WGAN-GP privacy protection system and method based on improved PATE

Abstract

The invention belongs to the field of AI security, relates to comprehensive application of privacy learning, ensemble learning and knowledge migration, and provides a method which is stable in model training, good in generation effect and strict in privacy guarantee. Therefore, the technical scheme adopted by the invention is as follows: according to the improved PATE-based WGAN-GP privacy protection method, differential privacy protection is carried out based on a designed consensus degree check condition and Gaussian distribution sampling noise, so that an aggregation mechanism is optimized; a conditional differential privacy aggregator is designed in the integration process by utilizing the relation that the consensus degree of a teacher discriminator is inversely proportional to the privacy cost and the consensus degree of the teacher discriminator is directly proportional to the accuracy, and synthetic data for other machine learning models to train is generated on the basis of protecting original sensitive training data by optimizing a teacher classifier cluster. The method and the device are mainly applied to privacy data security protection occasions.

Description

technical field [0001] The invention belongs to the field of AI security, relates to the comprehensive application of privacy learning, integrated learning and knowledge transfer, and designs a model for comprehensive performance improvement by weighing privacy and accuracy. Realize the privacy protection of training data, generate synthetic data that no longer contains real private information and are realistic enough for the training of machine learning models, defend against model stealing attacks, and ensure the security of machine learning models. It is specifically related to the WGAN-GP privacy protection method based on the improved PATE. Background technique [0002] With the advent of the information sharing era, information publishing and data mining technologies emerge in an endless stream, and a large amount of privacy value, including potential and valuable knowledge, has been mined. The risk of privacy breaches inevitably increases rapidly at an extremely hig...

AI Technical Summary

Problems solved by technology

However, the generative confrontation network trained by this method needs to add an appropriate amount of precisely calculated noise in each round of gradient clipping, so a large amount of noise will still be introduced

Because of this, training methods based on noisySGD usually face the problem that the privacy budget is exhausted and the model cannot converge

At the same time, the noise introduced during gradient clipping is sampled from a random distribution, so the impact on the training optimization of the model is unpredictable, and the training of the model may have an effect in the opposite direction.

Images