Non-linear operator calculation method and system for privacy protection machine learning

Abstract

The invention discloses a non-linear operator calculation method and system for privacy protection machine learning, and provides efficient and safe basic support for private calculation of operations such as a non-linear activation function in a machine learning model on the premise that multi-party cooperative calculation is performed and a plurality of participants do not expose local data. According to the framework, additive secret sharing and mask secret sharing are combined, and an efficient sharing conversion protocol is constructed and used for supporting conversion operation between different sharing types. Furthermore, the invention provides a series of sub-protocols such as security replacement, security comparison and most significant bit (MSB) extraction, and lays a key foundation for subsequent construction of security calculation protocols of non-linear operators such as ReLU, DReLU, MaxPool and the like.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and specifically relates to a nonlinear operator computation method and system for privacy-preserving environments. Background Technology

[0002] With the rapid development of artificial intelligence (AI) and big data technologies, the demand for data-driven intelligent analysis is growing across all industries. However, traditional centralized AI model training methods require the integration of data resources from multiple sources, often facing serious privacy risks and security challenges, especially in fields involving sensitive data such as healthcare, finance, and public safety.

[0003] Privacy-preserving machine learning (PPML) is increasingly used in cross-agent collaboration and highly sensitive data analysis, but the end-to-end performance of existing technologies has long been limited by the efficiency of nonlinear operators. Statistics on typical neural networks (CNNs) show that linear operators account for approximately 84.8%–91.7% of the number of operations, while nonlinear operators account for 73.8%–96.3% of the runtime. This indicates that the performance bottleneck mainly comes from the nonlinear part, rather than the number of linear operators themselves. In engineering implementation, linear operations are typically implemented in the arithmetic domain, while nonlinear operations are mostly implemented using bit-level circuits. During training and inference, these two types of operations alternate, leading to frequent conversions between different sharing types (such as arithmetic sharing and Boolean / XOR sharing), thus introducing significant online communication and latency overhead. This "sharing type conversion" overhead has been repeatedly verified as a key obstacle to improving PPML performance.

[0004] To address the aforementioned bottlenecks, existing approaches mainly include: bit-level schemes represented by garbled circuits (GC) and unintentional transfers (OT); hybrid MPC that combines arithmetic and Boolean circuits; and online lightweight evaluation based on Function Secret Sharing (FSS). The first two methods either maintain high communication volume and round-trip times during the online phase or inevitably introduce multiple sharing type conversions and added systemic overhead. While FSS offers lower online latency, its common form is mostly a two-party protocol, relying on key distribution, and its general extension and engineering adaptability to multi-party, especially dishonest majority security models are limited. Furthermore, some implementations only use finite fields. It carries mixed bit-level and arithmetic-level logic, making it difficult to simultaneously handle common operators. The efficient implementation on the ring further limits the system's throughput and latency performance.

[0005] In summary, existing technologies generally suffer from issues such as nonlinear operator-dominated online latency, systemic communication and round-based overhead caused by sharing type conversion, insufficient adaptability in multi-party (especially dishonest majority) collaborative scenarios, and mismatch between underlying implementation domain selection and engineering deployment. The industry urgently needs a nonlinear basic operator solution that provides constant rounds, low online communication, and compatibility with dishonest majority safety models without relying on heavy garbage collection (GC), along with a low-overhead sharing conversion mechanism. This would significantly reduce end-to-end latency and communication costs, laying the foundation for the efficient deployment of core operations such as ReLU / DReLU, comparison and MSB extraction, and MaxPool. Summary of the Invention

[0006] The purpose of this invention is to propose a nonlinear operator computation method and system for privacy-preserving machine learning, providing a secure and efficient basic operator protocol for the computation of key operations such as nonlinear activation functions in multi-party secure computation scenarios.

[0007] The nonlinear operator computation method for privacy-preserving machine learning designed in this invention includes the following specific steps: Data can be shared secretly using two sharing types: additive secret sharing and masked secret sharing. Four sharing conversion macros are provided, including: A2Bit: Converts mask arithmetic sharing to Boolean sharing; A2Add: Converts mask arithmetic sharing to additive sharing; A2Xor: Converts mask arithmetic sharing to XOR sharing; Add2A: Converts additive sharing to masked arithmetic sharing; Based on the aforementioned sharing type and conversion macro, the following secure multi-party computation sub-protocol is constructed: A secure permutation protocol for generating random permutation matrices and performing permutations on secretly shared data; A secure comparison protocol for performing bitwise less-than comparisons in a secret-shared state; The Secure Most Significant Bit Extraction Protocol (SSIP) is used to extract the most significant bit of secretly shared data. The sub-protocol is used to implement non-linear activation functions in privacy-preserving machine learning, including ReLU, DReLU, and MaxPool.

