Privacy-preserving neural network inference method based on multi-point evaluation

Abstract

The application discloses a privacy protection neural network inference method based on multi-point evaluation. K Segment k Polynomial, and a safe multiplication tree and a safe remainder tree are established, and then a remainder polynomial is safely evaluated. Since the polynomial power to be evaluated in the online stage is reduced, the number of self-multiplication items is reduced, thereby reducing the communication round number of overall polynomial evaluation, reducing the number of calls of the safe multiplication triplets in the secret sharing, and correspondingly reducing the offline pre-computation cost. In addition, the layered structure of the safe multiplication tree and the remainder tree supports parallel computation of multi-point input, and can fully utilize the parallel computation capacity of a modern multi-core processor or a GPU.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of secure multi-party computation multi-point evaluation, and particularly relates to a privacy protection neural network inference method based on multi-point evaluation. BACKGROUND

[0002] Privacy-preserving machine learning based on secure multi-party computation (MPC) can achieve privacy inference that protects both user input statements and service provider model weights. However, due to the dependence of machine learning models on MPC-unfriendly nonlinear functions, especially Softmax and GELU, privacy inference is inefficient.

[0003] Existing privacy inference frameworks, such as THE-X, Iron, MPCFormer, Privformer, MPCViT, BOLT, etc., all make specific protocol improvements to nonlinear functions. According to their optimization ideas, they can be divided into the following categories.

[0004] The first category is rough replacement. For example, in the work of MPCFormer, a simpler and easier-to-implement function is used to replace the nonlinear function to speed up inference, but this results in a significant performance drop, with a precision loss of more than 5%. To alleviate the loss of accuracy, they usually use knowledge distillation, which requires additional training on plaintext data, increasing the additional overhead in the preparation phase and may not be effective.

[0005] The second category is precise approximation. Nonlinear functions can be more accurately approximated by piecewise polynomials, iterative methods, or lookup tables. These methods introduce a lot of overhead: piecewise polynomials require many multiplications and MPC-unfriendly secure comparison protocols, iterative methods involve a large number of communication rounds, and table lookup is a computationally intensive protocol, especially for large tables or wide-bit-width inputs, which is relatively inefficient.

[0006] The third is precise calculation. Some works consider calculating the exact value of these functions in plaintext by decrypting intermediate values, or using expensive cryptographic tools such as garbled circuits. However, the method of decrypting intermediate values may lead to recovery attacks, and the use of expensive cryptographic tools will result in unacceptable computational overhead.

[0007] In the implementation of nonlinear functions (such as commonly used ReLU, Sigmoid, Tanh, GELU, Softmax and other complex nonlinear functions) based on secure multi-party computation (MPC) using polynomials, the primary difficulties are concentrated in the determination of the multiplication depth of polynomial evaluation, the interaction round, the approximation interval and the segmentation strategy. The higher the polynomial degree, the more the communication round interaction, and the network bandwidth and delay become the main factors affecting the bottleneck. Specifically, the increase in the number of intervals of the polynomial, although it can require a lower power polynomial, will introduce the increase in the call of the secure comparison protocol between intervals. On the contrary, the reduction of the interval requires a higher power polynomial to meet the fitting requirements. On the other hand, the existing work does not fully consider the optimization of the multi-point case of evaluating the same polynomial on multiple inputs, so that the secure polynomial evaluation process only has parallel computing, causing repeated computation of some steps.

[0008] In addition, there are the following secondary problems: domain switching and additional encoding costs caused by cross-protocol (conversion between arithmetic domain and Boolean domain); how to generate triplets in batches in the preprocessing stage; lack of adaptive polynomial approximation strategy for data or task type, and current work mostly lacks precision. SUMMARY

[0009] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and to provide a privacy protection neural network inference method based on multi-point evaluation.

