Credible federal large model nonlinear activation function verification method based on zero knowledge proof

Abstract

The invention relates to a credible federal large model nonlinear activation function verification method based on zero knowledge proof, and belongs to the field of data security and privacy protection. The method comprises the following steps: decomposing a ReLU function into three groups of linear equations of symbol judgment, zero output and Boolean constraint according to the nonlinear characteristic of the ReLU function to form an R1CS constraint system; on the basis of the R1CS constraint system, a zero-knowledge proof protocol is adopted, a verification equation containing bilinear pairing operation is constructed, and a proof generation algorithm and a verification algorithm are defined; according to a proof generation algorithm and a verification algorithm, global public parameters are generated through a multi-party security computing protocol, participants compute and generate zero-knowledge proof tuples according to local activation values, and a server receives the proof generated by each participant and executes aggregation verification. According to the method, on the premise of protecting data privacy, completeness and correctness of activation value calculation are verified, the method can be extensively applied to federal large model training, and the collaboration problem of privacy protection and calculation credibility verification is solved.

Description

Technical Field

[0001] The present invention relates to a method for verifying a non - linear activation function of a trusted federated large model based on zero - knowledge proof, belonging to the field of data security and privacy protection. Background Art

[0002] As a distributed machine learning method for protecting data privacy, the federated large model is widely used in fields such as healthcare, finance, and the Internet of Things. Through local training and parameter sharing, the federated large model can optimize the global model without transmitting the original data. However, its distributed nature poses severe challenges to the integrity of the data space and the correctness of model calculations. In particular, the verification of non - linear activation functions is crucial for ensuring the performance of the global large model.

[0003] The ReLU function is a core component for deep learning models to fit complex non - linear relationships, but its calculation results are only visible locally. If there are malicious participants submitting incorrect results, it may lead to the failure of global model training. Therefore, verifying the calculation correctness of non - linear activation functions can not only improve the credibility of global model training but also ensure the consistency and integrity of the data space.

[0004] The zero - knowledge proof technology provides an effective solution to the above problems. Its core feature is that, without revealing the data itself, the prover can prove the correctness of a certain calculation result to the verifier. By combining the zero - knowledge proof protocol, participants can construct the circuit constraint relationship of the activation function and generate a proof of the calculation result. The verifier only needs to verify this proof and can confirm the correctness of the result without accessing the original data. This method not only protects data privacy but also significantly improves the credibility and verification efficiency of federated learning.

[0005] However, the non - linear characteristics of activation functions are likely to introduce redundant signals and complex constraints in circuit modeling, increasing the computational overhead. At the same time, the verification process also needs to meet the requirements of high efficiency and universality to adapt to different activation functions and federated learning tasks.

[0006] To address these problems, the present invention proposes an efficient method for verifying non - linear activation functions. By using the circuit modeling tool Circom to model the activation function logic as a circuit constraint relationship and combining the zero - knowledge proof protocol to generate a trusted setup, it effectively reduces redundant signals and unnecessary constraints, optimizing the computational complexity and verification efficiency. This method is suitable for a variety of federated learning scenarios, ensuring data integrity and the credibility of model calculations, and has advantages such as high efficiency, privacy protection, and universality. Summary of the Invention

[0007] The object of the present invention is to provide a method for verifying the non - linear activation function of a trusted federated large model based on zero - knowledge proof, aiming to solve the technical problems of high computational complexity, insufficient privacy protection, low model verification efficiency, and insufficient adaptability to multiple scenarios in the verification process of the non - linear activation function in the federated large model, so as to improve the credibility, data integrity, and training efficiency of the federated large model.

[0008] To achieve the above object, the present invention provides a method for verifying the non - linear activation function of a trusted federated large model based on zero - knowledge proof, and the method includes the following steps:

[0009] Step 1: For the non - linear characteristics of the ReLU function, decompose the ReLU function into three groups of linear equations of sign determination, zero output, and Boolean constraints to form an R1CS constraint system.

[0010] Step 2: Based on the R1CS constraint system, adopt a zero - knowledge proof protocol to construct a verification equation containing bilinear pairing operations, and define a proof generation algorithm and a verification algorithm.

[0011] Step 3: According to the proof generation algorithm and the verification algorithm, generate global public parameters through a multi - party secure computing protocol. The participating parties calculate and generate zero - knowledge proof tuples based on local activation values, and the server receives the proofs generated by each participating party and performs aggregated verification.

[0012] The said Step 1 includes:

[0013] Step 1.1: For the non - linear characteristics of the ReLU function, conduct a logical analysis of the ReLU function and define its piece - wise expression:

[0014]

[0015] where x is the input vector of a single neuron, and its vector dimension is determined according to the structure of the neural network and the dimension of the data; the original value is output when x≥0, and it is forced to zero when x < 0.

[0016] Step 1.2: Based on the logical analysis of the ReLU function, convert it into a circuit model. Through a circuit modeling tool, construct an arithmetic circuit including a numerical comparator, a conditional selector, and a constraint generator; among them, the numerical comparator is used to judge the non - negativity of the input value and generate a Boolean signal; the conditional selector determines the output value according to the Boolean signal; the constraint generator automatically generates verification constraints, and the components of the circuit model are as follows:

[0017] Numerical comparator: Judge the non - negativity of the input value and output a Boolean signal b∈{0,1}.

