Efficient homomorphic calculation method for neural network privacy reasoning

Abstract

The invention provides an efficient homomorphic calculation method for neural network privacy reasoning, and belongs to the technical field of cryptographic protocol design in privacy calculation. Through collaborative design of input channel coding in the first step, weight preprocessing in the second step, small-step self-isomorphism in the third step, plaintext and ciphertext multiply-accumulation in the fourth step and large-step self-isomorphism and accumulation in the fifth step, the number of output ciphertexts is remarkably reduced by utilizing the characteristics of self-isomorphism, so that the communication overhead is reduced, efficient communication is realized, and the communication efficiency is improved. And the method has a wide application scene.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic protocol design in privacy computing, specifically relating to an efficient homomorphic computation method for privacy inference in neural networks.

[0002] Privacy protection has become a major concern when deploying deep neural networks (DNNs) in the cloud. In recent years, homomorphic encryption (HE) has been proposed and attracted widespread attention. It allows computation directly on encrypted data (i.e., "ciphertext") without prior decryption. The result of the computation, after decryption, is completely identical to the result of performing the same computation directly on the original data (i.e., "plaintext"). In modern HE schemes, data is not "encrypted piece by piece," but rather processed in "packets." The original data is first encoded into a "plaintext polynomial." For example, a vector [10,20,30,40] might be encoded as a polynomial. When this plaintext polynomial After encryption, it becomes ciphertext consisting of two "polynomials," mathematically hiding the original plaintext polynomial information. All homomorphic operations are performed on this ciphertext polynomial. The HE scheme primarily supports the following mathematical operations. First is homomorphic addition, which allows the addition of two ciphertexts, corresponding to the element-wise addition of the plaintext polynomial (and its coefficients). For example, encryption... ciphertext and encryption Adding the ciphertext together will result in a decrypted version of... HE also supports "plaintext-ciphertext addition," meaning a ciphertext can be added to a plaintext polynomial. Secondly, it supports plaintext-ciphertext multiplication, which allows multiplication between a plaintext polynomial and a ciphertext. For example, a ciphertext encrypts a plaintext polynomial. There is also a plaintext polynomial Then, the ciphertext multiplication will result in a decrypted version. The polynomial.

[0003] In addition, in homomorphic encryption operations, polynomial calculations are usually performed using the "modulo" method. x N This is done in the sense of "+1", here N It is the degree of the polynomial. N For example, =2, that is, the operation is in the modulo. x N It will proceed under the "+1" rule. This rule means... x 2 +1=0, or in other words x 2 =-1. Suppose we want to calculate (1+2)x (3+4) x First, expand it like a regular polynomial multiplication to get 3 + 10. x +8 x 2 Next, apply the "model" x 2 The "+1" rule will x 2 Replace it with -1. Therefore, the expression becomes 3 + 10. x -8. Finally, simplifying this expression, we get 10. x -5. Finally, automorphism is also an operation in HE. It allows the server to rearrange the coefficients within a polynomial according to certain rules without decryption. This operation is denoted as... He encrypted each term of the plaintext polynomial with ciphertext. Mapped to For example, when N=4, an encrypted... The ciphertext is applied using the self-isomorphism operation. After that, it will become encrypted. After simplification using the modulo rule, it becomes This example also shows that for certain automorphism operations, due to the existence of the modulo rule, the position of sparsity is not actually changed, but only the sign of the coefficients is flipped.

[0004] In addition, "encoding" is crucial because it's the only way to bridge the gap between "tensor operations in neural networks" and "polynomial operations in HE". HE can only perform operations on polynomials, such as polynomial multiplication and addition, while neural networks require matrix multiplication or convolution. The encoding strategy, that is, how matrix elements are placed on polynomial coefficients, directly determines whether the computation will succeed and how efficient it will be. For example, to calculate the dot product of two vectors [1,2] and [3,4], i.e. One approach is to place the values ​​directly onto the coefficients in sequence, which would then become... and The product of the two is This method is incorrect because it does not produce the correct result in the resulting polynomial. Another approach is to place the second vector on the coefficients in the reverse order, that is... and The product of the two is Following this method, the correct result was obtained for the first term.