[0008] Furthermore, the A2Bit, A2Add, and A2Xor conversion macros do not introduce communication overhead and are implemented only through local calculation; the Add2A conversion macro only requires one public communication.

[0009] Furthermore, the generation process of the security permutation protocol includes: Each participant generates a random permutation matrix locally; The exchange matrix is ​​secretly shared via a mask; Parallel execution of matrix multiplication protocol to generate and share the final permutation matrix; Use Beaver triples to perform multiplication of the permutation matrix and the input vector.

[0010] Furthermore, in the secure permutation protocol, when all participants share the secret to generate the final permutation matrix by performing n-1 matrix multiplications, a binary tree parallelization strategy is used to organize the process, reducing the number of communication rounds for the n-1 matrix multiplications from... Optimized to , where n is the number of participants.

[0011] Furthermore, the execution process of the secure most significant bit extraction protocol includes: All participants are in the loop based on input value 'a'. Sharing the secrets of masking arithmetic , Given the ring size, perform coordinated operations to obtain its most significant bit. Boolean Secret Sharing The process includes: Masking and Decomposition: Sharing the arithmetic of masking to collaboratively generate a random mask value r by all participants. And obtain its bitwise decomposition; Conversion and Calculation: The above Convert to Boolean sharing And locally calculate the low value of r Arithmetic sharing of the value r' composed of bits ; Publication and Derivation: Through Reconstruction Obtain public value This allows for the local derivation of auxiliary comparison values. ; Safety comparison: For secret input, in For public input, invoke the security comparison protocol. Boolean sharing of comparison results ,in ; Result synthesis: All participants combine the most significant bits of the public value t through a local XOR operation. The most significant bit share of the random mask r and the share of the comparison results Final output Boolean Secret Sharing It satisfies $u = .

[0012] Furthermore, the online communication rounds of the secure comparison protocol and the secure most significant bit extraction protocol are constant, and the communication complexity is O(n^2). 2 ), where n is the number of participants, The size of the ring.

[0013] Furthermore, the method is implemented based on the emp-toolkit and Eigen library to build a project, supporting loop-based implementations. and It performs arithmetic and Boolean operations and uses fixed-point representation to handle decimal operations.

[0014] Based on the same inventive concept, the present invention also designs a system for implementing the nonlinear operator computation method for privacy-preserving machine learning, comprising: a secret sharing module for converting local data into additive or masked secret sharing; A nonlinear operator replacement module is used to replace nonlinear operators in a machine learning model with the secure multi-party computation sub-protocol. The training / inference module is used to perform forward and backward propagation in a secret-shared state. The Secret Reconstruction module is used to recover plaintext results from secret sharing when needed.

[0015] Furthermore, the system supports multi-party participation, including a dishonest majority security model, and is scalable in both LAN and WAN environments.

[0016] Based on the same inventive concept, the present invention also designs a computer-readable storage medium storing a computer program that, when executed by a processor, implements a nonlinear operator computation method for privacy-preserving machine learning.