[0018] Conditional selector: Realize the output out = x·b through a multiplication gate.

[0019] Constraint generators: b·(x - out) = 0 and (1 - b)·out = 0;

[0020] Step 1.3: Based on the circuit model of the ReLU function, expand and optimize it to the matrix level. Each matrix element independently generates verification constraints and establishes a signal life cycle model to ensure that the usage time of each signal is clear and correct. The signal life cycle model is as follows:

[0021] live(v) = (t def , t lastuse ) (2)

[0022] where live(v) is the active time period of the signal, t def represents the moment when the signal is defined, and t lastuse is the moment when the signal is used for the last time, and after that, no component or constraint references the signal anymore;

[0023] Step 1.4: After completing the matrix - level circuit modeling, perform precision control on the signals calculated by the ReLU function circuit model. By defining the fixed - point number conversion rule, multiply the actual value by the precision parameter to ensure that the signals in each calculation process can be transmitted with sufficient precision; where the fixed - point number conversion rule is stored value = actual value × 10 l , and l is the precision parameter;

[0024] Step 1.5: Convert the ReLU circuit logic into an R1CS constraint system, generating three groups of matrices (A, B, C) that satisfy: s is the signal vector, including all the inputs, outputs, intermediate variables, and constant 1 of the circuit; represents the Hadamard product; The A matrix is the input matrix, defining the input variables and weights in each constraint. When performing the circuit logic conversion of ReLU, the A matrix is used to describe the input signal x; The B matrix is the weight matrix. In the ReLU verification, the B matrix is used to represent the relationship between the input variables and the conditional selection; The C matrix is the result matrix. In the ReLU constraint, the C matrix is used to record the calculation result of the activation value to ensure the correctness of the circuit calculation logic.

[0025] Specifically, in Step 1, for the piece - wise non - linear logic of the activation function (ReLU function), the signal redundancy is reduced through the constraint optimization algorithm, the circuit constraint relationship is optimized, and using the circuit modeling tool, the calculation process of the non - linear activation function is formalized into a circuit constraint model, accurately describing the relationship between the input (x) and the output f(x), effectively reducing the computational complexity and the number of circuit gates, and further improving the verification efficiency.

[0026] Step 2 includes:

[0027] Step 2.1: According to the generated R1CS constraint system, construct a secure key pair for the zero-knowledge proof protocol. By performing key construction, generate a set of proof keys and generate corresponding verification keys for verification; in this process, generate an elliptic curve base point through predefined random parameters and ensure that the random parameters remain unchanged throughout the protocol, thereby avoiding privacy leakage or conflicts; where the set of proof keys is: Generate verification keys where g1, g2 are elliptic curve base points, and α, β, γ, τ are predefined random parameters, randomly selected in the initialization stage of the zero-knowledge proof protocol. Once selected, the random parameters remain unchanged in the subsequent process of the protocol to avoid conflicts or privacy leakage in the subsequent proof process; i is the number representation of each element in the set, with a value range from 0 to n - 1; τ i represents raising the value of τ to the i-th power, and its role is to apply the exponent to the group element. Since the exponentiation operation is irreversible in the elliptic curve group, the security is enhanced; P k represents the set used to generate the proof key elements; V k is used to check the proof tuples generated through the proof key during the verification stage to see if they are correct;

[0028] Step 2.2: Based on the key generation, the participating parties generate zero-knowledge proof tuples according to their locally calculated activation values; each participating party combines the input matrix, weight matrix, and result matrix, and generates an encrypted proof in combination with the key, and encrypts the generated proof through a commitment function; where the proof tuple Z = (A', B', C') satisfies: σ is a predefined random parameter; k is a random parameter; h(τ) is a polynomial commitment function that encrypts τ to generate an immutable commitment value; A', B', C' are matrices used to generate zero-knowledge proof tuples based on the R1CS constraint system. A' represents the input matrix of the proof tuple, corresponding to the activation value and parameters locally generated by the participating party; B' represents the weight matrix of the proof tuple, corresponding to the encryption parameters used in the local calculation of the participating party; C' represents the result matrix of the proof tuple, recording the result of calculating the activation value, and is used to prove the correctness of the calculation process;

[0029] Step 2.3: The server uses bilinear pairing operations to verify the validity of the proof tuples generated by each participating party, where the bilinear pairing operation verification equation is: e is the bilinear pairing function operation, and the verification passes if and only if the constraint holds; A”, B”, C” are elements from the proof tuple and are used to verify the validity of the proof tuple through the bilinear pairing function; Used to verify whether α and β conform to the expected relationship. If the pairing result conforms to the expected relationship, it indicates that the pairing is valid. Used to verify whether C" is consistent with σ; in this way, the prover can prove the correctness of the calculation to the verifier without disclosing the specific calculation content.

[0030] Specifically, in step 2, by deeply integrating the zero-knowledge proof technology with the circuit model, the participating parties can generate a credible proof without disclosing the input data (x), ensuring that the calculation result conforms to the logical characteristics of the activation function and that the private data of the participating parties does not need to be exposed during the verification process, fundamentally protecting data privacy.