[0005] To apply HE (Highly Homomorphic Encryption) to privacy-preserving DNN inference, there are two main approaches: fully homomorphic encryption (FHE) and a hybrid HE / two-party computation (2PC) scheme. The key difference lies in the implementation of the nonlinear activation function. The hybrid scheme uses a two-party computation protocol, which helps avoid activation function approximation and costly bootstrapping operations found in the FHE scheme. Therefore, this invention focuses on optimizing the hybrid scheme.

[0006] Privacy-preserving inference using a hybrid HE / 2PC scheme is still significantly slower than plaintext inference, with linear layers accounting for the majority of the total latency. The overhead of linear layers includes the homomorphic computation and the transmission of the homomorphic ciphertext. The entire computation process is as follows: Figure 1 As shown. Before the linear layer computation begins, the client and server each possess a secret shared access to the input activation vectors of the convolutional layer. and ,in , t This is a plaintext modulus. The client encodes its secret share into a polynomial according to the rules of the convolution protocol and encrypts it before sending it to the server for computation. The server has a weight vector W, which it first encodes, then homomorphically adds the received client secret share to its own secret share and performs computation with W. After computation, it shares the secret share again and sends it back to the client for decryption and post-processing. In this way, the client can obtain the computed data without leaking the input data, and the client will not know the information about the server's neural network. With the proposal and application of homomorphic accelerators, the latency of the computation part has been greatly reduced, so homomorphic encrypted transmission has become the main bottleneck. In particular, since homomorphic encryption can only perform operations on polynomials, such as homomorphic polynomial addition and multiplication, while neural networks mainly involve tensor operations, such as matrix multiplication or convolution, how to encode, that is, how to map the elements of the tensor to the coefficients of the polynomial, and design the polynomial addition and multiplication process to ensure that the computation result is correct, is very important and directly affects the computational efficiency and communication size. The existing method, Cheetah Protocol, mainly optimizes the convolution and matrix multiplication protocols in neural networks, but it generates a large number of output polynomials. Figure 2This paper demonstrates a one-dimensional convolution with two input channels and two output channels. For the convolution, the method sequentially arranges the elements of the input tensor X into the coefficients of the polynomial, first along the height and width dimensions of the image, then along the channel dimensions. The elements of the weights W are then arranged in the reverse order. After this arrangement, the correct result elements will appear in some coefficients of the product polynomial. However, this encoding method produces many output polynomials, many of which contain useless elements, or dummy coefficients. These output polynomials need to be secretly shared with the client for subsequent nonlinear layer calculations, resulting in significant communication overhead. Existing methods do not have algorithms to reduce the number of output polynomials. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention proposes an efficient homomorphic computation method for privacy-preserving inference in neural networks. Its core consists of a channel-encoded input and weight encoding method, along with a series of ciphertext automorphism operations, achieving the goal of reducing the number of output polynomials and thus reducing communication overhead. The specific process of achieving efficient homomorphic convolution in this invention is explained below.