[0017] The advantages of this invention are: This invention provides a unified protocol family and engineering implementation path for nonlinear operators (such as comparison and sign judgment) in privacy-preserving machine learning: at the protocol level, it introduces secure permutations. Embedded as an auxiliary protocol in the nonlinear pipeline, the position and value are randomized and masked, thereby suppressing access pattern leakage without significantly increasing the online load. This is achieved through bitwise comparisons in a constant-round online phase. ) and MSB extraction ( Core primitives such as A2Bit, A2Add, A2Xor, and Add2A are used to essentially decouple online latency from circuit depth, significantly alleviating the round-trip latency bottleneck in wide area networks (WANs). At the system level, macros for localized sharing type conversion (A2Bit, A2Add, A2Xor, Add2A, etc.) are constructed, sinking most conversions between the arithmetic and Boolean / XOR domains to local operations, introducing one-time communication only where necessary, avoiding the systemic overhead caused by frequent cross-domain switching in existing hybrid MPC solutions. In terms of security and deployability, this invention maintains high efficiency and scalability even with multiple participants and natively supports... It supports commonly used annular domains and maintains shared state for in-place execution of linear operators such as convolution, matrix multiplication, and addition, making it easy to interface with general numerical libraries, deep learning frameworks, and inference engines. Specifically: (1) Constant-round online rounds. Nonlinear operations such as comparison and sign determination are unified into a constant-round online protocol, which essentially decouples the online phase from the circuit depth. Compared with schemes where the number of rounds increases with the depth, it is less sensitive to high-latency WAN environments. When the number of participants increases from 3 to 32, the average latency increases from approximately 0.048 ms to 4.37 ms in a LAN network environment and from approximately 43.5 ms to 282.5 ms in a WAN network environment. It maintains controllable end-to-end latency and stable online performance even as the scale increases.

[0018] (2) Local conversion. The conversion between arithmetic and Boolean / XOR is carried out locally with zero communication (A2Bit / A2Add / A2Xor). Only Add2A requires one communication, which reduces cross-domain round trips and communication triggers from the source. In the three-party scenario, when the batch size is increased from 1 to 100, the throughput increases from about 20.7k to about 159k ops / s. When the batch size is 1000, the throughput is still high and the average latency does not increase significantly, thereby significantly reducing the end-to-end communication pressure and improving training and inference throughput.

[0019] (3) Scalable for multiple participants. The protocol maintains usability under multi-agency collaboration and dishonest majority models, and preprocessing and replacement can be reused across batches; the number of online rounds does not increase with the scale of participants, and is only affected by message size and bandwidth; in actual model inference, it can achieve orders of magnitude speedup compared to general implementations, for example, in a two-participant scenario, it is reduced from 0.25–2.05 s to 0.0024–0.0052 s, meeting the dual requirements of security and efficiency in compliance scenarios.

[0020] In summary, this invention, through its innovative combination of "constant online rounds + local conversion + multiple participants," significantly reduces end-to-end latency and communication pressure while maintaining strict security, and improves training and inference throughput, demonstrating overall performance and engineering advantages compared to existing technologies. Attached Figure Description

[0021] Figure 1 This invention provides a nonlinear operator computation framework for privacy-preserving machine learning. Detailed Implementation

[0022] To facilitate understanding of the present invention, the technical process and effects of the present invention will be described in conjunction with the accompanying drawings.

[0023] To better understand this invention, the specific symbols are described as follows: Representative set .

[0024] for , which is represented as a set .

[0025] Vectors are represented using bold lowercase letters, for example... .

[0026] : Use bold uppercase letters to represent matrices, for example .

[0027] Representative vector The Each element.

[0028] represent The 1 bit.

[0029] :represent Perform matrix multiplication .

[0030] :represent Perform Hadamard product .

[0031] Representatives of the participating parties, among whom , indicating the number of participants is .

[0032] : represents the first Each participating party.

[0033] : Represents the sharing of additive secrets.

[0034] : Represents a secret sharing of a mask.

[0035] : represent The shared additive secrets held.

[0036] : represent The mask they possess is secretly shared.

[0037] : Indicates the least significant bit The following is the secure multi-party computation protocol proposed in this solution: Safe multiplication protocol.

[0038] : Security Replacement Protocol.

[0039] : Security comparison protocol.

[0040] Secure MSB Extraction Protocol.

[0041] The following is a secure multi-party computation protocol utilizing existing solutions: Secure random bit generation protocol.

[0042] Beaver triple generation protocol.

[0043] Example 1 The nonlinear operator computation method for privacy-preserving machine learning disclosed in this invention uses two different types of secret sharing: additive secret sharing. Secret sharing with the mask Regarding the sharing of additive secrets, express The additive or XOR secret sharing. (or Regarding the sharing of secrets via a mask, Indicates in The mask boolean sharing on each satisfies , and , ,in , A publicly available random mask; and These represent secret sharing in the arithmetic field and the Boolean field, respectively; the former is additive secret sharing, and the latter is Boolean XOR sharing.

