中对所述训练模型进行训练；
    所述第一训练节点在所述第二TEE中对训练得到的结果进行加密，以得到所述第一训练节点的第一训练结果；
    所述第一训练节点向第一聚合节点发送所述第一训练结果，所述第一训练结果用于所 述第一聚合节点在第一TEE中进行结果聚合。
  12. 根据权利要求11所述的方法，其特征在于，所述第一训练节点在所述第一训练节点的第二TEE中对训练模型进行训练之前，所述方法还包括：
    所述第一训练节点在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
  13. 根据权利要求11或12所述的方法，其特征在于，所述方法还包括：
    所述第一训练节点在训练数据中加入噪声；
    所述第一训练节点使用加入噪声后的训练数据对所述训练模型进行训练。
  14. 根据权利要求11-13任一项所述的方法，其特征在于，所述方法还包括：
    所述第一训练节点响应于随机响应策略的第一指示信息发送所述第一训练节点的训练结果；
    所述第一训练节点响应于随机响应策略的第二指示信息删除所述第一训练节点的训练结果。
  15. 一种聚合节点，其特征在于，所述聚合节点应用于联合学习系统，所述联合学习系统还包括N个训练节点，所述N都为正整数，所述聚合节点中配置有第一可信执行环境TEE，所述聚合节点包括：
    接收单元，用于接收所述P个训练节点发送的针对所述训练模型的P个第一训练结果，所述第一训练结果是所述训练节点对第二训练结果进行加密得到的，所述第二训练结果是所述训练节点训练所述训练模型得到的，P为正整数，且P≤N；
    处理单元用于：
    将所述P个第一训练结果从所述第一聚合节点的第一富执行环境REE中调度到所述第一聚合节点的第一TEE中；
    在所述第一TEE中解密所述P个第一训练结果，以得到P个所述第二训练结果；
    在所述第一TEE中聚合所述P个第二训练结果，以得到第一聚合结果，所述第一聚合结果用于更新所述训练模型或者用于下一级聚合。
  16. 根据权利要求15所述的聚合节点，其特征在于，所述聚合节点还包括：
    发送单元，用于向所述第二聚合节点发送加密后的第一聚合结果，所述加密后的第一聚合结果被所述第二聚合节点在所述第二聚合节点的第一TEE中解密得到所述第一聚合结果，来自于Q个第一聚合节点的Q个第一聚合结果用于所述第二聚合节点在所述第二聚合节点的第一TEE中聚合以得到第二聚合结果，所述第二聚合结果用于更新所述训练模型或者用于下一级聚合，Q为大于1的正整数。
  17. 一种训练节点，其特征在于，所述训练节点应用于联合学习系统，所述联合学习系统还包括M个聚合节点，所述M为正整数，所述N个训练节点上配置有相同的训练模型，所述M个聚合节点中都配置有第一可信执行环境TEE，所述训练节点中配置有第二TEE，所述训练节点包括：
    处理单元用于：
    在所述第一训练节点的第二TEE中对所述训练模型进行训练；
    在所述第二TEE中对训练得到的结果进行加密，以得到所述第一训练节点的第一训练结果；
    发送单元，用于向第一聚合节点发送所述第一训练结果，所述第一训练结果用于所述第一聚合节点在第一TEE中进行结果聚合。
  18. 根据权利要求17所述的训练节点，其特征在于，
    所述处理单元，还用于在所述第一训练节点的第二TEE中对加密的训练模型进行解密，以得到解密后的所述训练模型。
  19. 一种计算设备，其特征在于，包括处理器和存储有计算机程序的计算机可读存储介质；
    所述处理器与所述计算机可读存储介质耦合，所述计算机程序被所述处理器执行时实现如权利要求9或10所述的方法或者11-14任一项所述的方法。
  20. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求9或10所述的方法或者11-14任一项所述的方法。
  21. 一种芯片系统，其特征在于，包括处理器，所述处理器被调用用于执行如权利要求9或10所述的方法或者11-14任一项所述的方法。
PCT/CN2020/109930 2019-10-29 2020-08-19 一种联合学习系统、训练结果聚合的方法及设备 WO2021082647A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201911041366.2A CN112749812A (zh) 2019-10-29 2019-10-29 一种联合学习系统、训练结果聚合的方法及设备
CN201911041366.2 2019-10-29

Publications (1)

Publication Number Publication Date
WO2021082647A1 true WO2021082647A1 (zh) 2021-05-06

Family

ID=75640331

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/109930 WO2021082647A1 (zh) 2019-10-29 2020-08-19 一种联合学习系统、训练结果聚合的方法及设备

Country Status (2)

Country Link
CN (1) CN112749812A (zh)
WO (1) WO2021082647A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113360514A (zh) * 2021-07-02 2021-09-07 支付宝(杭州)信息技术有限公司 联合更新模型的方法、装置及系统
CN114121206A (zh) * 2022-01-26 2022-03-01 中电云数智科技有限公司 一种基于多方联合k均值建模的病例画像方法及装置

