Training and calling methods of machine learning models and machine learning systems

Abstract

Embodiments of this specification provide a training method and a calling method for a machine learning model, as well as a machine learning system. The training method includes: obtaining, by a verifiable computing engine platform, a first training dataset including training data for each of one or more participants; obtaining, in a trusted execution environment of the verifiable computing engine platform, a watermarked training dataset based on all of the first training datasets of the one or more participants, wherein the watermarked training dataset includes watermarked training data with a watermark label and training data without a watermark label; and performing training in the trusted execution environment based on the watermarked training dataset to generate the machine learning model.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of machine learning technology, and in particular, relate to a training method and a calling method of a machine learning model and a machine learning system. Background Art

[0002] Machine learning, a discipline of artificial intelligence, optimizes the performance of computer programs based on data or past experience. In machine learning, the more training data provided, the higher the accuracy of the resulting machine learning model. Therefore, organizations or businesses with access to large amounts of data can often train high-quality machine learning models. However, due to privacy and data security concerns, such machine learning models are often limited to the use of their trainers, hindering the full utilization of the data and corresponding models. Therefore, an effective solution is needed to better realize and protect the value of data and models. Summary of the Invention

[0003] The purpose of the present invention is to provide a training method and calling method for a machine learning model and a machine learning system to better realize and protect the value of data and models.

[0004] According to a first aspect of one or more embodiments of this specification, a method for training a machine learning model is provided, including:

[0005] Obtaining, by the verifiable computing engine platform, a first training data set including training data for each of the one or more participants;

[0006] In a trusted execution environment of the verifiable computing engine platform, obtaining a watermarked training dataset based on all first training datasets of the one or more participants, wherein the watermarked training dataset includes watermarked training data with a watermark label and training data without a watermark label; and

[0007] In the trusted execution environment, training is performed based on the watermarked training dataset to generate the machine learning model.

[0008] According to a second aspect of one or more embodiments of this specification, a method for calling a machine learning model is provided, wherein the machine learning model is configured to perform watermark verification, wherein the watermark verification is used to identify whether the data to be verified is watermark verification data having a watermark tag. The calling method includes:

[0009] The verifiable computing engine platform obtains the call request information from the caller;

[0010] In the trusted execution environment of the verifiable computing engine platform, using the machine learning model to perform watermark verification on the data to be verified according to the call request information; and

[0011] When it is determined that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to the preset verification number, it is determined that the watermark verification has passed, and in the trusted execution environment, the machine learning model is run according to the calling authority assigned to the caller to generate an analysis result based on the data to be analyzed provided by the caller.

[0012] According to a third aspect of one or more embodiments of this specification, a machine learning system is provided, including a verifiable computing engine platform, wherein the verifiable computing engine platform includes:

[0013] a first communication unit, configured to obtain call request information from a caller;

[0014] a verification unit, the verification unit being provided in a trusted execution environment of the verifiable computing engine platform, and the verification unit being configured to perform watermark verification on the data to be verified using the machine learning model according to the call request information, wherein the machine learning model is configured to be able to perform watermark verification, and the watermark verification is used to identify whether the data to be verified is watermark verification data having a watermark tag;

[0015] an allocating unit, configured to allocate a calling right to the caller; and

[0016] A model running unit is provided in the trusted execution environment, and the model running unit is configured to run the machine learning model.

[0017] According to a fourth aspect of one or more embodiments of this specification, a non-transitory computer-readable storage medium is provided, on which computer instructions are stored, and when the computer instructions are executed by a processor, the steps of the training method or the calling method as described above are implemented.

