Privacy protection reasoning method of binary neural network model under outsourcing calculation

Abstract

The invention discloses a privacy protection reasoning method of a binary neural network model under outsourcing computing, and belongs to the field of neural network reasoning under an outsourcing computing environment. The method comprises the steps that firstly, an inference system composed of a model owner, an edge server group and a user is built, the model owner executes RSS, BNN model parameters are encrypted and distributed to three edge servers, sign functions are operated, FSS function keys are generated, and the FSS function keys are distributed to all the edge servers; and simultaneously generating a random number mask for multiplication and data transmission. And then, aiming at the BNN model, designing an activation function optimization nonlinear operation based on an FSS and RSS hybrid protocol, constructing a convolutional layer based on RSS, and providing efficient linear operation by a full connection layer. And finally, the user adds and reconstructs the query result of the BNN model locally by using the addition homomorphic property of secret sharing to obtain a plaintext reasoning result. According to the method, lightweight construction of each module in the BNN is completed, the reasoning efficiency is improved, and reasoning data privacy is protected in a computing resource limited environment.

Description

Technical Field

[0001] The present invention belongs to the field of neural network reasoning in an outsourced computing environment, and specifically refers to a privacy-preserving reasoning method for a binary neural network model in outsourced computing. Background Art

[0002] In outsourced computing environments such as edge computing, the demand for neural network inference is growing. In resource-constrained environments, such as the Internet of Vehicles (IoV), tasks such as object detection and speech recognition urgently require efficient and low-power solutions. Binary Neural Networks (BNNs), as lightweight deep learning models, significantly reduce computational complexity and storage requirements by restricting weights and activation values ​​to binary values. However, in outsourced computing environments, the model parameters of the neural network and user input data may be leaked to the outsourced server. Therefore, effective privacy protection technologies are needed to achieve efficient model inference while protecting model parameters and user input.

[0003] In recent years, numerous studies have gradually introduced privacy-preserving technologies into neural networks. For example, SecureML and SecureNN achieve privacy-preserving training and inference of models through secure multi-party computation. Regarding privacy protection for BNN models, researchers have conducted in-depth research focusing on training stability and inference accuracy. For example, Banners uses Replicated Secret Sharing (RSS) to improve BNN inference speed on edge servers; SecureBiNN improves BNN inference efficiency by combining adjacent model structures; FlexBNN proposes a flexible bit-width conversion method to reduce online communication overhead; and FssiBNN further improves BNN inference speed based on Function Secret Sharing (FSS).

[0004] Although existing research attempts to adopt a variety of cryptographic techniques to improve the privacy-preserving reasoning efficiency of BNNs in outsourced computing scenarios, due to the introduction of secure multi-party computing features, the network communication overhead is still too high, thus facing challenges in actual deployment.

[0005] In the existing BNN privacy protection reasoning scheme based on secret sharing, the technology such as Arithmetic Secret Sharing (ASS) or RSS is used to implement the privacy protection processing of each computing module in the model. Figure 1 As shown in Figure 2, the BNN reasoning solution based on secret sharing mainly includes the following modules:

[0006] (1) Fully connected and convolutional layers. The parameters of these layers are binary values, usually {-1, +1}. During forward propagation, the weights W, biases B, and convolution kernels perform binary operations on the input signal to reduce the complexity and storage requirements of the model. This binarization can significantly improve the inference speed and reduce memory usage. In addition, the existing technology uses ASS and Beaver triples to assist in implementing secure multi-party computation, effectively utilizing linear multiplication to perform computations that ensure multi-party security and privacy.

[0007] (2) Activation function. In traditional neural networks, commonly used activation functions such as ReLU usually return positive numbers. However, in order to adapt to the binary representation of weights and activations, BNNs usually use the sign function Sign instead. This substitution allows each activation value to be perfectly mapped to binary form, thereby improving computational efficiency. At the same time, existing work usually builds a parallel carry adder (PPA) based on ASS, and implements comparison operations on secret shared values ​​through multiple rounds of communication to ensure the security of multiple parties.

[0008] (3) Maximum pooling. BNNs only use maximum pooling as a downsampling strategy. During this process, the maximum pooling layer selects the maximum value from the output of the activation function and generates the corresponding binary output. Specifically, in this way, BNNs can optimize output information and reduce redundancy, while helping to extract key features and enhance model performance. Existing work usually implements the maximum pooling function based on PPA comparison and local addition and subtraction.