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20220374762A1 (en) * 2021-05-18 2022-11-24 International Business Machines Corporation Trusted and decentralized aggregation for federated learning
WO2024065755A1 (zh) * 2022-09-30 2024-04-04 华为技术有限公司 一种通信方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180101697A1 (en) * 2016-10-11 2018-04-12 Palo Alto Research Center Incorporated Method for differentially private aggregation in a star topology under a realistic adversarial model
CN109308418A (zh) * 2017-07-28 2019-02-05 阿里巴巴集团控股有限公司 一种基于共享数据的模型训练方法及装置
CN109325584A (zh) * 2018-08-10 2019-02-12 深圳前海微众银行股份有限公司 基于神经网络的联邦建模方法、设备及可读存储介质
CN109684855A (zh) * 2018-12-17 2019-04-26 电子科技大学 一种基于隐私保护技术的联合深度学习训练方法
CN110245510A (zh) * 2019-06-19 2019-09-17 北京百度网讯科技有限公司 用于预测信息的方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11526745B2 (en) * 2018-02-08 2022-12-13 Intel Corporation Methods and apparatus for federated training of a neural network using trusted edge devices
US11556730B2 (en) * 2018-03-30 2023-01-17 Intel Corporation Methods and apparatus for distributed use of a machine learning model
CN109189825B (zh) * 2018-08-10 2022-03-15 深圳前海微众银行股份有限公司 横向数据切分联邦学习建模方法、服务器及介质
CN109598385A (zh) * 2018-12-07 2019-04-09 深圳前海微众银行股份有限公司 反洗钱联合学习方法、装置、设备、系统及存储介质
CN109492420B (zh) * 2018-12-28 2021-07-20 深圳前海微众银行股份有限公司 基于联邦学习的模型参数训练方法、终端、系统及介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180101697A1 (en) * 2016-10-11 2018-04-12 Palo Alto Research Center Incorporated Method for differentially private aggregation in a star topology under a realistic adversarial model
CN109308418A (zh) * 2017-07-28 2019-02-05 阿里巴巴集团控股有限公司 一种基于共享数据的模型训练方法及装置
CN109325584A (zh) * 2018-08-10 2019-02-12 深圳前海微众银行股份有限公司 基于神经网络的联邦建模方法、设备及可读存储介质
CN109684855A (zh) * 2018-12-17 2019-04-26 电子科技大学 一种基于隐私保护技术的联合深度学习训练方法
CN110245510A (zh) * 2019-06-19 2019-09-17 北京百度网讯科技有限公司 用于预测信息的方法和装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113360514A (zh) * 2021-07-02 2021-09-07 支付宝(杭州)信息技术有限公司 联合更新模型的方法、装置及系统
CN113360514B (zh) * 2021-07-02 2022-05-17 支付宝(杭州)信息技术有限公司 联合更新模型的方法、装置及系统
CN114121206A (zh) * 2022-01-26 2022-03-01 中电云数智科技有限公司 一种基于多方联合k均值建模的病例画像方法及装置
CN114121206B (zh) * 2022-01-26 2022-05-20 中电云数智科技有限公司 一种基于多方联合k均值建模的病例画像方法及装置

Also Published As

Publication number Publication date
CN112749812A (zh) 2021-05-04

Similar Documents

Publication Publication Date Title
WO2021082647A1 (zh) 一种联合学习系统、训练结果聚合的方法及设备
CN110399742B (zh) 一种联邦迁移学习模型的训练、预测方法及装置
WO2022247576A1 (zh) 一种数据处理方法、装置、设备及计算机可读存储介质
TW202009776A (zh) 多方安全計算方法及裝置、電子設備
CN111898137A (zh) 一种联邦学习的隐私数据处理方法、设备及系统
CN110061845A (zh) 区块链数据加密方法、装置、计算机设备及存储介质
CN109214201B (zh) 一种数据共享方法、终端设备及计算机可读存储介质
CN111428887B (zh) 一种基于多个计算节点的模型训练控制方法、装置及系统
CN113127916A (zh) 数据集合处理方法、数据处理方法、装置及存储介质
US20200220713A1 (en) Secure communication with a trusted execution environment
CN111131412B (zh) 实现5g移动端计算的方法、系统、移动端及云端服务器
Yan et al. Context-aware verifiable cloud computing
CN107948212A (zh) 一种日志的处理方法及装置
CN109495252A (zh) 数据加密方法、装置、计算机设备及存储介质
US20220374763A1 (en) Federated learning with partitioned and dynamically-shuffled model updates
US20220374762A1 (en) Trusted and decentralized aggregation for federated learning
Yang et al. Publicly verifiable outsourced data migration scheme supporting efficient integrity checking
CN112765642A (zh) 数据处理方法、数据处理装置、电子设备及介质
CN114422237B (zh) 数据传输方法及装置、电子设备和介质
CN113420886B (zh) 纵向联邦学习模型的训练方法、装置、设备及存储介质
Chen et al. A privacy protection method based on key encapsulation mechanism in medical blockchain
CN103885725A (zh) 一种基于云计算环境的虚拟机访问控制系统及其控制方法
JP5668549B2 (ja) 秘匿分析処理方法、プログラム及び装置
CN116502732B (zh) 基于可信执行环境的联邦学习方法以及系统
CN108270563A (zh) 一种基于sm2加密算法的数据交换方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20881641

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20881641

Country of ref document: EP

Kind code of ref document: A1