[0010] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0011] In one aspect of the present application, a privacy protection neural network inference method based on multi-point evaluation is provided, comprising the following steps:

[0012] User P 0 randomly select N random values , for the input point tuple e = e 1,…, e j ,…, e N}, respectively calculate e j ]1= e j - r j send to the service party P 1, set e j ]0= r j as the share value held by the user P 0, satisfy ej ]0+[ e j ]1= e j mod 2 l , j ∈[ N ], N =2 α , α For natural numbers, Describing a finite ring, l 2 is a positive integer used to determine the exponent of the modulus. l Let the order of the finite ring be , mod For modulo operation, [•] represents the form of the shared value;

[0013] For a given nonlinear function, the user P 0 and service provider P 1. Conduct multi-point evaluations based on the shared value held, specifically as follows:

[0014] The nonlinear function is approximated as follows: K part k polynomial of degree F i,k = C i,k x k +…+ C i,1 x + C i,0 , i ∈[ K ] is the segment index. C i,k , … , C i,1 , C i,0 For public coefficients, k ≥2 and is a positive integer, x As the independent variable;

[0015] Constructing a safe multiplication tree: Defining a linear expression in one variable p j =( x - e j ) and by 2 α indivual p j Product of factors P i,j ;

[0016] Calling polynomial division Pi,j performing multi-point evaluation;

[0017] performing security evaluation on the remainder polynomial R i,j ;

[0018] sending the share P 1 obtained by performing multi-point evaluation on the service polynomial y ]1 to the user P 0, and the user P 0 locally calculates y =([ y ]0+[ y ]1) mod 2 l , and reconstructs the result y ; and y ]0 is the share obtained by performing multi-point evaluation on the service polynomial by the user P 0.

[0019] As a preferred technical solution, the calling polynomial division is performed on the product P i,j , and the multi-point evaluation is performed, specifically:

[0020] According to the polynomial division, we have: R i,j = F i,k modP i,j ;

[0021] According to the divide-and-conquer method in the polynomial multi-point evaluation, we have: input e j into F i,k , and the value F i,k ( e j ) is equal to the value of the corresponding remainder polynomial R i,j ( e j ).

[0022] As a preferred technical solution, the security evaluation on the remainder polynomial R i,j is performed, specifically:

[0023] The polynomial R i,j is expressed as: R i,j ( x )= C k-2 x k-2 +…+C 0 x 0 , C k-2 … C 0 represents the coefficient of the remainder polynomial;

[0024] user P 0 and service provider P 1. Call safe multiplication and substitute. x = e j calculate[ x m ] n , m ∈[0, k- 2] and is an integer; n ∈{0,1} is the participant index, when n =0 represents the user, when n =1 indicates a service provider;

[0025] Calculate the product of the coefficient term and the term multiplied by the plaintext-ciphertext multiplication method. C m x m ] n And locally accumulate to obtain the final shared value. R i,j ( e j )] n .

[0026] As a preferred technical solution, the nonlinear function is approximated as... K part k polynomial of degree F i,k In the steps, adjust the original polynomial F i,k Number of times k= 2 α +1, which means setting the degree of the remainder polynomial to 0. R i,j ( e j )= c , c It is a constant and is a secret shared entity, held separately by two parties, represented as [ c ] n .

[0027] As a preferred technical solution, the nonlinear function is approximated as... K part k polynomial of degree F i,k In the steps, adjust the original polynomialF i,k the number of times k= 2, and let α= 0, that is, the number of times of the secure multiplication tree is 1, P i,j =p j ( x - e j ).

[0028] As a preferred technical solution, the secure multiplication is calculated by using a Beaver multiplication triple, specifically:

[0029] Let the participants P n obtain the secret shares of the secret value u , v , z [ u ] n ,[ v ] n ,[ z ] n , wherein u , v , z are random values uniformly distributed on , and satisfy z = uv ;

[0030] Then the participant P n calculates e’ ] n [ a ] n -[ u ] n ,[ f ] n [ b ] n -[ v ] n , and sends it to other participants, and then the secret is reconstructed to obtain e’ = a - u , f = b - v ;

[0031] The participant P n calculates g ] n = e’ • f + f • u] n + e’ •[ v ] n +[ z ] n ;

[0032] correctness verification .