[0009] (4) Batch Normalization. When γ > 0, BatchNorm can be simplified to an additive form and calculated together with the Sign function. The specific formula is Sign(α + (β / γ)), where the bias terms α and β are adjusted to accommodate the needs of binary activation.

[0010] Based on the above modules, multiple edge servers will perform inference tasks based on the input data and ultimately return the generated result shares to the user. The user will reconstruct the plaintext results locally from the result shares returned by the server, thus achieving efficient BNN inference while ensuring data privacy.

[0011] In outsourced computing environments such as edge computing, existing technologies for building privacy-preserving BNN reasoning have the following problems:

[0012] (1) For linear operations, the linear operations based on the ASS and FSS schemes require the use of auxiliary variables such as multiplication triplets to introduce a large amount of communication.

[0013] (2) For nonlinear operations, directly applying ASS to a parallel carry adder (PPA) to implement a secure comparison protocol results in more communication rounds, and the communication cost increases with the number of data bits. Current RSS-based schemes utilize share conversion between ASS and RSS to evaluate BNNs, resulting in additional communication rounds and higher communication overhead. Summary of the Invention

[0014] This paper proposes a privacy-preserving reasoning method for the BNN model under outsourced computing, which uses RSS technology to construct linear calculations and FSS technology to construct nonlinear calculations to meet the reasoning efficiency requirements when deployed in a resource-constrained outsourced computing environment.

[0015] A privacy-preserving inference method for a BNN model under outsourced computing includes the following steps:

[0016] Step 1: Build an inference system consisting of a model owner, an edge server group, and users;

[0017] The model owner is a trusted entity that uses RSS technology to divide the BNN model into shares and then provides these shares to three edge servers that do not collude with each other;

[0018] The three edge servers that do not collude with each other process the user's inference request according to a customized protocol and return their respective share of the query results to the client;

[0019] The user uses lightweight additive secret sharing technology to divide the data query request into three shares, sends them to the edge server group, and reconstructs them into plaintext locally after receiving the three query results.

[0020] In step 2, the model owner executes RSS to encrypt and distribute the BNN model parameters to the three edge servers to complete the offline deployment.

[0021] Edge Server P i The shares of the input parameter "W" i , data share "X" i , i∈{0,1,2}.

[0022] Step 3: The model owner runs the symbolic function in the offline phase to generate the FSS function key and distributes it to each edge server; at the same time, a random number mask α is generated. i (satisfying α0+α1+α2=0), used for multiplication operations and data transmission.

[0023] First, an interval function (IC) is constructed based on the distributed comparison function (DCF) in FSS, specifically:

[0024] The distributed comparison function f satisfies: f(x) = β if x > α, else 0;

[0025] Based on two DCF operations, we further construct an IC function that satisfies: p,q (x)=1 x∈[p,q] .

[0026] Then, based on the IC function, let f p,q (x) where p = 0, q = 2 n-1 , the secret sharing value is n bits, and a comparison function based on FSS is implemented.

[0027] Finally, by running the Gen part of the symbolic function, the function keys k0, k1 and random input value masks r0, r1 of the FSS are generated and distributed to the edge servers P0, P1 to generate the random output value mask r out Distribute to edge server P2.

[0028] Step 3: Build RSS-based FC / Conv layers for BNN.

[0029] In BNNs, there are two types of linear combinations of input X and parameters W: fully connected layers (FC) and convolutional layers (Conv). Fully connected layers are expressed as WX + b, where addition relies on the local operation of the same platform property of secret sharing, and the main computation comes from matrix multiplication. Convolutional layers convert the input and weights into matrix multiplication by applying the Toeplitz transform.

[0030] The RSS re-sharing technology is used to perform multiplication on the fully connected layer, specifically:

[0031] Consider an arbitrary fully connected layer input X, weight W, and bias b of the input / output layer stored in a secret sharing manner between edge servers, and each edge server jointly calls the multiplication protocol to calculate the result. In this multiplication protocol, the three edge servers each hold the RSS share of the model parameters W and the user input X. Each edge server P i Compute locally <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 ; Afterwards, each edge server performs re-sharing, using the random number mask α pre-generated in the offline phase i encryption <y> i , the encrypted <y> i Sent to the neighboring party, each participant calculates the RSS share of the multiplication result locally based on the received data < <y>> i =< <W·X》 i .