[0018] According to a fifth aspect of one or more embodiments of this specification, a computer program product is provided, which includes computer instructions, and when the computer instructions are executed by a processor, the steps of the training method or the calling method described above are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0020] Figure 1 This is an architectural diagram of a machine learning system in one embodiment of this specification;

[0021] Figure 2 is a flowchart of a method for training a machine learning model in one embodiment of this specification;

[0022] Figure 3 is a flowchart of step S130 in the training method of the machine learning model in one embodiment of this specification;

[0023] Figure 4 is a flowchart of a method for training a machine learning model in another embodiment of this specification;

[0024] Figure 5 is a flowchart of a method for training a machine learning model in another embodiment of this specification;

[0025] Figure 6 is a flowchart of a method for training a machine learning model in yet another embodiment of this specification;

[0026] Figure 7 is a flowchart of a method for calling a machine learning model in one embodiment of this specification;

[0027] Figure 8 This is a flowchart of step S330 of the method for calling a machine learning model in one embodiment of this specification;

[0028] Figure 9 This is a flowchart of step S330 of the method for calling a machine learning model in another embodiment of this specification. DETAILED DESCRIPTION

[0029] To help those skilled in the art better understand the technical solutions in this specification, the following will provide a clear and complete description of the technical solutions in the embodiments of this specification, in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. All other embodiments derived by those skilled in the art based on the embodiments in this specification without creative effort shall fall within the scope of protection of this specification.

[0030] Currently, there are various attacks targeting data privacy. For example, membership inference attacks can determine the identity of training datasets, and model theft attacks can steal models using limited black-box information. Both of these attacks pose a risk to both white-box and black-box machine learning models, as they only require the model's API and minimal data. While model watermarking can verify the identity of participants in training the model, providing some protection against model theft, it still cannot protect against attacks by malicious actors. This is because even if a participant possesses the model and data, it is still possible to launch a membership inference attack against other participants in a white-box environment.

[0031] To address the mining, transfer, and evaluation of data value in machine learning and to more fully leverage the value of data and models, one or more embodiments of this specification propose a method for training a machine learning model, a method for calling a machine learning model, a machine learning system, a non-transitory computer-readable storage medium, and a computer program product. The machine learning models herein may include, but are not limited to, multi-party learning models and deep learning models.

[0032] like Figure 1 , which is an architectural diagram of a machine learning system. The machine learning system may include a verifiable computing engine (MYTF) platform 910, which can utilize technologies such as a trusted execution environment (TEE) and a WebAssembly (WASM) virtual machine to allow verifiable computing tasks (e.g., verifiable applications or trusted applications (TAPPs)) to be executed in a trusted execution environment. It can also prove to anyone that the computing task was executed in the trusted execution environment as expected by the user.

[0033] Among them, the trusted execution environment can be a secure and trusted area in the processor to ensure the security, confidentiality and integrity of the code and data placed therein. The trusted execution environment provides an isolated execution environment where code and data can run in the trusted execution environment, and during the operation process, the operation of the calculation can be guaranteed not to be interfered with by the conventional operating system, thereby ensuring the confidentiality and integrity of the code and data. The code program executed in the trusted execution environment can be called an Enclave. Before using the Enclave program, the user usually needs to measure the code and data of the Enclave program and undergo remote verification to confirm that the Enclave program is the program that the user expects to be executed.

[0034] The WASM virtual machine is a stack-based virtual machine with binary operation instructions. WASM code can be compiled into machine code and loaded into the WASM virtual machine for execution.

[0035] TAPP is an application implemented using Verifiable Computation technology and can be run in MYTF, such as the WASM virtual machine. Specifically, anyone can upload WASM bytecode to the Verifiable Computing Engine platform and call the WASM bytecode to execute computing tasks and obtain computational results.

[0036] In some embodiments, the machine learning system may further include one or more participant devices 920, each of which is provided locally in one or more participants. The participant devices 920 may be used to perform local data processing for the corresponding participant and exchange information or data with the verifiable computing engine platform.

[0037] When a machine learning model is called, the verifiable computing engine platform 910 can be used to perform watermark verification on the caller. After passing the watermark verification, the verifiable computing engine platform 910 decrypts the ciphertext model received from the participating device 920 to generate a machine learning model, and runs the machine learning model in the trusted execution environment of the verifiable computing engine platform 910 based on the assigned calling permissions, thereby providing corresponding services to the caller.