[0031] Step 3 includes:

[0032] Step 3.1: After generating the zero-knowledge proof tuples locally for each participating party through the zero-knowledge proof protocol, then use three-party collaboration to generate security parameters, including each participating party independently generating its security parameters, providing a basis for subsequent calculations and proofs, and processing the security parameters through modular arithmetic; where the security parameter: H = (h1, h2, h3) mod p, p is the prime number of the elliptic curve base field, H is a security parameter containing three sub-parameter vectors, and by using independently generated parameters, it prevents a single participating party from manipulating the generated parameters; h1, h2, h3 are the parameters independently generated by the first party, the second party, and the third party respectively; mod represents the modulo operation; modp performs the modulo p operation on all generated h i Perform the modulo p operation;

[0033] Step 3.2: After the generation of the security parameters is completed, the participating parties start local calculations. Each participating party calculates and generates proof tuples based on the local activation value; during the calculation process, the activation value, weight matrix, and bias vector are used to calculate the activation value of each layer of the neural network, and the activation value is compared with the defined zero-knowledge proof protocol. The proof generated by the participating party will be used to prove the correctness of the calculation result without disclosing the actual input data; where the activation value is y i = ReLU(W i x i + d i ), generate the input-output pair (x i , y i ) and keep x i private, where y i represents that the output of the i-th layer is calculated through the ReLU activation function and is the public output; W i represents the weight matrix of the i-th layer, x i represents the input of the i-th layer and is the secret input owned by the prover; d iDenote the bias of the \(i\)-th layer, which is used to adjust the neuron activation threshold; the role of ReLU is to output zero for the negative values of all activation values and keep the positive values unchanged;

[0034] Step 3.3: After local computation, the proof tuples generated by the participants will be used to construct a zero-knowledge proof, which is generated based on the calculation of the ReLU activation function and the R1CS constraint system, aiming to verify the correctness of the computation process without exposing any private data; meanwhile, the participants calculate the gradients, which serve as the basis for subsequent gradient processing; the constructed zero-knowledge proof is: Prove the existence of \(x\) such that, without leakage, verifying the computation correctness requires not only the activation result of the ReLU function for the input but also satisfying the R1CS constraints, thus ensuring the effectiveness and consistency of the computation; where the constructed zero-knowledge proof is \(\pi\) i , prove the existence of \(x\) i such that: Without leaking \(x\) i , verifying the computation correctness, \(y\) i ' requires not only the activation result of the ReLU function for the input but also satisfying the R1CS constraints, thus ensuring the effectiveness and consistency of the computation; Denote the logical AND operation, indicating that both conditions must hold to ensure that the computation process is legal and correct;

[0035] Step 3.4: The participants process the generated gradients, implementing gradient clipping and noise injection to protect privacy and ensure the stability of the training process; the gradient clipping operation ensures that the gradients are within a reasonable range to stabilize the training process, and noise injection protects privacy by adding noise to the gradients; where the gradient clipping is: \(\nabla W\) i ' = clip(\(\nabla W\) i , \(\Delta\)), and the noise injection is: \(\nabla W\) agg = \(\sum \nabla W\) i ' + \(N(0, \nu\) 2 ), where clip is the gradient clipping operation to ensure that the gradients are within a reasonable range and stabilize the training process; \(\Delta\) is the clipping threshold, \(\nu\) is the noise standard deviation to control the noise intensity; \(N(0, \nu\) 2 ) is Gaussian noise, and its purpose is to protect privacy by adding noise to the gradients; \(\nabla W\) i denotes the gradient of the \(i\)-th layer weight and the rate of change of the loss function with respect to this layer weight, \(\nabla W\) i ' represents the updated direction after applying the gradient clipping operation, \(\nabla W\) agg is the aggregated gradient, representing the weighted sum of the gradients calculated by multiple participants;

[0036] Step 3.5: The server completes the update of the global parameters by aggregating the calculation results of multiple participants. The gradients calculated by each participant are weighted and averaged according to the preset weights, and the parameters of the global model are updated. The parameter update rule is W n+1 = W n - η·▽W agg , where η is the learning efficiency, n is the number of iterations, W n is the model parameter of the current round, and W n+1 is the updated model parameter for the next round of training iteration.

[0037] Specifically, the present invention ensures the credibility of the calculation results through zero-knowledge proof and circuit modeling. At the same time, it prevents data leakage and result forgery through privacy protection, realizing the efficiency, privacy, and security of the calculation verification of the non-linear activation function. This combination provides technical support for the federated large model and privacy computing scenarios, enabling participants to achieve credible verification of the calculation results without exposing private data.