[0044] This solution utilizes Beaver triples to implement mask arithmetic sharing. and Multiplication Agreement , used for calculation ,in A Beaver triple-based multiplication protocol may include the following steps: in the preprocessing stage, all participants sample random masks. And prepare the corresponding Beaver triples. , This invention will This is defined as the function that generates these triples. During the online phase, each participant computes locally. ,in These are the inputs and A public random mask. Then publicize it to obtain... And thus the result is obtained. . .

[0045] In addition, this solution considers the conversion between different types of sharing and provides the following four sharing conversion macros: From mask arithmetic sharing to Boolean sharing ( Each participant enter , ; From mask arithmetic sharing to additive sharing ( Each participant enter Output additive sharing ,in ; From mask arithmetic sharing to XOR sharing ( ): Each participant enter Output ,in ; From additive sharing to mask arithmetic sharing ( ): Each participant enter Output mask arithmetic ,in .

[0046] The four macros A2Bit, A2Add, and A2Xor mentioned above are local conversions and do not involve communication; Add2A involves only one public operation. The communication is as follows. The specific protocol implementation is as follows: The parties first reach a local settlement. Subsequently, the participating parties cooperated to open and with the original Sharing new mask arithmetic This macro only works when the macro is enabled. A round of communication is generated at a time. Always keep it a secret.

[0047] First press A2Add to... Turn to Then, take the least significant bit from each local unit and set it. XOR aggregation yields This macro is a purely local computation and does not generate any communication.

[0048] : Indicator quantity Only for The participating parties are established, otherwise Each participant calculates its new share locally. ,in For input The public random mask. Due to It can be obtained directly. This macro is a purely local computation and does not generate any communication. Local parties will With its holdings Taking the least significant bit, we get and .because , can be obtained Thus forming This macro is a purely local computation and does not generate any communication. This indicates that the least significant bit is taken.

[0049] This method implements a multiplication protocol for masked secret sharing based on Beaver triples. Based on the sharing transformation macro, a series of sub-protocols are designed for the nonlinear operator computation framework for privacy-preserving machine learning: 1) Security Replacement Protocol

[0050] This protocol aims to generate a random permutation matrix where the non-zero element in each row is itself a random number. This invention shares the steps to generate a random permutation matrix.

[0051] 1. Participants Select a random permutation moment locally Each row contains only one random number; 2. All participants secretly share their respective random permutation matrices with the other participants, obtaining a set. ; 3. All participants execute the matrix multiplication protocol in parallel to obtain... ,in .

[0052] Based on the parallelization strategy of binary trees, for the above In the implementation of matrix multiplication, step 3 will be... Serial communication optimized to Round-robin communication.

[0053] Each participant Holding a public matrix (permutation matrix) Sharing the secrets of input ,in The goal is to avoid leaking information. Calculate under the premise In terms of algorithm flow, each participant... Locally selected random permutation matrix (Each row / column contains exactly one 1), and With The same method is used to secretly share information and obtain... Then, using the matrix multiplication protocol, each share is calculated sequentially to obtain... ,in And then call Beaver multiplication to complete. The calculation is as follows: The specific algorithm protocol is as follows: (a) Each participant Choose a random permutation matrix locally Each row contains only one random number.

[0054] (b) All participants secretly share their random permutation matrices with other participants via a mask, and each party receives a share. .

[0055] (c) All participants execute the matrix multiplication protocol in parallel and obtain... ,in .

[0056] (d) All participants call To prepare the corresponding Beaver triples ,in . (e) Each participant , Local computing

[0057] (f) All participants open ,get And it can be regarded as .

[0058] 2) Security Comparison Protocol

[0059] This invention proposes an efficient protocol for securely computing bitwise "less than" comparisons, based on a random permutation matrix prepared using a first protocol. Specifically, given a public value... as well as , }(in Protocol output , among which when ,otherwise .

[0060] For comparison Bit unsigned integer a and (remember for The bits, for The (bits), can be calculated as follows: 1. Sampling and selecting random bits and random values ,in It is a prime number; 2. Regarding Execute in sequence: 3. Calculate the random bits Position difference after masking ; 4. Calculate whether it is in the first... Indicator of positional difference ; 5. Calculate the zero detection bit ; 6. In the model Chinese calculation ; 7. If and only if Time output Otherwise, output random bits. .