[0038] In some embodiments, the machine learning system may further include a blockchain 930 having one or more nodes 931. Blockchain 930 is a novel application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. In a blockchain system, data blocks can be combined into a chain data structure in a sequentially connected manner according to chronological order, and a distributed ledger that is tamper-proof and unforgeable is cryptographically guaranteed. In one or more embodiments of this specification, at least part of the information related to the training and calling of the machine learning model can be recorded in the corresponding node 931 of the blockchain 930. Alternatively, the trained machine learning model can be regarded as a non-fungible token (NFT) on the blockchain 930, thereby providing highly reliable credential information for the circulation and evaluation of data value, as well as the distribution of corresponding benefits.

[0039] like Figure 2 As shown, in one embodiment of this specification, a training method for a machine learning model is proposed, and the training method may include:

[0040] Step S110: The verifiable computing engine platform obtains a first training data set including training data of each participant among one or more participants.

[0041] Specifically, the first training data set may include multiple pieces of training data. In some embodiments, the training data provided by each participant may include a feature portion and a corresponding label portion. The feature portion of the training data may serve as input to the trained model. After the model performs a series of calculations on the input, it may generate a corresponding output. The label portion of the training data may be used to compare with the output generated by the model based on the corresponding feature portion. Based on the comparison results, relevant parameters in the trained model may be adjusted until the model achieves a preset accuracy. However, the training data provided by each participant may have a different data identifier (ID). The data identifier corresponds to each piece of training data one-to-one to uniquely identify the training data. For example, the data identifier may be generated based on the identity information of the subject corresponding to the training data. The identity information may include, for example, an identification card number or telephone number that uniquely identifies the subject. In other embodiments, the training data in the first training data set from different participants may have the same or substantially the same data identifier. However, the feature portion of the training data in the first training data set from different participants may differ. Furthermore, the corresponding label portion of the machine learning model may only be distributed in the training data of one or some participants, rather than in the training data of all participants.

[0042] In addition, in order to ensure data security, the first training data set of each participant can be transmitted to the verifiable computing engine platform in an encrypted manner, and the verifiable computing engine platform can decrypt the obtained encrypted first training data set.

[0043] like Figure 2 As shown, the training method may further include:

[0044] Step S130: In a trusted execution environment of a verifiable computing engine platform, a watermarked training dataset is obtained based on all first training datasets of one or more participants, wherein the watermarked training dataset includes watermarked training data with a watermark label and training data without a watermark label.

[0045] By watermarking part of the training data in the first training data set provided by each participant, corresponding watermarked training data can be obtained. Specifically, Figure 3 As shown, obtaining a watermarked training dataset based on all first training datasets of one or more participants may include:

[0046] Step S131, merging all first training data sets of one or more participants to generate a second training data set;

[0047] Step S133: extracting a third training dataset from the second training dataset, wherein the third training dataset is a non-empty proper subset of the second training dataset, and the third training dataset includes training data from each participant of the one or more participants;

[0048] Step S135, generating a fourth training data set based on the third training data set, wherein the feature portion of each training data piece in the fourth training data set is generated by watermarking the feature portion of the corresponding training data piece in the third training data set, and the label portion of each training data piece in the fourth training data set is generated by modifying the label portion of the corresponding training data piece in the third training data set into a watermark label; and

[0049] Step S137: merge the fourth training dataset and at least a portion of the second training dataset into a watermarked training dataset.

[0050] Merging all first training data sets of one or more participants to generate a second training data set may include:

[0051] Merging the training data of each of the one or more participants with the same or corresponding data identifiers into the same piece of training data in the second training data set, and treating the training data of each of the one or more participants with different and non-corresponding data identifiers as different pieces of training data in the second training data set; and

[0052] The feature part and label part of each training data in the second training data set are arranged in the same manner.