[0033] As a preferred technical solution, the nonlinear function includes an exponential function in Softmax, ReLU, Sigmoid, Tanh, and GELU.

[0034] As a preferred technical solution, the privacy protection neural network inference method based on multi-point evaluation is applied to a semi-honest model.

[0035] Another aspect of the application also provides a privacy protection neural network inference system based on multi-point evaluation, which is applied to the privacy protection neural network inference method based on multi-point evaluation described above, and includes a user P 0, a service party P 1, a parameter distribution module, a nonlinear function approximation construction module, a secure multiplication tree construction module, a multi-point evaluation module, and a secret reconstruction module.

[0036] The parameter distribution module is configured to cause the user P 0 to randomly select N a random value , and calculate e [ e 1,…, e j ,…, e N ] for an input point tuple e j . e j The parameter distribution module is configured to cause the user r j to send P 1 to the service party e j . r j The parameter distribution module is configured to cause the user P 0 to hold a share value, which satisfies e j . e j The parameter distribution module is configured to cause the user e j to send mod 2 l to the service party

[0037] The nonlinear function approximation construction module is configured to approximate the nonlinear function asK Segment k Sub-polynomial F i,k = C i,k x k +…+ C i,1 x + C i,0 ;

[0038] The secure multiplication tree construction module is used to construct a secure multiplication tree: defining a monomial p j =( x - x j ) and a product composed of 2 α factors p j ; P i,j ;

[0039] The multi-point evaluation module is used to perform multi-point evaluation by calling polynomial division P i,j ; and performing secure evaluation of the remainder polynomial R i,j ;

[0040] The secret reconstruction module is used to calculate y =([ y ]0+[ y ]1) mod 2 l , and reconstruct the result y .

[0041] Another aspect of the present application also provides a storage medium storing a program, which, when executed by a processor, implements the above-mentioned privacy protection neural network inference method based on multi-point evaluation.

[0042] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0043] (1) The present application mainly aims at the privacy protection nonlinear function polynomial approximation evaluation process based on secure multi-party computation, proposes a new evaluation angle, proposes a scene for multi-point input, establishes a secure multiplication tree and a secure remainder tree, and then securely evaluates the remainder polynomial, thereby reducing the communication round number and the number of secure multiplications of the overall polynomial evaluation.

[0044] (2) The hierarchical structure of the secure multiplication tree and the remainder tree of the application supports parallel computation of multiple input points. For example, each secure modular division only processes the calculation of one input point, and thus is independent of each other and can be calculated in parallel. Similarly, the local calculation of each remainder polynomial can also be calculated in parallel. This architecture can fully utilize the parallel computing power of modern multi-core processors or GPUs.

[0045] (3) Since the polynomial power to be evaluated in the online stage is reduced, the number of self-multiplication items is reduced, the number of secure multiplications is reduced, the number of calls of the secure multiplication triple in the secret sharing is reduced, and the overhead of offline pre-computation is correspondingly reduced. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 is a structural schematic diagram of a privacy protection polynomial multi-point evaluation secure multiplication tree of an embodiment of the application. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0048] Embodiment 1:

[0049] The embodiment provides a privacy protection neural network inference method based on multi-point evaluation, which is a secure two-party privacy protection multi-point evaluation protocol under the condition of given polynomial approximation expression of a nonlinear function.

[0050] The present scheme includes two participants, namely a user P 0 and a service party P 1. The secure two-party computation technology used in the present scheme is additive secret sharing, including arithmetic sharing and Boolean sharing, and the basic idea is to divide a secret value into two shares in a finite ring or Boolean domain and perform privacy protection function calculation.

[0051] The scheme specifically includes the following steps:

[0052] S1, secret distribution stage:

[0053] The user P 0 randomly selects N random values , and for the input point tuple e { e 1,…, ej ,…, e N}, calculate respectively [ e j ]1= e j - r j Send to the service provider P 1. [ e j ]0= r j As a user P The shared value held by 0 satisfies [ e j ]0+[ e j ]1= e j mod 2 l , j ∈[ N ], N =2 α , α For natural numbers, It represents a finite ring (or an integer ring). l 2 is a positive integer used to determine the exponent of the modulus. l Let be the order (i.e., modulus) of the ring of integers. mod For modulo operation, [•] represents the form of the shared value.

