A method and apparatus for code privacy protection inference based on model segmentation and random activation

Abstract

A code privacy-preserving inference method and apparatus based on model segmentation and random activation, wherein the method includes the following steps: Step 1, segmenting the original code audit model into an original client and a server; Step 2, expanding the feedforward neural network of the Transformer block inside the original client to generate a pseudo client; Step 3, establishing a key authentication mechanism on the pseudo client; if key authentication is successful, the expanded neuron part automatically does not participate in the processing of input data, and the pseudo client automatically transforms into a client; if key authentication fails, the pseudo client randomly activates the expanded neuron part according to a random activation strategy; Step 4, establishing an encrypted channel connection mechanism between the pseudo client and the server. This invention can greatly defend against member inference attacks and inversion reconstruction attacks, while not affecting the model performance during normal user use.

Description

Technical Field

[0001] This invention relates to the fields of computer artificial intelligence and large model security technology, and in particular to a code privacy protection inference method and apparatus based on model segmentation and random activation. Background Technology

[0002] With the rapid development of artificial intelligence technology, large models have demonstrated powerful capabilities in many fields. Currently, code auditing is one of the promising applications of large models. Meanwhile, in the privatization of large models, due to limitations in local computing power, a model is being researched and used that involves splitting and distributing the model to a client for user use, and then uploading it to a server to complete the inference and execution of the large model. However, when using a client with split large models for code auditing, it is inevitable that users will need to provide the corresponding code for training or auditing the large model, inadvertently internalizing sensitive information. Some of this code contains sensitive core data, and during the interaction between the client and server, there is a possibility of attacks by privacy thieves due to the untrusted domain, such as shadow model construction, input / output guessing attacks, member inference attacks, and model reverse engineering.

[0003] Existing code privacy protection inference methods split the model involved in code auditing into client and server parts through model segmentation. Both parts participate in code inference, similar to big-small model collaboration technology. The client first performs inference and auditing on the code, and then transmits the results to the server. The server continues inference and auditing based on the client's inference, completing the entire code auditing process. Model segmentation can protect the privacy of client code to a certain extent because the data transmitted to the server after client model inference can be understood as intermediate data in the entire model inference process. The input of the entire model—the user code—has already undergone a round of "obfuscation," thus providing a certain degree of privacy protection.

[0004] The drawback of existing technology is that, even with the above operations alone, the intermediate data after client-side inference is still susceptible to member inference attacks and inversion attacks. Summary of the Invention

[0005] In view of the above-mentioned deficiencies of the prior art, the present invention provides a code privacy protection inference method and apparatus based on model segmentation and random activation, which greatly defends against member inference attacks and inversion reconstruction attacks, while not affecting the model performance when used by normal users.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] Firstly, a code privacy-preserving inference method based on model segmentation and random activation includes the following steps:

[0008] Step 1: Divide the original code audit model into the original client and server;

[0009] Step 2: Expand the feedforward neural network of the Transformer block inside the original client to generate a pseudo client;

[0010] Step 3: Establish a key authentication mechanism on the pseudo-client; if key authentication is successful, the neuron extension part automatically stops participating in the processing of input data, and the pseudo-client automatically transforms into a client; if key authentication fails, the pseudo-client randomly activates the neuron extension part according to a random activation strategy.

[0011] Step 4: Establish an encrypted channel connection mechanism between the pseudo client and the server.

[0012] Preferably, in step 1, the original code audit model is fine-tuned using a code fine-tuning dataset before segmentation.

[0013] Preferably, in step 1, the code auditing model is segmented according to a predetermined strategy based on the total number of Transformer layers in the code auditing model; wherein, the first N layers of the original code auditing model are encapsulated as the original client, and the last M layers are encapsulated as the server.

[0014] Preferably, step 1 also includes testing whether the segmented original code audit model can reason normally.

[0015] Preferably, step 2 includes:

[0016] Obtain the original intermediate_size parameter value and the original hidden_states parameter value of the Transformer block in the original client model architecture;

[0017] Create a new FFN module; the architecture of the new FFN module is the same as that of the original client FFN module, but its internal dimension is the new intermediate_size parameter value;

[0018] In the new FFN module, the original parameters, except for the extended dimensions, are the same as those of the original client; the pseudo client F has the same number of Transformer blocks as the original client, and each Transformer block uses the new FFN module.