[0008] The technical solution of the present invention is as follows: An efficient homomorphic computation method for privacy-preserving inference in neural networks, characterized in that the input tensor of homomorphic convolution is denoted as... The weight is The output is ,in H and W To input the height and width of the tensor, h and w For the height and width of the weight, , The number of input and output channels; in homomorphic encryption, the degree of the polynomial is a power of two, denoted as . ,in k Given a positive integer, polynomial operations are performed modulo... x N This is done under the meaning of +1; at the same time, it introduces... and They are more than H and W The largest and smallest power of two numbers. represent the number of input and output channels that a polynomial can contain, respectively. ,definition Specify the total number of ciphertexts to be input, and The total number of ciphertexts to be output. This serves as both the input ciphertext number and the input channel group index. and As an index for input and output channels It also serves as the output channel index within the polynomial. As the output ciphertext number, it also serves as the output ciphertext index; in terms of weight, express and The weight of the number is plaintext, introduced and As the number of steps or factors for small and large steps; and satisfying They are all powers of 2, and are the closest A set of numbers, each corresponding to an index in the calculation. and , This represents the automorphism operation in homomorphic encryption, abbreviated as The specific steps of this method include: Step 1: Input channel code; Server-side secret sharing of input tensors Encode to obtain An explicit text However, no further encryption is required; the client shares the secret of the input tensor. After encoding and encryption are completed along the input channel direction, the client will obtain A ciphertext The entire message is sent to the server. Upon receiving the ciphertext, the server adds it to its own plaintext using a homomorphic plaintext-ciphertext addition process to restore the secret sharing to its original value. The original ciphertext: ; For the weight K, the server encodes it into the polynomial plaintext along the input channel direction, resulting in a total of Each weight plaintext Each weight plaintext contains One input channel and one output channel; Step 2: Plaintext preprocessing of weights; Plaintext weights Re-recorded , The output ciphertext number represents the plaintext number corresponding to the weight. The output channel corresponding to the weighted plaintext is used to preprocess the weighted plaintext to obtain a new set of weighted plaintext. The calculation formula is as follows: , in, and The range is [0, S b-1] and [0, S g -1], represent .

[0009] Step 3: Small-step automorphism; The server-side calculation obtained in the first step... Each input ciphertext is processed separately. Step automorphism operation, to obtain The middle cipher ; Step 4: Accumulate explicit and esoteric texts; Multiply and sum the intermediate ciphertext obtained in the third step with each preprocessed set of weighted plaintexts from the second step to obtain... The intermediate output ciphertext The specific calculation formula is as follows: , Step 5: Large-scale automorphism and accumulation; Perform a large-scale automorphism on the intermediate output ciphertext obtained in step four, as shown in the following formula: , After completing the large-step automorphism, perform the final accumulation to generate... The output ciphertext is the final output ciphertext, and the specific calculation formula is as follows: , Each ciphertext contains Each output channel has all elements arranged closely together.

[0010] Furthermore, in the first step, the client on the first... A ciphertext The encoding rules are as follows: , On the server side, the first An explicit text The encoding rules are as follows: , in These are the input height index, input width index, input channel group index, and input channel index, respectively; the encoding rules for both are the same. On the server side, weight plaintext The encoding rules are as follows: , , in, These are the weight height index, weight width index, input channel group index, input channel index, and output channel index, respectively.

[0011] Furthermore, each ciphertext output in the fifth step contains The output channels are tightly packed with all elements, and the correspondence between the output polynomial and the output tensor is as follows: , in, These are the output height index, output width index, output ciphertext index, and output channel index, respectively.

[0012] The technical effects of this invention are as follows: This invention is an efficient homomorphic computation method for privacy inference in neural networks. By co-designing the input channel encoding in the first step, the plaintext preprocessing of the weights in the second step, the small-step automorphism in the third step, the plaintext-ciphertext multiplication and accumulation in the fourth step, and the large-step automorphism and accumulation in the fifth step, the method significantly reduces the amount of output ciphertext by utilizing the characteristics of automorphism, thereby reducing communication overhead and achieving efficient communication. Attached Figure Description

[0013] Figure 1 A flowchart for implementing privacy inference in a hybrid HE / 2PC encryption scheme; Figure 2 A schematic diagram illustrating the implementation of the privacy inference algorithm for convolution operations using the Cheetah method; Figure 3 This is a flowchart of the efficient homomorphic computation method for privacy-preserving inference in neural networks proposed in this invention; Figure 4 This is a schematic diagram of the channel encoding method in an example of the present invention; Figure 5 This is a schematic diagram of the plaintext weight preprocessing algorithm in an example of the present invention; Figure 6 This is a schematic diagram illustrating the methods of small-step automorphism, explicit-ciphertext multiplication and accumulation, and large-step automorphism and accumulation in the embodiments of the present invention. Detailed Implementation