[0032] Step 4: Construct an activation function based on the RSS and FSS hybrid protocol for BNN.

[0033] The activation function in BNN, namely the Sign function, is constructed based on FSS. The calculation is completed through the two stages of generation (Gen) and evaluation (Eval). The FSS paradigm is constructed by converting the function into offset form and adding a random number mask. The FSS-based BA function is constructed in a form that supports RSS in input and output. A hybrid protocol of RSS and FSS is designed. The specific process is as follows:

[0034] First, consider a three-party RSS scenario and represent the Sign function as an offset function containing input and output masks. The sum of r0 and r1 is used as the input value mask to satisfy r in = r0 + r1, the value of r2 is used as the output value mask to satisfy r out = r2. Using a trusted third party as a dealer, the random numbers r0, r1, and r2 are distributed to the three parties. At this time, the three parties hold shares: P0{< <x> >0,<r in >0}，P1{< <x> >1,<r in >1}，P2{< <x>>2,r out }.

[0035] Next, the trusted third party divides the entire process into two stages, offline and online, based on the FSS paradigm to build and execute the above functions, as follows:

[0036] The dealer first generates a random number r and constructs the corresponding offset function. Then, the dealer generates the shared key (k0, k1) through the FSS generation protocol Gen and distributes the keys k0 and k1 to the participants P0 and P1 respectively.

[0037] In the online phase, P0 and P1 first reconstruct the masked input value x+r in , using it as input locally using the function key k i Execute the evaluation protocol Eval(x+r in ) is calculated, and the share of the result is recorded as <res> 0， <res>1. At this time, participant P2 locally calculates <res>2=-r out ; At this time, it is observed Each of the three parties holds an additive secret share of the input value X after passing it through the Sign function.

[0038] Finally, each participant performs a round of re-sharing, P j Each of them will <res> j Send to P (j+1)mod3 , so that each party locally holds secret sharing in the form of RSS< <o> > j ＝{ <o> j , <o> (j+1)mod3 }, complete the hybrid protocol design of FSS and RSS.

[0039] Step 5: Construct the maximum pooling layer and regularization layer for BNN.

[0040] The maximum pooling layer in BNN outputs a binary result for each position in the image and finally sums them up. Based on local addition and SecBA, the maximum pooling function SecMaxPool is obtained, which is specifically:

[0041] When considering the single-channel case, the maximum pooling is performed by Slide the window of size k×k up with a stride of s (usually s=k) to calculate the output in At this time, the SecMaxPool operation calls the secure addition and SecBA operations in parallel d′2·d′2 times. The addition protocol does not require any communication, and the SecBA protocol only needs to reconstruct x+r in the online phase. in And re-sharing is performed, a total of two rounds of communication are required to complete the operation.

[0042] The regularization operation in the hidden layer is combined with the adjacent activation function to be expressed as an activation function operation. In BNN, the regularization operation appears together with the BA operation except in the output layer, in the form of BA(BN(x)). For the BN operation, given the input share <x>And the parameters <γ> and <β> in the regularization formula γ·x+β, pre-calculate <β> / <γ> locally and share them secretly, converting the activation function and regularization into separate activation function operations: BA(BN( <x>))=BA(<γ>· <x>+<β>)=BA( <x>+<β> / <γ>), where BA(x)=Sign(x).

[0043] In step 6, the user divides the data query into three parts and sends them to three edge servers respectively. The three edge servers perform queries based on the BNN models constructed in steps 3, 4, and 5, and return the reasoning results after the query to the user end respectively. The user locally uses the additive homomorphic property of secret sharing to add and reconstruct the plaintext reasoning results.

[0044] The advantages and beneficial effects of the present invention are:

[0045] (1) This paper proposes a privacy-preserving inference method for BNN models. It optimizes the efficiency of linear and nonlinear computations using lightweight cryptographic primitives RSS and FSS, respectively. It also constructs a hybrid protocol using lightweight secret sharing primitives to improve inference speed during the online phase. Through the design of a preprocessing scheme and hybrid protocol, it achieves faster speed and lower online communication volume, achieving more efficient inference computation.