[0019] Preferably, the new intermediate_size parameter is a multiple of the original hidden_states parameter value and is at least 1.5 times the original intermediate_size parameter value.

[0020] Preferably, in step 3, the random activation strategy includes: Kaiming uniform initialization, high variance Gaussian initialization, Xavier uniform initialization, and large-range uniform initialization.

[0021] As a preferred embodiment, in step 4, after the real user authenticates with the key, he / she obtains the structure and parameter values ​​of the original client and then calls the original client for use; the original code data uploaded by the user is processed by the client in the local secure environment and becomes the intermediate data transmitted by the middle layer of the large model; the intermediate data is encrypted and sent to the server running in the trusted domain through the untrusted domain.

[0022] Preferably, in the encrypted channel connection mechanism, the client and the server each have a pair of public and private keys. The server publicly sends its public key to the client. The client uses the server's public key to generate a temporary session key and encrypts the session key. The client sends the session key to the server. After receiving the session key, the server decrypts the session key using its own unique private key.

[0023] Secondly, a code privacy-preserving inference device based on model segmentation and random activation includes:

[0024] The module splitting is used to divide the original code audit model into the original client and server sides;

[0025] The module constructs neurons to extend the original client to create a pseudo client;

[0026] The authentication module verifies whether a user is a real user or a privacy-stealing attacker by authenticating with a preset key, thereby determining whether the defense module is effective, that is, whether the user is using a client or a fake client at this time.

[0027] The defense module is used by fake clients to activate extended neurons through random neuron activation operations, which confuses the intermediate data obtained by attackers through the processing module and undermines the effectiveness of the corresponding attack model application.

[0028] The processing module is used to process the raw input through the client and extract the surface features of the processed data to obtain the intermediate data of the corresponding data.

[0029] The push module is used to establish an encrypted channel and transmit the encrypted data results obtained by the processing module to the computing platform running on the server, and then decrypt the data and pass it to the subsequent model to continue to complete the inference.

[0030] The generation module includes a server-side generation module and a client-side generation module. The server-side generation module continues to reason from the decrypted intermediate data to obtain the corresponding result, and then transmits it to the client-side generation module via the push module for encryption. After decryption, the corresponding reasoning result is obtained.

[0031] The code privacy protection inference device based on model segmentation and random activation is used to implement the code privacy protection inference method and steps based on model segmentation and random activation as described in the first aspect.

[0032] Compared with the prior art, the beneficial effects of the present invention are reflected in:

[0033] 1. This invention breaks down a large model, encapsulating only a small portion of the large model as a client deployed locally by the user, while the remaining portion requiring significant computing resources can be deployed as a server in a trusted domain computing platform. This solves the problem of insufficient local computing resources for users and also protects user privacy data through a series of encryption measures.

[0034] 2. This invention employs a random neuron activation method to construct a pseudo-client and uses key authentication for identity verification to determine whether a client or a pseudo-client is distributed. The pseudo-client makes it difficult for privacy-stealing attackers to construct a correct and usable attack model, thus greatly defending against member inference attacks and inversion reconstruction attacks, while not affecting the model performance when used by normal users. Attached Figure Description

[0035] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention;

[0036] Figure 2 This is a schematic diagram of the model segmentation operation in Embodiment 1 of the present invention;

[0037] Figure 3 This is a schematic diagram of the neuron expansion process in Embodiment 1 of the present invention;

[0038] Figure 4 This is a schematic diagram of random neuron activation in Embodiment 1 of the present invention;

[0039] Figure 5 This is a diagram showing the attack model prediction results of Embodiment 1 of the present invention;

[0040] Figure 6 This is a schematic diagram of the device in Embodiment 2 of the present invention. Detailed Implementation

[0041] To make the technical means, inventive features, objectives, and effects of the invention readily understandable, the invention is further described below with reference to specific illustrations. However, the invention is not limited to the embodiments described below.

[0042] It should be noted that the structures, proportions, sizes, etc., illustrated in the accompanying drawings of this specification are only used to complement the content disclosed in the specification for those skilled in the art to understand and read, and are not intended to limit the conditions under which the present invention can be implemented. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in the proportions, or adjustments to the size, without affecting the effects and objectives that the present invention can produce, should still fall within the scope of the technical content disclosed in the present invention.