[0014] The present invention will be further clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0015] This invention proposes an efficient homomorphic computation method for privacy-preserving inference in neural networks. Its core consists of a channel-encoded input and weight encoding scheme and a series of ciphertext automorphism operations, achieving the goal of reducing the number of output polynomials (i.e., the number of ciphertexts), thereby reducing communication overhead. First, let's reiterate the problems with the previous Cheetah method. The main problem with the Cheetah method is that its encoding scheme generates too many output polynomials, which contain a large number of "dirty elements." These excessive output polynomials create a significant network communication bottleneck. Specifically, as... Figure 2 As shown, the Cheetah protocol typically encodes the input and weight tensors along the width dimension. When the server performs homomorphic multiplication (i.e., polynomial multiplication), the truly valid convolution result (e.g., ...) Figure 2 The [10,10] in the result polynomial will only be sparsely distributed and will appear on certain specific coefficients (e.g., 10) in the result polynomial. x 4 and 10 x 5 All other coefficients in the resulting polynomial are useless for the calculation result; these are called "dirty elements." Since most of the space in each output ciphertext is occupied by these "dirty elements," with only one or a very small amount of valid data, the server must generate and send a large number of output ciphertexts to the client to transmit the entire result. Given that the computation itself has been significantly optimized by the HE accelerator, this huge network communication overhead caused by "dirty elements" has become the main performance bottleneck. Therefore, a channel-encoded input and weight encoding method and a series of ciphertext automorphism operations are proposed to reduce the number of output polynomials, where each polynomial does not contain invalid elements, thereby reducing communication overhead.

[0016] The main symbols used in this invention and their definitions are as follows: Input tensor X The input and weights represent the homomorphic convolution. K (Generally denoted by W, which is the width of the tensor during the calculation process) W Distinguishing and using K The symbol () represents the weights of the convolutional layer, while the output tensor Y represents the result of the convolution calculation. Symbols related to tensor size include: H and W These are the height and width of the input tensor, respectively. h and w These are the height and width of the weight, respectively. and These represent the number of input and output channels, respectively. In homomorphic convolution, the input tensor is denoted as... The weight is The output is In a homomorphic encryption environment, the record N It is the degree of the polynomial and satisfies Where k is a positive integer, and polynomial operations are performed modulo 1. x N It proceeds under the meaning of +1. At the same time, it introduces... and They are more than H and W The largest and smallest power of two numbers. represent the number of input and output channels that a polynomial can contain, respectively. This further defines Specify the total number of ciphertexts to be input, and This represents the total number of ciphertexts to be output. During the secret sharing and encoding phase, and These refer to the shared input secrets held by the client and server, respectively; and It is the set of input ciphertext after client-side encoding and encryption. It is the set of input plaintext encoded on the server side, and the two are used to recover the original ciphertext through homomorphic addition. . This serves as both the input ciphertext number and the input channel group index. and As an index for input and output channels It also serves as the output channel index within the polynomial. This serves as both the output ciphertext number and the output ciphertext index. Regarding weights, express and The weight of the number is plaintext. This introduces... and As the number of steps or factors for small and large steps; and satisfying They are all powers of 2, and are the closest A set of numbers, each corresponding to an index in the calculation. and , This represents the automorphism operation in homomorphic encryption, abbreviated as After the second preprocessing step, a new set of preprocessing weights is obtained, represented as follows: In the calculation process, It is the intermediate output ciphertext set. It is the intermediate ciphertext obtained after a large number of automorphism operations, and finally accumulated. That is the final output ciphertext.

[0017] The overall process is as follows Figure 3As shown, the main steps include channel encoding, weighted plaintext preprocessing, small-step automorphism operation, plaintext-ciphertext multiplication and accumulation, and large-step automorphism and accumulation; the calculation method includes the following steps: Step 1: Input channel code.

[0018] Server-side secret sharing of input tensors Encode to obtain An explicit text However, no further encryption is required; the client shares the secret of the input tensor. After encoding and encryption are completed along the input channel direction, the client will obtain A ciphertext The entire message is sent to the server. Upon receiving the ciphertext, the server adds it to its own plaintext using a homomorphic plaintext-ciphertext addition process to restore the secret sharing to its original value. Original ciphertext: ; Encoded and Their encoding rules are the same, namely: , , in These are the input height index, input width index, input channel group index, and input channel index, respectively. For weights K The server also encodes the data into the polynomial plaintext according to the input channel direction, resulting in a total of... Each weight plaintext Each weight plaintext contains One input channel and one output channel; weights in plaintext The encoding rules are as follows: , , in, These are the weight height index, weight width index, input channel group index, input channel index, and output channel index, respectively.