[0038] The beneficial effects of the present invention are as follows:

[0039] (1) A method for verifying the non-linear activation function of a credible federated large model based on zero-knowledge proof proposed by the present invention can effectively solve the privacy protection and calculation efficiency problems in the verification of the activation function in the federated large model, and ensure data integrity and the credibility of the global model;

[0040] (2) The method of the present invention reduces redundant signals and unnecessary constraint relationships by introducing circuit modeling tools and constraint optimization algorithms, significantly reducing the calculation complexity and resource overhead in the verification process;

[0041] (3) The method of the present invention combines the zero-knowledge proof protocol, and can efficiently verify the correctness of the calculation results of the non-linear activation function without leaking the data of the participants, significantly improving the privacy protection ability of the federated large model;

[0042] (4) The present invention provides an efficient, credible, and secure solution for the calculation verification of the non-linear activation function in scenarios such as federated learning through the deep combination of zero-knowledge proof, circuit modeling optimization, and privacy protection technology, not only improving the verification efficiency but also ensuring data privacy;

[0043] (5) The present invention is adapted to a variety of non-linear activation functions, providing a new idea for the privacy calculation of the federated large model and the construction of a credible data space. Description of the Drawings

[0044] The drawings are used to provide a further understanding of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention and do not constitute a limitation to the present invention. In the drawings:

[0045] Figure 1 It is a schematic diagram of the design process of a verification method for a non - linear activation function of a trusted federated large model based on zero - knowledge proof provided by an embodiment of the present invention. Detailed implementation manners

[0046] In order to make the purpose, technical solutions and advantages of the present invention clearer and easier to understand, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0047] In the following examples, the diagrams provided and the setting of specific parameter values in the model are mainly for explaining the basic concept of the present invention and conducting simulation verification on the present invention. In a specific application environment, appropriate adjustments can be made according to the actual scenario and requirements.

[0048] Embodiment 1: An embodiment of the present invention provides a verification method for a non - linear activation function of a trusted federated large model based on zero - knowledge proof, as Figure 1 shown, including:

[0049] Step 1: For the non - linear characteristics of the ReLU function, decompose the ReLU function into three groups of linear equations of sign determination, zero output, and Boolean constraints to form an R1CS constraint system.

[0050] Step 1.1: For the non - linear characteristics of the ReLU function, conduct a logical analysis of the ReLU function and define its piece - wise expression:

[0051]

[0052] where x is the input vector of a single neuron, and its vector dimension is determined according to the structure of the neural network and the dimension of the data; when x≥0, the original value is output, and when x < 0, it is forced to zero;

[0053] Step 1.2: Based on the logical analysis of the ReLU function, transform it into a circuit model. Through a circuit modeling tool, construct an arithmetic circuit including a numerical comparator, a conditional selector, and a constraint generator; among them, the numerical comparator is used to judge the non - negativity of the input value and generate a Boolean signal; the conditional selector determines the output value according to the Boolean signal; the constraint generator automatically generates verification constraints. The components of the circuit model are as follows:

[0054] Numerical comparator: Judge the non - negativity of the input value and output a Boolean signal b∈{0,1};

[0055] Conditional selector: Implement the output out = x·b through a multiplication gate;

[0056] Constraint generator: b·(x - out) = 0 and (1 - b)·out = 0;

[0057] Step 1.3: Based on the circuit model of the ReLU function, expand and optimize it to the matrix level. Each matrix element independently generates verification constraints and establishes a signal life cycle model, and the signal life cycle model is as follows:

[0058] live(v) = (t def , t lastuse )(2)

[0059] where live(v) is the active time period of the signal, t def represents the moment when the signal is defined, and t lastuse is the moment when the signal is last used, and after that, no component or constraint references the signal anymore;

[0060] Step 1.4: After completing the matrix - level circuit modeling, perform precision control on the signals calculated by the ReLU function circuit model. By defining the fixed - point conversion rule, multiply the actual value by the precision parameter; where the fixed - point conversion rule is stored value = actual value × 10 l , and l is the precision parameter;

[0061] Step 1.5: Convert the ReLU circuit logic into an R1CS constraint system, generating three groups of matrices (A, B, C) that satisfy: s is the signal vector, including all inputs, outputs, intermediate variables of the circuit, and the constant 1; represents the Hadamard product; The A matrix is the input matrix, defining the input variables and weights in each constraint. When performing circuit logic conversion on ReLU, the A matrix is used to describe the input signal x; The B matrix is the weight matrix. In ReLU verification, the B matrix is used to represent the relationship between the input variable and the conditional selection; The C matrix is the result matrix. In the constraints of ReLU, the C matrix is used to record the calculation result of the activation value.

[0062] Specifically, the ReLU function constraint system (taking the input x = 5 as an example) decomposes the ReLU function into three groups of constraints:

[0063] (1) Sign determination constraint: m = (x >> 63) & 1 (where m ∈ {0, 1}), used to extract the sign bit of a 64 - bit signed integer and determine the input sign through bitwise operations (for example, when x = 5, m = 0);

[0064] (2) Boolean constraint: m×(1 - m) = 0, ensuring that m can only take 0 or 1;

[0065] (3) Zero - output constraint: y = x×(1 - m), when m = 0, the output is 5.

[0066] The constructed R1CS constraint system matrix is represented as:

[0067] The left matrix W L :

[0068] The right matrix W R :

[0069] The output matrix W o :

[0070] Among them, the operation rules adopted by the above matrices are: In the operation rules, [x, m, 1]^T is a column vector, which represents the input vector (1 is the bias top).

[0071] Step 2: Based on the R1CS constraint system, adopt the zero-knowledge proof protocol to construct a verification equation containing bilinear pairing operations, and define a proof generation algorithm and a verification algorithm.