[0043] Example 1:

[0044] like Figure 1 The code privacy-preserving inference method based on model segmentation and random activation, as shown, includes the following steps:

[0045] Step 1: Divide the original code audit model into client C and server S;

[0046] like Figure 2 As shown, the original code auditing model is fine-tuned using a code fine-tuning dataset. The first N and last M Transformer blocks of the complete model, fine-tuned using the code auditing domain dataset, are extracted. For example, assuming the large model consists of Num stacked Transformer blocks, the word embedding layer and the first N Transformer blocks are extracted as the initial client network structure, and the last M Transformer blocks and the output are extracted as the initial server network structure. Obviously, Num = N + M. It is worth noting that the split model blocks are still treated as a whole in inference; the split should not change the key structure and integrity of the original large model, nor should it change the output of the large model. Experiments have verified that the model splitting operation does not cause an irreversible decrease in model performance.

[0047] Step 2: Expand the neurons in the feedforward neural network of the Transformer block inside the client to generate a pseudo client;

[0048] Internally, each Transformer block can be summarized into the following modules: multi-head attention module, layer normalization module, feedforward neural network (FFN) module, and residual connection module. The FFN module typically consists of two or three linear (fully connected) layers, interspersed with non-linear activation functions. Its most common structure is: input layer, hidden layer, and output layer. The number of neurons within a Transformer block is usually referred to as the hidden layer dimension of the FFN module. In large model architectures, `intermediate_size` is a very important parameter, representing the hidden layer dimension of the FFN in the Transformer block, determining the width and capacity of the feedforward network when processing information. The calculation of a typical FFN layer can be simplified as follows:

[0049]

[0050] Where x is the input, W1 is the weight matrix from hidden_size to intermediate_size, and b1 is the corresponding bias term. W2 is the weight matrix from intermediate_size to hidden_size, and b2 is its bias term. Here, max(0,*) represents the ReLU activation function. In modern models, activation functions such as GeLU or SiLU are also commonly used.

[0051] Modifying the `intermediate_size` parameter in the FFN module will change W1 and W2, thus altering the hidden layer dimensions of the FFN module and ultimately changing the model's capacity and non-linear expressive power. The random neuron activation operation of this invention is a further extension based on modifying and adjusting the hidden layer dimensions of the FFN module.

[0052] The client C is constructed as a pseudo-client F, and the random neuron activation operation of the pseudo-client F is mainly focused on the hidden layers of the feedforward network (FFN) of the N-layer Transformer block in the client C.

[0053] like Figure 3 As shown, step 2 includes:

[0054] 2.1 Obtain the original intermediate_size parameter value and the original hidden_states parameter value of the Transformer block in the client C model architecture.

[0055] 2.2 Create a completely new FFN module for each layer of the original code auditing model. This new module has the same architecture as the original client C, but its internal dimension has been set to a completely new `intermediate_size`. This `intermediate_size` is generally set to a multiple of the `hidden_states` parameter value and will be 1.5 times or more than the original `intermediate_size`. Adjustments can be made as needed during implementation. At this point, the weights of the new module are undefined.

[0056] 2.3 For the newly created FFN module, most of its parameters (excluding the original parts of the extended dimensions) are copied precisely from the original client C to complete the initial construction of the pseudo client F. It is important to note that since the original client C has N layers of Transformer blocks, the pseudo client F also has the same number of Transformer blocks. Each Transformer block's FFN module will use the newly created FFN module, making the pseudo client F somewhat similar to the original client C, thus completing the process of establishing the pseudo client F.

[0057] Step 3: Establish a key authentication mechanism on the pseudo-client; if key authentication is successful, the neuron extension part will automatically stop participating in the processing of input data, and the pseudo-client will automatically become the client; if key authentication fails, the pseudo-client will randomly activate the neuron extension part according to the random activation strategy.

[0058] After parameter copying is complete, the newly added neurons in the FFN module of the pseudo-client F (i.e., the uncopyable parameters) remain random. A key authentication mechanism is added to the pseudo-client F. When using the pseudo-client F, if key authentication fails, the pseudo-client F will randomly activate these newly added neurons, i.e., as shown below. Figure 4 As shown, different initialization methods are used to activate neurons according to a predetermined strategy (which can be adjusted at any time during implementation to maintain randomness). The available activation strategies are as follows: Kaiming Uniform Initialization, Normal Distribution with Large Standard Deviation, Xavier Uniform Initialization, and Large Range Uniform Initialization.