[0054] S2, Function Calculation Stage:

[0055] For a given nonlinear function, the user P 0 and service provider P 1. Conduct multi-point evaluations based on the shared value held, specifically as follows:

[0056] S2.1, Approximate the nonlinear function as follows: K part k polynomial of degree F i,k = C i,k x k +…+ C i,1 x + C i,0 , i ∈[ K ] is the segment index. C i,k , … , C i,1 , Ci,0 For public coefficients, k ≥2 and is a positive integer, x As the independent variable;

[0057] S2.2, construct as follows Figure 1 The safe multiplication tree shown: Defines a linear expression in one variable. p j =( x - e j ) and by 2 α indivual p j Product of factors P i,j ;

[0058] Specifically, such as Figure 1 As shown, for j ∈[ N ], N =2 α The last layer indicates when taking α =0,2 α When =1, P i,j = p j =( x - e j ), each product P i,j The number of occurrences is 1, which includes ( x - e 1) ( x - e 2), ( x - e 3), ( x - e 4), ..., ( x - e N-1 ), ( x - e N The second to last level indicates when taking... α =1,2 α When =2, each product P i,j The number of occurrences is 2, which includes ( x - e 1)( x - e 2), ( x - e 3)( x - e 4), ..., ( x - eN-1 ()( x - e N ); and so on, the second layer from top to bottom represents when 2 is taken. α-1 At that time, each product P i,j The number of times is 2 α-1 This includes (times, that is, including) x - e 1)…( x - e N / 2-1 ), ( x - e N / 2 )…( x - e N The second layer from the top indicates when 2 is taken. α At that time, each product P i,j The number of times is 2 α This includes (times, that is, including) x - e 1)…( x - e N );

[0059] S2.3, Calling polynomial division P i,j The multi-point assessment will be conducted, specifically as follows:

[0060] S2.3.1, According to polynomial division (modulo division): R i,j = F i,k modP i,j ;

[0061] S2.3.2. Based on the divide-and-conquer method in multi-point evaluation, we can conclude that: [The input...] e j Substitution F i,k value F i,k ( e j ) equals the corresponding remainder polynomial R i,j ( e j The value of );

[0062] S2.4, Perform the remainder polynomial R i,j The security assessment is as follows:

[0063] S2.4.1, will R i,j Represented as: R i,j ( x )= C k-2 x k-2 +…+ C 0 x 0 , C k-2 … C 0 represents the coefficient of the remainder polynomial;

[0064] S2.4.2, User P 0 and service provider P 1. Call safe multiplication and substitute. x = e j calculate[ x m ] n , m ∈[0, k- 2] and is an integer; n ∈{0,1} is the participant index, when n =0 represents the user, when n =1 indicates a service provider;

[0065] S2.4.3 Calculate the product share of the coefficient term and the term multiplied by plaintext-ciphertext multiplication. C m x m ] n And locally accumulate to obtain the final shared value. R i,j ( e j )] n .

[0066] S3, Secret Reconstruction Phase:

[0067] service provider P 1. Share obtained through multi-point evaluation [ y ]1 (i.e., the [ obtained in step S2.4.3]) R i,j ( e j )]1) Send to user P 0, users P 0 Local computation y =([ y ]0+[ y ]1) mod 2l The result of reconstruction y ;[ y ]0 for users P 0. The share obtained from multi-point evaluation (i.e., the share obtained in step S2.4.3) R i,j ( e j )]0).

[0068] As a preferred technical solution, in step S2.4, the safe multiplication is calculated using Beaver multiplication triples, specifically as follows:

[0069] Set up participating parties P n Obtain secret value u , v , z The secret share is [ u ] n ,[ v ] n ,[ z ] n ,in u , v , z Is Uniformly distributed random values, and satisfying z = uv ;

[0070] Then the participants P n calculate[ e’ ] n =[ a ] n -[ u ] n , [ f ] n =[ b ] n -[ v ] n It was then sent to other participants and subsequently secretly reconstructed. e’ = a - u , f = b - v ;

[0071] Participants P n calculate[ g ] n = e’ • f + f •[ u ]n + e’ •[ v ] n +[ z ] n ;

[0072] Correctness verification yields .