[0046] (2) This paper proposes a privacy-preserving inference method for BNN models under outsourced computing, which protects the privacy of inference data while improving inference efficiency in an environment with limited computing resources. The overall solution is implemented based on secure multi-party computing technology. In terms of privacy protection, the solution designs activation functions based on the FSS and RSS hybrid protocol to optimize nonlinear operations, constructs convolutional layers and fully connected layers based on RSS to provide efficient linear operations, and completes the lightweight construction of various modules in the BNN to ensure the security of the model and input data during the inference process. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is an existing secret sharing BNN inference scheme;

[0048] Figure 2 This is a privacy-preserving reasoning method for the BNN model under edge cloud computing proposed by the present invention. DETAILED DESCRIPTION

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0050] This paper proposes a privacy-preserving inference method for BNN models under outsourced computing, which uses RSS technology to construct linear computing and FSS technology to construct nonlinear computing:

[0051] (1) Utilize FSS technology to build nonlinear computations. By using a preprocessing mechanism to generate function-based keys in the offline phase, a large amount of computation is transferred from the online phase to the offline phase, significantly reducing server communication overhead and optimizing the problem of excessive online overhead in previous PPA-based solutions.

[0052] (2) Using RSS technology to construct linear operations, the multiplication operation efficiency achieved is higher than that based on Beaver multiplication triples. At the same time, a hybrid protocol design scheme of RSS and FSS under neural networks is proposed to give full play to the advantages of both to improve the efficiency of linear and nonlinear operations and achieve efficient BNN reasoning.

[0053] A privacy-preserving reasoning system for BNN models under outsourced computing consists of three types of entities: edge server groups, model owners, and users, such as Figure 2 As shown:

[0054] (1) Model owner. The model owner is a trusted entity that uses RSS technology to divide the BNN model into shares and then provides these shares to three non-colluding edge servers to provide inference services to users.

[0055] (2) Edge server group. Three servers that do not collude with each other will process the user's inference request according to a customized protocol.

[0056] (3) User. The user uses lightweight additive secret sharing technology to divide the data query into three shares. The edge server group returns the share of each query result to the client, and the client reconstructs it into plaintext locally.

[0057] A privacy-preserving inference method for BNN models under outsourced computing. The specific steps are as follows:

[0058] (1) Offline deployment phase.

[0059] First, the model owner needs to encrypt and deploy the BNN model parameters to the server group in advance to provide the service. Specifically, the model owner needs to execute RSS to encrypt and distribute the model parameters to three non-colluding servers to complete the deployment.

[0060] (2) Function key and random number generation.

[0061] First, an interval function (IC) is constructed based on the distributed comparison function (DCF) in FSS. The distributed comparison function f satisfies: f(x) = β if x>α, else 0. Based on two DCF operations, an IC function is further constructed to satisfy: f p,q (x)=1 x∈[p,q] .

[0062] Continuing based on the IC function, let f p,q (x) where p = 0, q = 2 n-1 (Secret sharing value is n bits) Implement a comparison function based on FSS.

[0063] Finally, run the symbolic function;

[0064] The symbolic function is divided into two parts: Gen and Eval. The offline calculation is performed locally in advance, and the online part is calculated interactively by the two servers. See Algorithm 2 for details.

[0065] In this offline phase, only the Gen portion of Algorithm 2 is run to generate the FSS key and distribute it to each participating server to support the subsequent online calculation of the activation function. At the same time, the random number mask required for multiplication operations and data transmission is also generated in this phase.

[0066] (3) Construction of FC / Conv layer based on RSS.

[0067] There are two main types of linear combinations of input X and parameters W in BNN: fully connected layers (FC) and convolutional layers (Conv). The fully connected layer can be expressed as WX+b, where the addition operation can be performed locally by relying on the same-platform property of secret sharing, and the main calculation comes from matrix multiplication; the convolutional layer can be converted into matrix multiplication by applying the Toeplitz transform to the input and weights. The RSS re-sharing technology can perform multiplication operations efficiently. Consider an arbitrary fully connected layer with input X, weights W (and bias b of the input / output layer) stored in a secret-sharing manner among participants, and participants jointly call the multiplication protocol to calculate the result, see Algorithm 1. The protocol can be easily extended to convolution operations and batch normalization. In the protocol, the three participants each hold an RSS share of the model parameters W and the user input X, and each party P i Only local calculation is required <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 ; Afterwards, each party performs re-sharing, using the random number mask α pre-generated in the offline phase i encryption <y> i , the encrypted <y> i Send to the neighboring party, each participant calculates locally based on the received data, and finally obtains the RSS share of the multiplication result < <y>> i =<<W·X> > i .