[0072] Step 2.1: According to the generated R1CS constraint system, construct a secure key pair for the zero-knowledge proof protocol. By performing key construction, generate a set of proof keys and generate corresponding verification keys for verification; during this process, generate an elliptic curve base point through a predefined random parameter and ensure that the random parameter remains unchanged throughout the protocol; among them, the set of proof keys is: Generate verification keys Where g1, g2 are elliptic curve base points, α, β, γ, τ are predefined random parameters, randomly selected in the initialization stage of the zero-knowledge proof protocol, and once selected, the random parameters remain unchanged in the subsequent process of the protocol; i is the number representation of each element in the set, with a value range from 0 to n - 1; τ i Represents raising the value of τ to the i-th power, and its role is to apply the exponent to the group element; P k Represents the set used to generate proof key elements; V k Is used to check the proof tuples generated through the proof key during the verification stage to see if they are correct;

[0073] Step 2.2: Based on the key generation, the participating parties generate zero-knowledge proof tuples according to their locally calculated activation values; each participating party combines the input matrix, weight matrix, and result matrix, generates an encrypted proof in combination with the key, and encrypts the generated proof through a commitment function; among them, the proof tuple Z = (A', B', C') satisfies: σ is a predefined random parameter; k is a random parameter; h(τ) is a polynomial commitment function that encrypts τ to generate a tamper-proof commitment value; A', B', and C' are matrices used to generate zero-knowledge proof tuples based on the R1CS constraint system. A' represents the input matrix of the proof tuple, corresponding to the activation values and parameters locally generated by the participating parties; B' represents the weight matrix of the proof tuple, corresponding to the encryption parameters used in the local calculations of the participating parties; C' represents the result matrix of the proof tuple, recording the results of calculating the activation values;

[0074] Step 2.3: The server uses bilinear pairing operations to verify the validity of the proof tuples generated by each participating party. The bilinear pairing operation verification equation is as follows: e is a bilinear pairing function operation that verifies and passes only when the constraint holds; A”, B”, and C” are elements from the proof tuple and are used to verify the validity of the proof tuple through the bilinear pairing function; It is used to verify whether α and β conform to the expected relationship. If the pairing result conforms to the expected relationship, it indicates that the proof pairing is valid; It is used to verify the consistency between C" and σ.

[0075] Specifically, in the implementation of the zk-SNARK protocol, it represents the bilinear pairing operation to verify the relationship between the input and calculation of the circuit; adopting the Groth16 protocol, the construction of the bilinear pairing verification equation involves the following content, and the bilinear pairing verification equation is as follows:

[0076] e(g1^A', g2^B') = e(g1^C', g2) × e(g1^α, g2 β ) × e(C", g2 σ ) (3)

[0077] It is used to verify the relationship between the input and calculation of the circuit. Among them, the role of e(g1^A', g2^B') is to verify whether the input and parameters in the calculation process are correctly associated to ensure that the calculation conforms to the constraints; the roles of e(g1^C', g2), e(g1^α, g2 β ) and e(C", g2 σ ) are to calculate intermediate results, constant factors, and parameters related to the constraints, and verify to ensure that the correct calculation logic is followed and all required constraints are met.

[0078] The proof generation algorithm is as follows: First, clarify the input parameters, which include public parameters, public inputs, and private witnesses. The public parameters are generated during protocol initialization and provided as fixed data to all participants throughout the proof process. The public inputs are the input data that all parties can share, while the private witnesses are the secret data held by the parties during the proof generation process. Then, by calculating the proof elements, specific zero-knowledge proof tuples are generated, and these proof elements will be used in the subsequent verification algorithm to ensure the correctness and security of the protocol.

[0079] Step 3: According to the proof generation algorithm and the verification algorithm, generate global public parameters through a multi-party secure computation protocol. The participating parties calculate and generate zero-knowledge proof tuples based on their local activation values, and the server receives the proofs generated by each participating party and performs aggregated verification.

[0080] Step 3.1: After generating the local zero-knowledge proof tuples of each participating party through the zero-knowledge proof protocol, then use three-party collaboration to generate security parameters, including each participating party independently generating its security parameters and processing the security parameters through modular arithmetic; where the security parameter: H = (h1, h2, h3) mod p, p is the prime number of the elliptic curve base field, and H is a security parameter containing three sub-parameter vectors; h1, h2, and h3 are the parameters independently generated by the first party, the second party, and the third party respectively; mod represents the modulo operation; modp performs modulo p operation on all generated h i Perform modulo p operation;

[0081] Step 3.2: After the generation of the security parameters is completed, the participating parties start local calculations. Each participating party calculates and generates proof tuples based on its local activation value; during the calculation process, the activation value, weight matrix, and bias vector are used to calculate the activation value of each layer of the neural network, and the activation value is compared with the defined zero-knowledge proof protocol. The proof generated by the participating party will be used to prove the correctness of the calculation result; where the activation value is y i = ReLU(W i x i + d i ), generate the input-output pair (x i , y i ) and keep x i private, where y i represents that the output of the i-th layer is calculated through the ReLU activation function and is the public output; W i represents the weight matrix of the i-th layer, x i represents the input of the i-th layer and is the secret input owned by the prover; d i represents the bias top of the i-th layer, which is used to adjust the neuron activation threshold; the role of ReLU is to output all negative activation values as zero and keep positive values unchanged;