[0061] In order to be in The design uses bitwise "less than" comparisons instead of... Above, the present invention makes To avoid calculation in step 3 ,in Random bits selected for sampling. This invention firstly... Chinese calculation The mask boolean is shared and converted to The addition method is shared above. Because for... Can be calculated locally This is achieved by using the aforementioned random permutation matrix in step 6 to mask the process. The position and value of the vector are determined to avoid sequential calls to the multiplication protocol. Finally, the vector after the mask is made public. To determine if a zero element exists. Bitwise "less than" comparison protocol (denoted as...) The detailed description of the protocol is as follows. Having in 2 rounds Online communication complexity: Each participant hold in The goal is to avoid leaking information. Calculate under the premise Among them when .

[0062] (a) Each participant sampling .

[0063] (b) Joint invocation by all parties generate and , For length is The bit-by-bit random mask vector, Represents a bit index, each Independent uniform sampling.

[0064] (c) All parties use the command Will Convert to and .

[0065] (d) All participants use naming Will Convert to and .

[0066] (e) For each Each participant sets up locally. And calculate ,in It is a bit-by-bit random mask Boolean Secret Sharing (each) Independent and uniform, with independent, (representing bit index) It is a mask bit. Boolean secret sharing.

[0067] (f) For each All participants jointly open the file to obtain the intermediate auxiliary bit. , making ,in For the first The party holding Boolean share.

[0068] (f) All parties use the command ( )Will Convert to .

[0069] (g) All participants use commands Will Convert to .

[0070] (h) For each Each participant performs parallel local computation , , , .

[0071] (i) All participants use commands Will Convert to .

[0072] (j) All participants invoke command Depend on get .

[0073] (k) Local settings for each participant If and only if there exists , making and output .

[0074] 3) Secure MSB Extraction Protocol

[0075] The core operation of most nonlinear functions is comparison, which can be characterized using the most significant bit (MSB) in two-complement form. For example, to compare... You can calculate first. The MSB is extracted to complete the comparison. It should be noted that the correctness of this method depends on the absence of overflow. The following invention is based on... An MSB extraction protocol is proposed to achieve lower online traffic.

[0076] From an intuitive point of view, in order to obtain The MSB can be calculated. ,in That is, take respectively low bits (range is) The key operation lies in judgment. Does it meet the requirements? .because This means that in middle There will be no wrapping, only comparison. That's all.

[0077] In terms of algorithm flow, given input sharing First generate Secondary random bit sharing, i.e. and ,in for The bitwise decomposition, i.e. Reconstruction get It can be observed ,and In addition, we obtained Plaintext, and can be computed locally. .

[0078] Utilizing the present invention Comparable and And obtain the final MSB output. Let this MSB extraction protocol be denoted as... Its detailed description is as follows, the protocol Having in 2 rounds Online communication complexity: Each participant hold ,calculate .

[0079] (a) Function jointly invoked by all participants To generate ,in .

[0080] (b) All participants invoke the command To convert it to .

[0081] (c) Each participant Local computing .

[0082] (d) Each participant Local computing .

[0083] (e) calculate ,and calculate .

[0084] (f) Open jointly by all participating parties get ,in .

[0085] (g) Each participant Local computing ,in .

[0086] (h) Each participant Local computing .

[0087] (i) All participants call of and obtain ,in and .

[0088] (j) Outputs of all participants .

[0089] As attached Figure 1 As shown, the overall process between the data provider and the secure computing server includes stages such as secret sharing, nonlinear operator replacement, training / inference, and secret reconstruction.

[0090] S1 Secret Sharing (①): Each participant secretly shares its local data and initial model parameters, generating a secret share on the ring domain and sending it to the secure computing server. No participant can recover the plaintext from the share, ensuring input privacy.

[0091] S2 Nonlinear Operator Replacement (②): Replace the nonlinear and comparison-related operators in the deep model with equivalent security protocols: Unify comparison and sign judgment using the bitwise "less than" comparison protocol. ) and the most significant bit extraction protocol ( Complete this step to replace the plaintext branch; Introducing a secure permutation protocol ( The shared state data undergoes encrypted permutation / inverse permutation, and its position and order are randomized; the permutation is generated and reusable in the preprocessing stage, and the online interaction is a constant round. Before comparison or filtering, first pass The mask perturbs the hidden position and value pattern; Linear operators (convolution, matrix multiplication, addition, etc.) are executed natively within the shared domain without needing to be explicitly defined.