[0059] (Uniform Distribution with Large Range).

[0060] The core operation of this invention is the aforementioned random neuron activation operation. The randomly changeable intermediate_size and the random combination of activation methods that apply different initialization methods to newly added neurons ensure randomness. This makes the intermediate data obtained through the pseudo-client F extremely obfuscated and difficult to detect. On this basis, it makes it difficult for privacy thieves to construct models for attacks, thereby achieving privacy protection.

[0061] Step 4: Establish an encrypted channel connection mechanism between the pseudo client and the server.

[0062] This method introduces the concept of a pseudo-client based on model segmentation. The pseudo-client has a similar model structure to the client, but differs significantly in the number of neurons. The pseudo-client is an extension of the client's neurons, meaning it has more neurons than the client. The pseudo-client operates in two states: one where the extended neurons participate in computation through random activation, and another where they do not participate. In the former state, the randomly activated neurons apply greater obfuscation to the intermediate data after one round of "fuzzing." In the latter state, the pseudo-client effectively becomes the original client and can be used normally. The pseudo-client protects user code data privacy through these operations. This can be understood as the client's true model structure and parameter values ​​being hidden within the pseudo-client's broader model structure and parameters.

[0063] Real users, through key authentication, can obtain the exact structure and parameter values ​​of the genuine client, thereby accessing and using the real client—corresponding to the second state of the pseudo-client (i.e., the client itself). The raw code data uploaded by the user, after being processed by the client in the local secure environment, becomes intermediate data transmitted through the middle layer of the large model. Subsequently, this intermediate data is encrypted and sent to the server running in the trusted domain via an untrusted domain.

[0064] In interactions with the server, the client establishes an encrypted channel. Communication begins with the exchange of public keys: both the client and server possess a public and private key pair, with the server publicly sharing its public key with the client. This public key itself is uncrackable, so interception is not a problem. Upon receiving this public key, the client generates a temporary session key. To ensure its security during transmission, the client encrypts it using the server's public key and sends the encrypted key to the server. The server, upon receiving the encrypted key, decrypts it using its unique private key, securely obtaining the session key. At this point, the client and server share the same session key, establishing a secure and efficient encrypted channel. The client can then use this key to encrypt any intermediate data and send it over an untrusted network. Upon receiving the encrypted data, the server simply decrypts it using the same session key and passes the decrypted data to the Transformer layer for further inference, ensuring the confidentiality and integrity of the entire data transmission and processing process.

[0065] When a privacy thief fails key authentication, the fake client enters the first state. The fake client applies random neuron activation to the extended part. These randomly activated neurons greatly obfuscate the intermediate data they obtain during computation, making it difficult for the privacy thief to guess the cracked model structure and construct a shadow model. Furthermore, if the privacy thief directly uses the intermediate data obtained from the fake client to train the attack model, thereby achieving member inference attacks or inversion attacks, the training of such models relies on intermediate data, which is inherently chaotic. This intermediate data will significantly undermine the actual usability of the attack model. Even if the privacy thief can intercept the intermediate data sent by the user client in the untrusted domain, the invalidity of the attack model prevents the attacker from stealing the user's private code information.

[0066] The flowchart of the large model privacy-preserving inference method based on model segmentation for code auditing proposed in this invention is as follows: Figure 1 As shown, the key to this invention lies in how to segment the model to form client C and server S, and how to construct pseudo client F from client C and subsequently use random neuron activation operations for privacy protection.

[0067] This invention designs a series of experiments to verify the simulated privacy theft process and validate the effectiveness of the pseudo-client F in protecting privacy. The experiments use Qwen2.5-coder-7B-Instruct as the model and the Mostly Basic Python Problems (MBPP) dataset as the dataset used in the experiments. The experimental procedure is as follows:

[0068] S1. Divide the MBPP dataset into two parts. One part, containing 500 data points, will be used for model fine-tuning. Let this part be denoted as Data. in This refers to the member dataset. Another part, consisting of 374 data entries, does not participate in fine-tuning and is denoted as Data. out This refers to a non-member dataset. Simultaneously, fine-tuning of the model is performed.