[0068]

[0069] (4) Construction of activation function based on RSS and FSS hybrid protocol.

[0070] When constructing the activation function in BNN, due to its binarization characteristics, the activation function in BNN adopts the Sign function. Therefore, the Sign function is constructed based on FSS, and the calculation is completed through the two stages of generation (Gen) and evaluation (Eval) to improve its online communication efficiency. At the same time, since the overall system of the present invention adopts RSS shares as input and output, and FSS requires the input to be plain text and the output to be ASS shares, the focus is on constructing the BA function based on FSS into a form that supports RSS in input and output. Therefore, the present invention constructs the FSS paradigm by converting the function into an offset form and adding a random number mask, and designs a hybrid protocol of RSS and FSS. In order to ensure privacy, the input RSS shares are held by three parties respectively, and the output RSS shares are dynamically calculated through the generation and evaluation process of FSS. The offset function family applied to the FSS paradigm is defined as

[0071] First, consider a three-party RSS scenario where the goal is to represent the Sign function as an offset function containing input and output masks. The sum of r0 and r1 is used as the input value mask to satisfy r in = r0 + r1, the value of r2 is used as the output value mask to satisfy r out = r2. Using a trusted third party as a dealer, the random numbers r0, r1, and r2 are distributed to the three parties. At this time, the three parties hold shares: P0{< <x> >0,<r in >0}，P1{< <x> >1,<r in >1}，P2{< <x>>2,r out }.

[0072] Next, the trusted third party divides the entire process into two stages, offline and online, based on the FSS paradigm to build and execute the above function. As mentioned above, the function key has been generated and distributed to the participants in the offline stage. Specifically, the dealer first generates a random number r and constructs the corresponding offset function. Then, the dealer generates the function sharing key (k0, k1) through the FSS generation protocol Gen and distributes the keys k0 and k1 to the participants P0 and P1 respectively. In the online stage, P0 and P1 first reconstruct the masked input value x+r in , using it as input locally using the function key k i Execute the evaluation protocol Eval(x+r in ) is calculated, and the share of the result is recorded as <res> 0， <res>1. At this time, participant P2 locally calculates <res>2=-r out At this point, we can observe Each of the three parties holds an additive secret share of the input value X after passing the Sign function. In order to complete the subsequent calculation, only one round of re-sharing is required, P j Each of them will <res> j Send to P (j+1)mod3 , so that each party locally holds secret sharing in the form of RSS< <o> > j ＝{ <o> j , <o> (j+1)mod3 }, complete the hybrid protocol design of FSS and RSS.

[0073] The binary activation function operation constructed based on the hybrid FSS and RSS protocol is the SecBA algorithm. The specific process is shown in Algorithm 2. By combining the characteristics of RSS and FSS, this scheme implements efficient binary activation function operation based on input and output masks. This scheme not only utilizes FSS to optimize the execution efficiency of nonlinear operations, but also integrates it with RSS to enable its embedding into the entire RSS-based inference process, providing a new combined solution for distributed computing while ensuring privacy.

[0074]

[0075]

[0076] (5) Construction of maximum pooling layer and regularization layer.

[0077] In a BNN, the max pooling (maxPool) layer always follows batch normalization and binary activation layers, outputting a binary result for each position in the image and ultimately summing the results. Therefore, max pooling can be computed via secure addition and secure comparison. The additive homomorphic properties of secret sharing can be computed locally, while secure comparison operations can be implemented using the SecBA function described above. Therefore, the max pooling function SecMaxPool can be easily derived based on local addition and SecBA.

[0078] When considering the single-channel case, the maximum pooling is performed by Slide the window of size k×k up with a stride of s (usually s=k) to calculate the output in At this time, the SecMaxPool operation can call the secure addition in parallel, and the secure BA operation can be performed d′2·d′2 times. As mentioned above, the addition protocol does not require any communication, and the SecBA protocol only needs to reconstruct x+r in the online phase. in And re-sharing, a total of two rounds of communication can complete the operation.