[0073] As a preferred technical solution, this embodiment is implemented under a semi-honest model, which assumes that all participants will abide by the protocol rules, but they may try to learn the private data of other participants from the information collected.

[0074] As a preferred technical solution, the nonlinear functions applicable to the function calculation stage of this embodiment include the exponential function in Softmax, ReLU, Sigmoid, Tanh, and GELU.

[0075] Example 2:

[0076] Under the secret sharing implementation, the performance bottleneck of this scheme lies in the communication overhead. Therefore, with fixed bandwidth and latency, it is necessary to minimize the number of communication rounds and the amount of communication. The communication overhead comes from the linear equations in the secure multiplication tree. p j The product of the polynomials and the modular division of the polynomials in the safe remainder tree. If the original polynomial is constructed reasonably... F i,k The hierarchy of the multiplication tree can control the remainder polynomial. R i,j It is a polynomial of degree 0. For example, in a commonly used intermediate layer setup in a neural network, with a 128-dimensional input, if the multiplication tree has 4 layers, the multiplication tree polynomial has an exponent of 8. In this case, if the original polynomial is adjusted according to the polynomial approximation process... F i,k Taking a 9th degree polynomial, the remainder polynomial is... R i,j It can be constructed as a polynomial of degree 0, thus ensuring safe modulo division of the output. R i,j It can be directly used as the shared result of a multi-point evaluation by both parties, as follows:

[0077] In step S2.1 of the privacy-preserving neural network inference method based on multi-point evaluation provided in Example 1, the original polynomial is adjusted. F i,k Number of times k= 2 α +1, that is, to construct the degree of the remainder polynomial as 0, then the remainder polynomial in step S2.4 R i,j ( ej )= c ; c It is a constant, needs to be calculated using secure modular division, and is in the form of a secret sharing, held by both parties respectively, represented as [ c ] n .

[0078] The remaining steps in this embodiment are the same as in Embodiment 1.

[0079] Example 3:

[0080] Building upon the framework of Examples 1 and 2, this example further reduces the number of safe polynomial division operations called during safe modular division by constructing a piecewise function that uses only quadratic approximation, thus simplifying the calculation. The details are as follows:

[0081] In step S2.1 of the privacy-preserving neural network inference method based on multi-point evaluation provided in Example 1, the original polynomial is adjusted. F i,k Number of times k= 2, and let α= 0, meaning the safe multiplication tree has a count of 1. P i,j =p j =( x - e j ).

[0082] The remaining steps in this embodiment are the same as in embodiments 1 and 2.

[0083] For example, in step S2, when the given complex nonlinear function is GELU, a quadratic multi-segment approximation is designed. With 6 segments, the maximum absolute error is controlled within 1.2 × 10⁻⁶. -2 The mean absolute error is 1.7 × 10⁻⁶. -3 The segmented breakpoints are at -5, -3, -1, 1, 3, and the polynomial takes the value 0 in the interval (-∞, -5] and the polynomial takes the value 0 in the interval (3, ∞). x It can maximize the simplification of the quadratic expression approximation based on the function trend.

[0084] Example 4:

[0085] This embodiment compares the invention with existing privacy-preserving polynomial evaluation methods based on secure multi-party computation to verify the advantages and beneficial effects of the invention.

[0086] The experiment was conducted on an Ubuntu 20.04.2 LTS environment with Python 3.12.4, conda 24.5.0, bazel 6.5.0, and gcc 11.2.0. For the GELU function, it approximates a 3-segment piecewise polynomial with a highest power of 6 and a ciphertext MSE of 5.85e-03. For the Softmax function, it approximates a 2-segment piecewise polynomial with a highest power of 6 and a ciphertext MSE of 1.61e-06. The experiment tested 2... 12 ,2 14 ,2 16 ,2 18 ,2 19 The privacy protection assessment of the two functions under dimensional input evaluates the communication volume and time. Compared with BumbleBee, one of the best protocols, GELU has a 17% reduction in communication volume and a 12% reduction in computation time, while Softmax has a 10% reduction in communication volume and a 5% reduction in computation time.