[0082] Step 3.3: After local calculation, the proof tuples generated by the participating parties will be used to construct a zero-knowledge proof, which is generated based on the calculation of the ReLU activation function and the R1CS constraint system; meanwhile, the participating parties calculate the gradients; the constructed zero-knowledge proof is: Prove the existence of such that without leakage, the calculation correctness can be verified. Not only the activation result of the ReLU function for the input is required, but also the R1CS constraints need to be satisfied; where the constructed zero-knowledge proof is π i , prove the existence of x i such that: Verify the calculation correctness without leaking x i , y i 'Not only the activation result of the ReLU function for the input is required, but also the R1CS constraints need to be satisfied; represents the logical AND operation, indicating that both conditions must hold;

[0083] Step 3.4: The participating parties process the generated gradients, performing gradient clipping and noise injection; where the gradient clipping is: ▽W i ' = clip(▽W i , Δ), and the noise injection is: ▽W agg = Σ▽W i ' + N(0, ν 2 ), where clip is the gradient clipping operation; Δ is the clipping threshold, ν is the noise standard deviation, controlling the noise intensity; N(0, ν 2 ) is Gaussian noise; ▽W i represents the gradient of the i-th layer weight and the change rate of the loss function with respect to this layer weight, ▽W i ' represents the updated direction after applying the gradient clipping operation, ▽W agg is the aggregated gradient, representing the weighted sum of the gradients calculated by multiple participating parties;

[0084] Step 3.5: By aggregating the calculation results of multiple participating parties, the server completes the update of the global parameters. The gradients calculated by each participating party are weighted and averaged according to the preset weights, and the parameters of the global model are updated. The parameter update rule is W n+1 = W n - η·▽W agg , where η is the learning efficiency, n is the number of iterations, W n is the model parameter of the current round, and W n+1 is the updated model parameter for the next round of training iteration.

[0085] Specifically, in the multi-party secure computing protocol, the whole process is divided into three stages. The first stage is the parameter generation stage, which involves generating elliptic curve parameters and randomly selecting field elements, and then constructing global public parameters. These public parameters provide the basis for subsequent proof generation and verification. The parameter generation stage includes: generating elliptic curve parameters and randomly selecting field elements. In the second stage, namely the proof generation stage, each participant generates a zero-knowledge proof tuple according to its local activation values s i and t i as well as its related secret parameters. Specifically, each participant i generates a proof in the following form:

[0086] π i =(g1^(α + δ.s i ), g2^(β + γ.t i ), g1^(γδ(s i t i - Δ i ))) (4)

[0087] Among them, g1^(α + δ.s i ), g2^(β + γ.t i ) are used to prove the correctness of the calculation, Δ i is the calculation calibration value related to the i-th party, and g1^(γδ(s i t i - Δ i ) is used to increase the complexity of the calculation while ensuring that the generated proof tuple is valid.

[0088] In the final aggregation verification stage (executed by the server), the server batch-processes and verifies the distributed proofs generated by each participant to ensure the correctness and consistency of the protocol. The core equation for verification is as follows:

[0089]

[0090] Among them, the pairings generated by all participants are Performing a pairing operation on the product C i generated by all participants with the base point g2, is to perform a pairing operation on the base point by combining predefined random parameters.

[0091] Furthermore, in the step 1, in the construction of the ReLU function constraint system, the symbol determination optimization uses an arithmetic shift operation (x >> 63) to replace the traditional sign function sign(x), converting the symbol determination into a bit operation. For an integer x, when x ≥ 0, the highest bit is 0 and m = 0; when x < 0, the highest bit is 1 and m = 1. This operation only requires 1 multiplication gate in the circuit constraint. Traditional ReLU verification requires a comparison operation x ≥ 0. In this solution, by introducing the sign bit m, the conditional judgment is converted into a linear operation: y = x - m × x. This expression holds in the finite field and automatically zeros out when m = 1, avoiding the use of a non-linear comparison gate.

[0092] In addition to the basic constraint m × (1 - m) = 0, a range proof is added:

[0093]

[0094] Among them, the purpose is to ensure that the sum of each bit in the binary expansion of x is m, where s k ∈ {0, 1}.

[0095] Furthermore, in the step 2, some mathematical constructs are defined to generate the proof key set and the verification key. The proof key set is used to generate zero-knowledge proofs. This set contains various keys required by the parties, and is used by the prover to generate valid proof tuples. In the key generation process, randomly selected parameters are used to generate the public key and the proof key. Through these random numbers, the unpredictability of the keys can be ensured. This process relies on the mathematical structure of the elliptic curve group and can ensure the security of the keys, preventing the private key from being deduced. The generated public key and private key form the basis in the zero-knowledge proof process, providing a reliable encryption tool for subsequent proof generation and verification.