[0019] like Figure 4 As shown, in this embodiment, the parameters of the convolution operator and homomorphic encryption are as follows: , For example, X[1,0,0] represents the element in the zeroth row and zeroth column of the first input channel, which is 1, while X[2,0,1] represents the element in the zeroth row and oneth column of the second input channel, which is 2.

[0020] Input tensors The numbers are arranged in order of priority. Dimensions, then arrange the width W Dimensions, final arrangement height H Dimension. Substituting the parameters, the encoding rules for the input ciphertext are as follows: , in, .

[0021] After weight encoding, a total of four weight plaintexts are obtained, each containing four input channels and one output channel. Substituting the specific parameters, the encoding rules for the weight plaintexts are as follows: , .

[0022] Step 2: Weighted plaintext preprocessing.

[0023] Plaintext weights Re-recorded , The output ciphertext number represents the plaintext number corresponding to the weight. The output channel corresponding to the weighted plaintext is used to preprocess the weighted plaintext to obtain a new set of weighted plaintext. The calculation formula is as follows: , in, and The range is [0, S b -1] and [0, S g -1], represent .

[0024] like Figure 5 As shown, in this embodiment, the above parameters are still used, and the result can be obtained at this time. , The values ​​of each indicator are as follows: A total of four preprocessed weighted plaintexts will be generated. Substituting the parameters, we can obtain: , , , , Step 3: Small-step automorphism.

[0025] The server-side calculation obtained in step one Each input ciphertext is processed separately. Step automorphism operation, to obtain The middle cipher .

[0026] like Figure 6 As shown, in this embodiment, the above parameters are still used. In this step, the server performs one automorphism operation on one input ciphertext to obtain two intermediate ciphertexts. .

[0027] Step 4: Accumulate the explicit and esoteric texts.

[0028] Multiply and sum the intermediate ciphertext obtained in the third step with each preprocessed set of weighted plaintexts from the second step to obtain... The intermediate output ciphertext The variable that appears in step two, the specific calculation formula is as follows: .

[0029] like Figure 6 As shown, in this embodiment, the above parameters are still used. In this step, this set of ciphertexts is multiplied and added together with each set of pre-processed weighted plaintexts to obtain two intermediate output ciphertexts. The specific calculation formula is as follows: , .

[0030] Step 5: Large-scale automorphism and accumulation.

[0031] Perform a large-scale automorphism on the intermediate output ciphertext obtained in step four, as shown in the following formula: , After completing the large-step automorphism, perform the final accumulation to generate... The output ciphertext is the final output ciphertext, and the specific calculation formula is as follows: , Each ciphertext contains The output channels are tightly packed with all elements, and the correspondence between the output polynomial and the output tensor is as follows: , in, These are the output height index, output width index, output ciphertext index, and output channel index, respectively. For example... Figure 6 As shown, in this embodiment, the above parameters are still used to perform a large-scale automorphism on the intermediate output ciphertext of the fourth step. Specifically... The formula is as follows: , , After completing the large-step automorphism, a final accumulation is performed to produce a single output ciphertext, which is the final output ciphertext. The specific calculation formula is as follows: , The output ciphertext contains all elements tightly packed in four output channels. The correspondence between the output polynomial and the output tensor is as follows: .

[0032] The core of this invention lies in tightly integrating the channel coding scheme of the first step with the small-step Baby-Step and large-step Giant-Step (BSGS) computation process of the second to fifth steps, in order to reduce the amount of output ciphertext and thus reduce network communication. Table 1 lists the reduction of output ciphertext in the Cheetah protocol, where the degree of the ciphertext polynomial is N=8192, and the convolution dimensions in the table are ( For example, (64, 64, 56, 56) represents The results in the table show that this invention can reduce the amount of output ciphertext, i.e., the communication volume by 2-32 times.