[0087] Example 5:

[0088] In this embodiment, a privacy-preserving neural network inference system based on multi-point evaluation is provided. This system includes a user... P 0. Service Provider P 1. Parameter distribution module, nonlinear function approximation construction module, safe multiplication tree construction module, multi-point evaluation module, and secret reconstruction module;

[0089] The parameter distribution module is used to allow users... P 0 Random selection N random values For the input point tuple e ={ e 1,…, e j ,…, e N}, calculate respectively [ e j ]1= e j - r j Send to the service provider P 1. [ e j ]0= r j As a user P The shared value held by 0 satisfies [ e j ]0+[ e j ]1= e j mod 2 l ;

[0090] The nonlinear function approximation construction module is used to approximate the nonlinear function as follows: K part k polynomial of degree F i,k = C i,k x k +…+ C i,1 x + C i,0 ;

[0091] The secure multiplication tree construction module is used to construct a secure multiplication tree: defining a linear expression in one variable. p j =( x - x j ) and by 2 α indivual p j Product of factors P i,j ;

[0092] The multi-point evaluation module is used to call polynomial division to... P i,j Perform multi-point evaluation; conduct remainder polynomial calculations R i,j Security assessment;

[0093] The secret reconstruction module is used for calculation. y =([ y ]0+[ y ]1) mod 2 l The result of reconstruction y .

[0094] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure can be divided into different functional modules to complete all or part of the functions described above. This system is a privacy-preserving neural network inference method based on multi-point evaluation applied to the above embodiments.

[0095] Example 6:

[0096] In this embodiment, a storage medium is provided, storing a program. When the program is executed by a processor, it implements a privacy-preserving neural network inference method based on multi-point evaluation as described in the above embodiment, specifically:

[0097] S1, User P 0 Random selection N random values For the input point tuple e ={ e 1,…, e j ,…, e N}, calculate respectively [ e j ]1= e j - r j Send to the service provider P 1. [ e j ]0= r j As a user P The shared value held by 0 satisfies [ e j ]0+[ e j ]1= e j mod 2 l , j ∈[ N ], N =2 α , α For natural numbers, Describing a finite ring, l 2 is a positive integer used to determine the exponent of the modulus. l Let the order of the finite ring be , mod For modulo operation, [•] represents the form of the shared value;

[0098] S2. For a given nonlinear function, the user P 0 and service provider P 1. Conduct multi-point evaluations based on the shared value held, specifically as follows:

[0099] S2.1, Approximate the nonlinear function as follows: K part k polynomial of degree F i,k = C i,k x k +…+ C i,1 x + C i,0 , i ∈[ K ] is the segment index. Ci,k , … , C i,1 , C i,0 For public coefficients, k ≥2 and is a positive integer, x As the independent variable;

[0100] S2.2 Constructing a safe multiplication tree: Defining a linear expression in one variable p j =( x - e j ) and by 2 α indivual p j Product of factors P i,j ;

[0101] S2.3, Calling polynomial division P i,j Perform multi-point assessment;

[0102] S2.4, Perform the remainder polynomial R i,j Security assessment;

[0103] S3, Service Provider P 1. Share obtained through multi-point evaluation [ y ]1 Sent to user P 0, users P 0 Local computation y =([ y ]0+[ y ]1) mod 2 l The result of reconstruction y ;[ y ]0 for users P 0 is the share obtained through multi-point evaluation.