[0096] Furthermore, in the step 3, the key technical details of distributed verification include the generation of threshold parameters and proof aggregation verification. First, a (t, n)-threshold BLS signature scheme (t = 2, n = 3) is used to generate the common parameters. Among them, t represents the minimum number of participating parties required for signing, n represents the total number of participating parties, and the BLS signature scheme is the name of a digital signature scheme based on bilinear pairing. In this process, each participating party i generates a private key sk i , which belongs to the finite field F p , and calculates the corresponding public key. Then, by calculating the joint public key Πpk i ^{λ i}, where λ i is the Lagrange coefficient, to obtain the overall joint public key. Each participating party also generates a parameter signature δ i = Hash(crs)^{sk i, and then aggregate all the signatures to obtain the final aggregated signature Πδ i . Among them, Hash represents the hash function, which is used to map the input data to an output value of a fixed size, crs represents the common reference string, which is used to generate the cryptographic signature, and {sk i} represents the private key of the i-th party. These steps ensure that the generated common parameters and signatures can be effectively used for subsequent verification.

[0097] In the proof aggregation verification stage, the server uses batch verification technology to simplify the verification process, and combines n verification equations into: e(ΠA i , ΠB i ) = e(ΠC i , g2) × e(g1^{αβn+αγΣt i +βδΣs i}), g2), and combines each element through scalar multiplication to reduce the verification complexity; among them, e(ΠA i , ΠB i ) represents mapping two group elements to a scalar to verify whether the cryptographic commitments are consistent; the right side of the equation represents the product of the results of two bilinear mappings, and the validity of the proof is checked by checking whether the left side of the equation is equal to the right side. If they are equal, it is valid, otherwise it is invalid.

[0098] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A verification method for the non - linear activation function of a trusted federated large model based on zero - knowledge proof, characterized in that, Including: Step 1: Regarding the non-linear characteristics of the ReLU function, decompose the ReLU function into three sets of linear equations for sign determination, zero output, and Boolean constraints to form an R1CS constraint system; Step 2: Based on the R1CS constraint system, adopt a zero-knowledge proof protocol to construct a verification equation containing bilinear pairing operations, and define a proof generation algorithm and a verification algorithm; Step 3: According to the proof generation algorithm and the verification algorithm, generate global public parameters through a multi-party secure computation protocol. The participating parties calculate and generate zero-knowledge proof tuples based on local activation values, and the server receives the proofs generated by each participating party and performs aggregated verification.

2. The method for verifying a non - linear activation function of a trusted federated large model based on zero - knowledge proof according to claim 1, wherein, The said Step 1 includes: Step 1.1: Regarding the non-linear characteristics of the ReLU function, conduct a logical analysis of the ReLU function and define its piecewise expression: where x is the input vector of a single neuron, and its vector dimension is determined according to the structure of the neural network and the dimension of the data; the original value is output when x ≥ 0, and it is forced to zero when x < 0; Step 1.2: Based on the logical analysis of the ReLU function, transform it into a circuit model. Through a circuit modeling tool, construct an arithmetic circuit containing a numerical comparator, a conditional selector, and a constraint generator; among them, the numerical comparator is used to judge the non-negativity of the input value and generate a Boolean signal; the conditional selector determines the output value according to the Boolean signal; the constraint generator automatically generates verification constraints. The components of the circuit model are as follows: Numerical comparator: Judge the non-negativity of the input value and output a Boolean signal b ∈ {0, 1}; Conditional selector: Implement the output out = x · b through a multiplication gate; Constraint generator: b · (x - out) = 0 and (1 - b) · out = 0; Step 1.3: Based on the circuit model of the ReLU function, expand and optimize it to the matrix level. Each matrix element independently generates verification constraints and establishes a signal life cycle model. The signal life cycle model is as follows: live(v)=(t def ,t lastuse ) (2) where live(v) is the active time period of the signal, t def represents the time when the signal is defined, t lastuse is the time when the signal is last used, after which no component or constraint references the signal anymore; Step 1.4: After completing the matrix-level circuit modeling, perform precision control on the signal calculated by the ReLU function circuit model. By defining the fixed-point number conversion rule, multiply the actual value by the precision parameter; where the fixed-point number conversion rule is stored value = actual value × 10 l , where l is the precision parameter; Step 1.5: Convert the ReLU circuit logic into an R1CS constraint system, generating three groups of matrices (A, B, C) that satisfy: s is a signal vector that contains all the inputs, outputs, intermediate variables, and the constant 1 of the circuit; denotes the Hadamard product; the A matrix is the input matrix that defines the input variables and weights in each constraint. When performing the circuit logic conversion of ReLU, the A matrix is used to describe the input signal x; the B matrix is the weight matrix, and in the ReLU verification, the B matrix is used to represent the relationship between the input variables and the conditional selection; the C matrix is the result matrix, and in the ReLU constraints, the C matrix is used to record the calculation results of the activation values.