[0069] S2. Construct the client C, server S, and pseudo-client F according to the method proposed in this invention. The Transformer blocks of client C and pseudo-client F have 5 layers. Random neuron activation expands the intermediate_size of pseudo-client F to twice its original size. The first three layers of newly added neurons use large-scale uniform initialization, while the last two layers use Xavier uniform initialization.

[0070] S3, respectively transfer Data in With Data out The data is processed by a pseudo-client, and the resulting series of intermediate data are denoted as datasets D1 and D2. These datasets simulate the preparation phase where a privacy-stealing attacker uses a pseudo-client to obtain relevant data for training an attack model. Simultaneously, all data in D1 are labeled with 1 (representing members), and all data in D2 are labeled with 0 (representing non-members). It is worth noting that this simulation process essentially provides the attacker with a very high attack perspective. In an actual attack, the amount of data an attacker can obtain is far less than in this simulation, making privacy theft much more difficult.

[0071] S4. Train the attack model using D1 and D2. This experiment used MLP, random forest, and LSTM models to train the attack model.

[0072] S5, Data in The data is handed over to client C for processing, and the resulting series of intermediate data is denoted as dataset D3. This dataset is the intermediate data set of the member datasets used for model training after processing by the client. This process simulates a user obtaining intermediate data from client C through key authentication with a fake client F, but the data is intercepted and obtained by the thief after passing through an untrusted domain when propagating to the server.

[0073] S6. Use the trained attack model to predict D3. This process simulates the attack. The results are as follows: Figure 5As shown, the vast majority of the original 500 member data entries were identified as non-members, with only a small portion identified as members. This demonstrates that even under such an extreme attack scenario in the simulation, the fake client F, through random neuron activation, can significantly undermine the effectiveness of the attack model trained by the thief, making it difficult for the thief to launch deeper privacy-stealing attacks and effectively protecting the user's privacy data security.

[0074] Example 2:

[0075] like Figure 6 The illustrated code privacy-preserving inference device based on model segmentation and random activation includes:

[0076] The splitting module is used to split the large model into a client model and a server model. The server will be deployed on the trusted domain computing platform.

[0077] The module constructs a pseudo-client by extending the client through neurons.

[0078] The authentication module uses a preset key to verify whether the user is a real user or a privacy-stealing attacker, thereby determining whether the defense module is effective, that is, whether the user is using a client or a fake client.

[0079] The defense module is used by fake clients to activate extended neurons through random neuron activation operations, thereby confusing the intermediate data obtained by attackers through the processing module and undermining the effectiveness of the corresponding attack model application.

[0080] The processing module is used to process the raw input through the client and extract the surface features of the processed data to obtain the intermediate data of the corresponding data.

[0081] The push module is used to establish an encrypted channel and transmit the encrypted data results obtained by the processing module to the computing platform running on the server, and then decrypt the data and pass it to the subsequent model to continue to complete the inference.

[0082] The generation module, on the server side, is used to further reason from the decrypted intermediate data to obtain the corresponding result through the server-side model. The result is then encrypted and transmitted to the client generation module via the push module, and decrypted to obtain the corresponding reasoning result.

[0083] The actual use of this device by a real user involves the following steps:

[0084] S1 uses split modules to complete the preliminary preparations and the corresponding server-side S deployment.

[0085] The S2 authentication module performs key verification. If the verification is successful, client C is located from pseudo-client F.

[0086] S3 users use client C to perform remote code auditing, and the processing module processes the raw data to obtain intermediate data.

[0087] The S5 push module encrypts the data and pushes it to the server-side generation module after the encrypted channel is successfully established.

[0088] The S6 server-side generation module obtains the final result and hands it over to the push module, which then sends the result back to the client-side generation module.

[0089] The S7 client's generation module displays the final results to the user.

[0090] The beneficial effects of this invention are as follows: Addressing the current challenges of computational power constraints and inadequate privacy protection in the field of code auditing, this invention proposes a code privacy protection inference method for remote code auditing. Based on model segmentation and random neuron activation expansion, the method not only leverages a client model with minimal computational power requirements on the user side to overcome the computational power shortage problem, but also utilizes a pseudo-client to make it difficult for privacy thieves to launch privacy-stealing attacks, effectively realizing privacy protection in remote code auditing.