[0104] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0105] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A privacy-preserving neural network inference method based on multi-point evaluation, characterized in that, Includes the following steps: user P 0 Random selection N random values For the input point tuple e ={ e 1,…, e j ,…, e N }, calculate respectively [ e j ]1= e j - r j Send to the service provider P 1. [ e j ]0= r j As a user P The shared value held by 0 satisfies [ e j ]0+[ e j ]1= e j mod 2 l , j ∈[ N ], N =2 α , α For natural numbers, Describing a finite ring, l 2 is a positive integer used to determine the exponent of the modulus. l Let the order of the finite ring be , mod For modulo operation, [•] represents the form of the shared value; For a given nonlinear function, the user P 0 and service provider P 1. Conduct multi-point evaluations based on the shared value held, specifically as follows: The nonlinear function is approximated as follows: K part k polynomial of degree F i,k = C i,k x k +…+ C i,1 x + C i,0 , i ∈[ K ] is the segment index. C i,k , … , C i,1 , C i,0 For public disclosure coefficients, k ≥2 and is a positive integer, x As the independent variable; Constructing a safe multiplication tree: Defining a linear expression in one variable p j =( x - e j ) and by 2 α indivual p j Product of factors P i,j ; Calling polynomial division P i,j Perform multi-point assessment; Perform remainder polynomial R i,j Security assessment; service provider P 1. Share obtained through multi-point evaluation [ y ]1 Sent to user P 0, users P 0 Local computation y =([ y ]0+[ y ]1) mod 2 l The result of reconstruction y ;[ y ]0 for users P 0 is the share obtained through multi-point evaluation.

2. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 1, characterized in that, The call to polynomial division for the product P i,j The multi-point assessment will be conducted, specifically as follows: According to polynomial division: R i,j = F i,k modP i,j ; Based on the divide-and-conquer method in multi-point evaluation of polynomials, we obtain: Input e j Substitution F i,k value F i,k ( e j ) equals the corresponding remainder polynomial R i,j ( e j The value of ).

3. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 2, characterized in that, The remaining term polynomial R i,j The security assessment is as follows: Will R i,j Represented as: R i,j ( x )= C k-2 x k-2 +…+ C 0 x 0 , C k-2 … C 0 represents the coefficient of the remainder polynomial; user P 0 and service provider P 1. Call safe multiplication and substitute. x = e j calculate[ x m ] n , m ∈[0, k- 2] and is an integer; n ∈{0,1} is the participant index, when n =0 represents the user, when n =1 indicates a service provider; Calculate the product of the coefficient term and the term multiplied by the plaintext-ciphertext multiplication method. C m x m ] n And locally accumulate to obtain the final shared value. R i,j ( e j )] n .

4. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 3, characterized in that, When the nonlinear function is approximated as K part k polynomial of degree F i,k In the steps, adjust the original polynomial F i,k Number of times k= 2 α +1, which means setting the degree of the remainder polynomial to 0. R i,j ( e j )= c , c It is a constant and is a secret shared entity, held separately by two parties, represented as [ c ] n .

5. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 4, characterized in that, When the nonlinear function is approximated as K part k polynomial of degree F i,k In the steps, adjust the original polynomial F i,k Number of times k= 2, and let α= 0, meaning the safe multiplication tree has a count of 1. P i,j =p j =( x - e j ).

6. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 3, characterized in that, The safe multiplication method is calculated using Beaver multiplication triples, specifically as follows: Set up participating parties P n Obtain secret value u , v , z The secret share is [ u ] n ,[ v ] n ,[ z ] n ,in u , v , z Is A random value that is uniformly distributed above and satisfies z = UV ; Then the participants P n calculate[ e’ ] n =[ a ] n -[ u ] n , [ f ] n =[ b ] n -[ v ] n It was then sent to other participants and subsequently secretly reconstructed. e’ = a - u , f = b - v ; Participants P n calculate[ g ] n = e’ • f + f •[ u ] n + e’ •[ v ] n +[ z ] n ; Correctness verification obtained .

7. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 1, characterized in that, The nonlinear functions include the exponential function in Softmax, ReLU, Sigmoid, Tanh, and GELU.

8. The privacy-preserving neural network inference method based on multi-point evaluation according to claim 1, characterized in that, Applied to the semi-honest model.

Images