3. The method for verifying a non-linear activation function of a trusted federated large model based on zero-knowledge proof according to claim 1, wherein The said Step 2 includes: Step 2.1: According to the generated R1CS constraint system, construct a secure key pair for the zero-knowledge proof protocol. By performing key construction, generate a set of proof keys and generate corresponding verification keys for verification; during this process, generate an elliptic curve base point through predefined random parameters and ensure that the random parameters remain unchanged throughout the protocol; wherein, the set of proof keys is: Generate verification keys where g1, g2 are elliptic curve base points, and α, β, γ, τ are predefined random parameters randomly selected in the initialization stage of the zero-knowledge proof protocol. Once selected, the random parameters remain unchanged in the subsequent process of the protocol; i is the number representation of each element in the set, with a value range from 0 to n-1; τ i represents raising the value of τ to the i-th power, and its function is to apply the exponent to the group element; P k represents the set used to generate the elements of the proof key; V k is used to check the proof tuples generated through the proof key during the verification stage to see if they are correct; Step 2.2: Based on the key generation, the participating parties generate zero-knowledge proof tuples according to their locally computed activation values; each participating party generates an encrypted proof by combining the input matrix, weight matrix, and result matrix with the key, and encrypts the generated proof through a commitment function; where the proof tuple Z = (A', B', C') satisfies: σ is a predefined random parameter; k is a random parameter; h(τ) is a polynomial commitment function that encrypts τ to generate a tamper-proof commitment value; A', B', C' are matrices used to generate zero-knowledge proof tuples based on the R1CS constraint system, where A' represents the input matrix of the proof tuple, corresponding to the activation value and parameters locally generated by the participating party; B' represents the weight matrix of the proof tuple, corresponding to the encryption parameters used in the local computation of the participating party; C' represents the result matrix of the proof tuple, recording the result of the computed activation value; Step 2.3: The server uses bilinear pairing operations to verify the validity of the proof tuples generated by each participant. The bilinear pairing operation verification equation is as follows: e is the bilinear pairing function operation, and it passes only when the constraint holds; A”, B”, C” are elements from the proof tuple and are used to verify the validity of the proof tuple through the bilinear pairing function; It is used to verify whether α and β conform to the expected relationship. If the pairing result conforms to the expected relationship, it indicates that the proof pairing is valid; It is used to verify whether C" is consistent with σ.

4. The method for verifying the non - linear activation function of a trusted federated large model based on zero - knowledge proof according to claim 1, characterized in that, The said Step 3 includes: Step 3.1: After generating the zero-knowledge proof tuples of each participating party locally through the zero-knowledge proof protocol, then use three-party collaboration to generate security parameters, including each participating party independently generating its security parameters and processing the security parameters through modular arithmetic; where the security parameter: H = (h1, h2, h3) mod p, p is the prime number of the elliptic curve base field, and H is a security parameter containing three sub-parameter vectors; h1, h2, and h3 are the parameters independently generated by the first party, the second party, and the third party respectively; mod represents modular arithmetic; modp performs modular p arithmetic on all generated h i Perform modular p arithmetic; Step 3.2: After the generation of the security parameters is completed, the participating parties start local computations. Each participating party calculates and generates a proof tuple based on the local activation value. During the calculation process, the activation value, weight matrix, and bias vector are used to calculate the activation value of each layer of the neural network, and the activation value is compared with the predefined zero-knowledge proof protocol. The proof generated by the participating parties will be used to prove the correctness of the calculation result. The activation value is y i = ReLU(W i x i + d i ), generate the input-output pair (x i , y i ) and keep x i private, where y i represents that the output of the i-th layer is calculated through the ReLU activation function and is the public output; W i represents the weight matrix of the i-th layer, x i represents the input of the i-th layer and is the secret input owned by the prover; d i represents the bias of the i-th layer, which is used to adjust the neuron activation threshold; the role of ReLU is to output all negative activation values as zero and keep positive values unchanged; Step 3.3: After local computation, the proof tuples generated by the participants will be used to construct a zero-knowledge proof, which is generated based on the calculation of the ReLU activation function and the R1CS constraint system; meanwhile, the participants calculate the gradients; the constructed zero-knowledge proof is: to prove the existence of such that the calculation correctness can be verified without leakage, not only the activation result of the ReLU function on the input is required, but also the R1CS constraints need to be satisfied; where the constructed zero-knowledge proof is π i , to prove the existence of x i such that: y i ' = ReLU(x i ) ∩ R1CS(x i , y i ) Verify the calculation correctness without leaking x i ; for y i ', not only the activation result of the ReLU function on the input is required, but also the R1CS constraints need to be satisfied; ∩ represents the logical AND operation, indicating that both conditions must hold; Step 3.4: The participating parties process the generated gradients, implementing gradient clipping and noise injection; where gradient clipping is: Noise injection is: where clip is the gradient clipping operation; Δ is the clipping threshold, ν is the noise standard deviation, controlling the noise intensity; N(0,ν 2 ) is Gaussian noise; represents the gradient of the i-th layer weight and the rate of change of the loss function with respect to the weight of this layer, represents the update direction after applying the gradient clipping operation, is the aggregated gradient, representing the weighted sum of the gradients calculated by multiple participating parties; Step 3.5: By aggregating the calculation results of multiple participants, the server completes the update of the global parameters. The gradients calculated by each participant are weighted and averaged according to the preset weights, and the parameters of the global model are updated. The parameter update rule is η is the learning efficiency, n is the number of iterations, and W n is the model parameter of the current round, and W n+1 is the updated model parameter for the next round of training iteration.

Images