[0079] The regularization operation in the hidden layer can be combined with the adjacent activation function to be uniformly expressed as an activation function operation, so there is no need to explain it separately. In BNN, the regularization operation appears together with the BA operation except in the output layer, in the form of BA(BN(x)). For the BN operation, given the input share <x>As for the parameters <γ> and <β> in the regularization formula γ·x+β, we can pre-calculate <β> / <γ> locally and share them secretly, so that the activation function and regularization that appear together can be transformed into a separate activation function operation: BA(BN( <x>))=BA(<γ>· <x>+<β>)=BA( <x>+ <β> / <γ>), where BA(x)=Sign(x). It can be proved that in this scenario, BA(<γ>· <x>+<β>)=BA( <x>+<β> / <γ>), since γ is a positive number.

[0080] (6) The complete process result is returned.

[0081] Finally, the calculated inference results are returned to the user by each server, and the user locally reconstructs the plaintext inference results by adding them together using the additive homomorphic property of secret sharing.< / x> < / x> < / x> < / x> < / x> < / x> < / o> < / o> < / o> < / res> < / res> < / res> < / res> < / x> < / x> < / x> < / y> < / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y> < / x> < / x> < / x> < / x> < / o> < / o> < / o> < / res> < / res> < / res> < / res> < / x> < / x> < / x> < / y> < / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y>

Claims

1. A privacy-preserving inference method for BNN models under outsourced computing, characterized by: The following steps are involved: Step 1: Build an inference system consisting of a model owner, an edge server group, and users; In step 2, the model owner executes RSS to encrypt and distribute the BNN model parameters to the three edge servers to complete the offline deployment. Edge Server P i The shares of the input parameter "W" i , data share "X" i , i∈{0,1,2}; Step 3: The model owner runs the symbolic function in the offline phase to generate the FSS function key and distributes it to each edge server; at the same time, a random number mask α is generated. i , used for multiplication and sending data; First, an interval function IC is constructed based on the distributed comparison function DCF in FSS, specifically: The distributed comparison function f satisfies: f(x) = β if x > α, else 0; Based on two DCF operations, we further construct an IC function that satisfies: p,q (x)=1 x∈[p,q] . Then, based on the IC function, let f p,q (x) where p = 0, q = 2 n-1 , the secret sharing value is n bits, and a comparison function based on FSS is implemented; Finally, by running the Gen part of the symbolic function, the function keys k0, k1 and random input value masks r0, r1 of the FSS are generated and distributed to the edge servers P0, P1 to generate the random output value mask r out Distribute to edge server P2; Step 4: For the BNN model, construct its RSS-based FC / Conv layer, activation function based on the hybrid protocol of RSS and FSS, and maximum pooling layer and regularization layer respectively; Step 401, constructing an RSS-based FC / Conv layer; In BNNs, there are two types of linear combinations of input X and parameters W: fully connected layers (FC) and convolutional layers (Conv). The fully connected layer is expressed as WX + b, where addition is performed locally using the co-location property of secret sharing, and multiplication is performed on the fully connected layer using the re-sharing technique of RSS. Step 402: construct an activation function based on the hybrid protocol of RSS and FSS; The activation function in BNN, namely the Sign function, is constructed based on FSS. The calculation is completed in two stages: generation and evaluation. The FSS paradigm is constructed by converting the function into offset form and adding a random number mask. The FSS-based BA function is constructed in a form that supports RSS in input and output. A hybrid protocol of RSS and FSS is designed. The specific process is as follows: First, consider a three-party RSS scenario and represent the Sign function as an offset function containing input and output masks. The sum of r0 and r1 is used as the input value mask to satisfy r in = r0 + r1, the value of r2 is used as the output value mask to satisfy r out = r2; Use a trusted third party as a dealer to distribute random numbers r0, r1, r2 to the three parties. At this time, the three parties hold shares: P0{《x》0, <r in >0},P1{《x》1, <r in >1}, P2{《x》2,r out }; Next, the trusted third party divides the entire process into two stages, offline and online, based on the FSS paradigm to build and execute the above functions, as follows: The dealer first generates a random number r and constructs the corresponding offset function. Then, the dealer generates the shared key (k0, k1) through the FSS generation protocol Gen and distributes the keys k0 and k1 to the participants P0 and P1 respectively. In the online phase, P0 and P1 first reconstruct the masked input value x+r in , using it as input locally using the function key k i Execute the evaluation protocol Eval(x+r in ) is calculated, and the share of the result is recorded as <res> 0， <res>1. At this time, participant P2 locally calculates <res>2=-r out ; At this time, res= <res> 0+ <res> 1+ <res>2=Sign [rin,rout] (x)-r out =Sign(x+r in -r in )+r out -r out = Sign(x), each of the three parties holds an additive secret share of the input value X after passing it through the Sign function;< / res> < / res> < / res> < / res> < / res> < / res> Finally, each participant performs a round of re-sharing, P j Each of them will <res>x is sent to P (j+1)mod3 , so that each party locally holds a secret sharing in the form of RSS "o" j ={ <o> j , <o> (j+1)mod3 }, complete the design of the hybrid protocol of FSS and RSS;< / o> < / o> < / res> Step 403: construct a maximum pooling layer and a regularization layer; Among them, the maximum pooling layer outputs a binary result for each position in the image and finally sums it up. The regularization operation in the hidden layer is combined with the adjacent activation function to be uniformly expressed as an activation function operation; In step 5, the user divides the data query into three parts and sends them to three edge servers respectively. The three edge servers perform queries based on the constructed BNN model and return the reasoning results after the query to the user end respectively. The user locally uses the additive homomorphic property of secret sharing to add and reconstruct the plaintext reasoning results.