[0091] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for code privacy preserving inference based on model partitioning and stochastic activation, characterized in that, The method comprises the following steps: Step 1, splitting the original code audit model into an original client and a server; Step 2, neuron expansion is performed on the feedforward neural network of the original client internal Transformer block to generate a pseudo client, comprising: obtaining the original intermediate_size parameter value and the original hidden_states parameter value of the Transformer block in the original client model architecture; creating a new FFN module; the architecture of the new FFN module is the same as that of the original client FFN module, but its internal dimension is the new intermediate_size parameter value; in the new FFN module, the original part parameters except the expanded dimension are the same as those of the original client; the pseudo client F has the same number of Transformer blocks as the original client, and each Transformer block uses the new FFN module; Step 3, establishing a key authentication mechanism on the pseudo client; if the key authentication is passed, the neuron expansion part automatically does not participate in the processing of the input data, and the pseudo client automatically changes into a client; if the key authentication fails, the pseudo client randomly activates the neuron expansion part according to a random activation strategy; Step 4, establishing an encrypted channel connection mechanism between the pseudo client and the server.

2. The model-based partitioned and randomly activated code privacy preserving inference method of claim 1, wherein, In step 1, the original code audit model is fine-tuned using a code fine-tuning dataset before splitting.

3. The model-based partitioned and stochastically activated code privacy preserving inference method of claim 1, wherein, In step 1, according to the total number of Transformer layers of the code audit model, the code audit model is split according to a predetermined strategy; wherein the first N layers of the original code audit model are encapsulated as the original client, and the last M layers are encapsulated as the server.

4. The model-based partitioned and randomly activated code privacy preserving inference method of claim 1, wherein, Step 1 also includes testing whether the original code audit model after splitting can normally reason.

5. The model-based partitioned and stochastically activated code privacy preserving inference method of claim 1, wherein, The new intermediate_size parameter is a multiple of the original hidden_states parameter value and is more than 1.5 times the original intermediate_size parameter value.

6. The model-based partitioned and stochastically activated code privacy preserving inference method of claim 1, wherein, In step 3, the random activation strategy includes Kaiming uniform initialization, high-variance Gaussian initialization, Xavier uniform initialization, and large-range uniform initialization.

7. The model segmentation and random activation-based code privacy protection reasoning method of claim 1, wherein After the real user passes the key authentication, the structure and parameter value of the original client are obtained, so that the original client is called for use; the original code data uploaded by the user is processed by the client in a local secure environment to become intermediate data transmitted in the middle layer of the large model; the intermediate data is encrypted and sent to the server running in the trusted domain through the untrusted domain.

8. The model segmentation and random activation-based code privacy protection reasoning method of claim 1, wherein In the encryption channel connection mechanism, the client and the server each have a pair of public key and private key, the server sends the server public key to the client; the client generates a temporary session key using the server public key and encrypts the session key; the client sends the session key to the server; after receiving the session key, the server decrypts the session key using its own private key.

9. A code privacy-preserving inference device based on model segmentation and random activation, characterized in that, Comprise: The splitting module is used for splitting the original code auditing model into an original client and a server; The construction module extends the neurons of the original client to construct a pseudo client; The authentication module verifies whether the user is a real user or a privacy stealing attacker through preset key authentication, so as to determine whether the defense module works, that is, whether the user uses the client or the pseudo client at this time; The defense module is used for the pseudo client to activate the extended part of neurons through random neuron activation operation, to confuse the intermediate data obtained by the attacker through the processing module, and to destroy the effectiveness of the corresponding attack model application; The processing module is used for processing the original input through the client, extracting the surface features of the processed data to obtain the intermediate data of the corresponding data; The push module is used for establishing an encryption channel and encrypting the data results obtained by the processing module and transmitting them to the algorithm platform running on the server, and then decrypting and delivering them to the subsequent model for further reasoning; The generation module includes a server generation module and a client generation module; The server generation module continues to reason the intermediate data obtained by decryption to obtain the corresponding results, and then transmits and outputs them to the client generation module through the push module after encryption, and obtains the corresponding reasoning results after decryption; The code privacy protection reasoning device based on model segmentation and random activation is used to realize the code privacy protection reasoning method based on model segmentation and random activation and its steps.

Images