[0092] S3 Training and Reasoning (Red Circuit): After operator replacement is completed, the server performs forward and backward propagation in the shared domain, alternately performing linear operations and the replaced nonlinear operations. To improve throughput, communication for multiple samples is merged and batch-processed, and pipelined.

[0093] S4 Secret Reconstruction (③): When visible results (such as predictions or evaluation metrics) are required, the agreed-upon recipient reconstructs the corresponding plaintext from the shared data.

[0094] This invention evaluates the performance and communication overhead of the proposed protocol. This invention will... As an auxiliary protocol, bitwise comparison is embedded ( ) and MSB extraction ( Its actual impact is reflected in the complete production line. This invention provides randomization of position and value for comparison operations. Its marginal overhead in the online phase is negligible compared to arithmetic and communication backbones. Evaluating it under real workloads (batch processing, different number of participants, LAN / WAN, etc.) better reflects its actual contribution to overall latency and throughput, as well as its coupling effect with engineering factors such as communication rounds, batch merging, and memory hierarchy. Simultaneously, this invention evaluates three neural network inference implementations in FALCON and compares its implementation with the current state-of-the-art solution MP-SPDZ. All implementations were performed on a PC equipped with an Intel(R) Core(TM) i7-10700 and 32GB of memory, running Ubuntu. The LAN network bandwidth reached up to 1Gbps with a round-trip time (RTT) of 0.04 ms; the WAN network bandwidth reached up to 200 Mbps with an RTT of 50 ms. The implementation of this invention is based on the emp-toolkit and Eigen libraries. All operations are performed within a loop. and Execute above. Fixed-point arithmetic is used for decimal operations with a precision of 20 digits.

[0095] The goal of this embodiment is to achieve low online communication rounds and low overhead. Therefore, this invention first evaluates the communication overhead of each protocol, as shown in the table below. It can be observed that, whether in the preprocessing stage or the online stage, the protocols of this invention involve circuit depth. Unrelated constant-round communication. Prep. indicates the preprocessing stage; Online. indicates the online stage. For the number of participants, Let be the size of the ring. Communication complexity is expressed in terms of complexity.

[0096]

[0097] Meanwhile, the present invention evaluated the performance of the protocol under different settings with different numbers of participants, as shown in the table below.

[0098]

[0099] The protocol of this invention exhibits high efficiency in both LAN and WAN environments. Furthermore, since the number of online communication rounds in this invention's protocol is constant, the impact of network communication latency on performance gradually decreases as the number of participants in a WAN scenario increases.

[0100] From a protocol design perspective, online communication typically occurs at the end of the protocol and is relatively concentrated. By merging communication from multiple protocol executions, this invention implements batch processing in the CPU implementation, thereby improving performance. As shown in the table below, this invention evaluated protocol performance at different batch sizes in a three-partition scenario. Average latency is in milliseconds, and throughput is in opts / s. When the batch size exceeds 100, the throughput of protocol execution will decrease slightly due to device limitations.

[0101]

[0102] To demonstrate the efficiency of the protocol, this invention constructs three commonly used neural networks in PPML (Net-A, Net-B, and Net-C, used in SecureML and FALCON). In the figure below, this invention uses a two-partition example, and the test results are as follows. Indicates the number of participants:

[0103] Example 2 Based on the same inventive concept, the present invention also designs a system for implementing the nonlinear operator computation method for privacy-preserving machine learning, comprising: a secret sharing module for converting local data into additive or masked secret sharing; A nonlinear operator replacement module is used to replace nonlinear operators in a machine learning model with the secure multi-party computation sub-protocol. The training / inference module is used to perform forward and backward propagation in a secret-shared state. The Secret Reconstruction module is used to recover plaintext results from secret sharing when needed.

[0104] Furthermore, the system supports multi-party participation, including a dishonest majority security model, and is scalable in both LAN and WAN environments.

[0105] Since the device described in Embodiment 2 of this invention is a computer-readable medium used to implement the nonlinear operator computation method for privacy-preserving machine learning in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of the system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in any method of this invention's embodiments fall within the scope of protection of this invention.