2. The privacy-preserving inference method for a BNN model under outsourced computing according to claim 1, characterized in that: The reasoning system is specifically: The model owner is a trusted entity that uses RSS technology to divide the BNN model into shares and then provides these shares to three edge servers that do not collude with each other; The three edge servers that do not collude with each other process the user's inference request according to a customized protocol and return their respective share of the query results to the client; The user uses lightweight additive secret sharing technology to divide the data query request into three shares, sends them to the edge server group, and reconstructs them into plaintext locally after receiving the three query results.

3. The privacy-preserving inference method for a BNN model under outsourced computing according to claim 1, characterized in that: The convolutional layer is converted into a matrix multiplication by applying the Toeplitz transform to the input X and the parameters W.

4. The privacy-preserving inference method for a BNN model under outsourced computing according to claim 1, characterized in that: The fully connected layer uses the RSS re-sharing technology to perform multiplication operations on the fully connected layer, specifically: Consider an arbitrary fully connected layer with input X, weight W, and bias b of the input / output layer stored in a secret-sharing manner between edge servers, and each edge server jointly calls the multiplication protocol to calculate the result; In this multiplication protocol, the three edge servers each hold the RSS share of the model parameter W and the user input X. i Compute locally <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 ; Afterwards, each edge server performs re-sharing, using the random number mask α pre-generated in the offline phase i encryption <y> i , the encrypted <y> i Sent to the neighboring party, each participant calculates the RSS share of the multiplication result "y" locally based on the received data i =《W·X》 i .< / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y> 5. The privacy-preserving inference method for a BNN model under outsourced computing according to claim 1, characterized in that: The maximum pooling layer obtains the maximum pooling function SecMaxPool based on local addition and SecBA, specifically: When considering the single-channel case, the maximum pooling is performed by Slide the window of size k×k up with a stride of s to calculate the output as in At this time, the SecMaxPool operation calls the secure addition and SecBA operations in parallel d′2·d′2 times; the addition protocol does not require any communication, and the SecBA protocol needs to reconstruct x+r in the online phase. in And re-sharing is performed, a total of two rounds of communication are required to complete the operation.

6. The privacy-preserving inference method for a BNN model under outsourced computing according to claim 1, characterized in that: The regularization operation in the hidden layer is combined with the adjacent activation function to be expressed as an activation function operation, specifically: In BNN, the regularization operation appears together with the BA operation except in the output layer, in the form of BA(BN(x)); for the BN operation, given the input share <x>And the parameters <γ> and <β> in the regularization formula γ·x+β, pre-calculate <β> / <γ> locally and share them secretly, converting the activation function and regularization into separate activation function operations: BA(BN( <x>))=BA(<γ>· <x>+<β>)=BA( <x> +<β> / <γ>), where BA(x)=Sign(x).< / x> < / x> < / x> < / x>

Images