[0033] Table 1 shows the reduction in the amount of ciphertext output. Finally, it should be noted that the purpose of disclosing the embodiments is to help further understand the present invention. However, those skilled in the art will understand that various substitutions and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the embodiments, and the scope of protection of the present invention is defined by the scope of the claims.

Claims

1. An efficient homomorphic computation method for privacy-preserving inference in neural networks, characterized in that, Let the input tensor of homomorphic convolution be . The weight is The output is ,in H and W To input the height and width of the tensor, h and w For the height and width of the weight, , The number of input and output channels; in homomorphic encryption, the degree of the polynomial is a power of two, denoted as . ,in k Given a positive integer, polynomial operations are performed modulo... x N This is done under the meaning of +1; at the same time, it introduces... and They are more than H and W The largest and smallest power of two numbers; represent the number of input and output channels that a polynomial can contain, respectively. ,definition Specify the total number of ciphertexts to be input, and The total number of ciphertexts to be output. This serves as both the input ciphertext number and the input channel group index. and As an index for input and output channels It also serves as the output channel index within the polynomial. As the output ciphertext number, it also serves as the output ciphertext index; in terms of weight, express and The weight of the number is plaintext, introduced and As the number of steps or factors for small and large steps; and satisfying They are all powers of 2, and are the closest to 2. A set of numbers, each corresponding to an index in the calculation. and , This represents the automorphism operation in homomorphic encryption, abbreviated as ; The specific steps of this method include: Step 1: Input channel code; Server-side secret sharing of input tensors Encode to obtain An explicit text However, no further encryption is required; the client shares the secret of the input tensor. After encoding and encryption are completed along the input channel direction, the client will obtain A ciphertext The entire message is sent to the server. Upon receiving the ciphertext, the server adds it to its own plaintext using a homomorphic plaintext-ciphertext addition process to restore the secret sharing to its original value. The original ciphertext: ; For the weight K, the server encodes it into the polynomial plaintext along the input channel direction, resulting in a total of Each weight plaintext Each weight plaintext contains One input channel and one output channel; Step 2: Plaintext preprocessing of weights; Plaintext weights Re-recorded , The output ciphertext number represents the plaintext number corresponding to the weight. The output channel corresponding to the weighted plaintext is used to preprocess the weighted plaintext to obtain a new set of weighted plaintext. The calculation formula is as follows: ， in, and The range is [0, S b -1] and [0, S g -1], represent ; Step 3: Small-step automorphism; The server-side calculation obtained in the first step... Each input ciphertext is processed separately. Step automorphism operation, to obtain The middle cipher ; Step 4: Accumulate explicit and esoteric texts; Multiply and sum the intermediate ciphertext obtained in the third step with each preprocessed set of weighted plaintexts from the second step to obtain... The intermediate output ciphertext The specific calculation formula is as follows: ， Step 5: Large-scale automorphism and accumulation; Perform a large-scale automorphism on the intermediate output ciphertext obtained in step four, as shown in the following formula: ， After completing the large-step automorphism, perform the final accumulation to generate... The output ciphertext is the final output ciphertext, and the specific calculation formula is as follows: ， Each ciphertext contains Each output channel has all elements arranged closely together.

2. The method as described in claim 1, characterized in that, In the first step, the client on the first A ciphertext The encoding rules are as follows: ， On the server side, the first An explicit text The encoding rules are as follows: ， in These are the input height index, input width index, input channel group index, and input channel index, respectively; the encoding rules for both are the same. On the server side, weight plaintext The encoding rules are as follows: ， ， in, These are the weight height index, weight width index, input channel group index, input channel index, and output channel index, respectively.

3. The method as described in claim 1, characterized in that, Each ciphertext output in the fifth step contains The output channels are tightly packed with all elements, and the correspondence between the output polynomial and the output tensor is as follows: ， in, These are the output height index, output width index, output ciphertext index, and output channel index, respectively.

Images