[0106] Example 3 Based on the same inventive concept, the present invention also designs a computer-readable storage medium storing a computer program that, when executed by a processor, implements a nonlinear operator computation method for privacy-preserving machine learning.

[0107] Since the device described in Embodiment 3 of this invention is a computer-readable medium used to implement the nonlinear operator computation method for privacy-preserving machine learning in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable media used in any method of this invention are within the scope of protection of this invention.

[0108] The specific embodiments described herein are merely illustrative of the spirit of the invention. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

Claims

1. A method for privacy-preserving machine learning nonlinear operator computation, characterized in that, Comprise: Secretly sharing data using two types of shares, additive secret sharing and masked secret sharing; Providing four share conversion macros, including: A2Bit: converting from masked arithmetic shares to Boolean shares; A2Add: converting from masked arithmetic shares to additive shares; A2Xor: converting from masked arithmetic shares to XOR shares; Add2A: converting from additive shares to masked arithmetic shares; Based on the share types and conversion macros, the following secure multi-party computation sub-protocols are constructed: A secure permutation protocol for generating a random permutation matrix and performing permutation on secret share data; A secure comparison protocol for performing bitwise less-than comparison in secret share state; A secure most significant bit extraction protocol for extracting the most significant bit of secret share data; Using the sub-protocols to implement nonlinear activation functions in privacy-preserving machine learning, including ReLU, DReLU, MaxPool.

2. The computational method of claim 1, wherein: The A2Bit, A2Add, and A2Xor conversion macros do not introduce communication overhead and are implemented only through local computation; the Add2A conversion macro requires only one public communication.

3. The computational method of claim 1, wherein, The generation process of the secure permutation protocol includes: Each participant locally generates a random permutation matrix; All participants exchange their matrices through masked secret sharing; All participants perform a matrix multiplication protocol in parallel to generate a secret share of the final permutation matrix; Call the Beaver triple-based multiplication protocol to calculate the product of the permutation matrix and the input secret share vector.

4. The method of claim 3, wherein the method is a privacy-preserving machine learning nonlinear operator computation method. In the secure permutation protocol, all participants generate a secret share of the final permutation matrix by performing n-1 matrix multiplications, organized using a binary tree parallelization strategy that reduces the number of communication rounds of the n-1 matrix multiplications from to where n is the number of participants.

5. The computational method of claim 1, wherein, The execution process of the secure most significant bit extraction protocol includes: All participants perform a masking operation on the input value a based on their share of the ring , The ring size, the operation is performed in conjunction to obtain its most significant bit of the Boolean secret sharing , the process comprises:​​ Masking and splitting: all participants jointly generate a random masking value r in a masked arithmetic sharing and obtain its bit-wise decomposition; Conversion and computation: convert the Boolean share to a Boolean share and locally compute the arithmetic share of the value r' consisting of the low bits of r ; Disclosed and derived: by reconstruction Obtaining a disclosed value and then locally deriving a helper comparison value ; Secure comparison: call the secure comparison protocol with the secret input and the public input , obtaining a Boolean share of the comparison result where ; resulting synthesis: all participants combine the most significant bits of the public value t , the most significant bits share of the random mask r , and the comparison result share , resulting in a final output Boolean secret share that satisfies $u = .

6. The computational method of claim 1, wherein: The online communication round of the secure comparison protocol and the secure most significant bit extraction protocol is constant round, and the communication complexity is O(n 2 ), where n is the number of participants, is the ring size.

7. The computational method of claim 1, wherein, The method is based on emp-toolkit with Eigen library construction engineering implementation, support in the ring With The arithmetic and Boolean operations are performed on the top and decimal operations are handled using fixed-point number representation.

8. A system for implementing the method of claim 1-7, characterized in that, Comprise: A secret sharing module for converting local data into additive or masked secret shares; A nonlinear operator replacement module for replacing nonlinear operators in a machine learning model with the secure multi-party computation sub-protocols; A training / inference module for performing forward and backward propagation in secret share state; A secret reconstruction module for recovering clear results from secret shares when needed.

9. The system of claim 8, wherein, The system supports multi-party participation, including dishonest majority security model, and is scalable in both local area network and wide area network environments.

10. A computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the nonlinear operator computation framework of any one of claims 1-7.

Images