[0053] In one specific example, the feature portion of the second training dataset generated by merging the first training datasets provided by all participants can be represented as an N*D-dimensional matrix. N is the total number of data, i.e., the total number of distinct and non-corresponding data identifiers; and D is the number of data features, i.e., the dimension in machine learning. In this matrix, each matrix element in the same row represents each feature of a piece of training data corresponding to the same data identifier, while each matrix element in the same column represents the same feature in the feature portion of each piece of training data. Furthermore, each piece of training data in the second training dataset may also include a corresponding label portion.

[0054] The third training dataset extracted from the second training dataset may be watermarked to generate a fourth training dataset. In some embodiments, extracting the third training dataset from the second training dataset may include:

[0055] Using a participant identification identifier corresponding to each participant, labeling all training data in the first training data set of the corresponding participant; and

[0056] Part of the training data in the second training data set is extracted based on the participant identity as the training data in the third training data set, so that the third training data set includes training data from each participant of the one or more participants.

[0057] Among them, the participant identity identifier can mark which participant among one or more participants the corresponding training data originated from. When extracting the third training data set, in order to ensure that the participant's verification or voting authority matches the amount of training data provided by the participant during the subsequent verification or voting process before calling the machine learning model, thereby better realizing the value of the data and model, the training data extracted into the third training data set can be determined based on the participant identity identifier, so that these training data to be watermarked originate from all participants among the one or more participants. In particular, when there are multiple participants, it is avoided that the watermarked training data originates from only one or several participants, causing other participants to lose the verification or voting authority corresponding to the amount of training data they provided. However, in the process of extracting training data from the second training data set to generate the third training data set, for each participant, the training data of each participant in the third training data set can be randomly extracted from the first training data set of the participant. Alternatively, in some embodiments, the third training data set can be extracted according to a preset extraction rule.

[0058] Furthermore, performing watermarking on the characteristic portion of each piece of training data in the third training data set to generate the characteristic portion of the corresponding training data in the fourth training data set may include:

[0059] The noise is superimposed on the characteristic portion of the training data in the third training data set, and the superimposed result is used as the characteristic portion of the corresponding training data in the fourth training data set.

[0060] The dimensions of the noise, the characteristics of the training data in the third training dataset, and the characteristics of the training data in the fourth training dataset are equal to each other to facilitate superposition. For example, if the characteristics of a piece of training data in the third training dataset can be represented as A3 = (ax3, ay3, az3), and the noise superimposed on the characteristics of this training data can be represented as N = (nx, ny, nz), then the result of superimposing the characteristics of the corresponding training data in the fourth training dataset can be represented as A4 = (ax4, ay4, az4) = (ax3 + nx, ay3 + ny, az3 + nz), i.e., ax4 = ax3 + nx, ay4 = ay3 + ny, and az4 = az3 + nz. It should be noted that, depending on actual needs, the noise superimposed on the characteristics of each piece of training data can be the same, partially the same, or different, and this is not limited here.

[0061] In some embodiments, the noise may include noise generated based on non-training data. Alternatively, the noise may include noise generated based on a forward-looking image strategy (FGSM) algorithm, etc. Alternatively, the noise may include Gaussian noise, etc., where Gaussian noise refers to randomly generated noise with noise values ​​that conform to a Gaussian distribution, and the average noise value of the Gaussian noise may be zero.

[0062] In addition, the label portion of each training data in the third training data set can be uniformly modified into a watermark label to serve as the label portion of the corresponding training data in the fourth data training set. If the machine learning model is a classification model, the watermark label can be set to a label corresponding to the watermark type, that is, a new classification type label that is different from the existing classification type label in the unwatermarked model. If the machine learning model is a regression model, the watermark label can be set to a label corresponding to the minimum or maximum output value of the machine learning model to distinguish it from the numerical results that may be output by the unwatermarked model.

[0063] Watermark verification data for each participant can be generated based on the characteristic portions of the training data in the fourth training dataset generated by the watermarking process. As described in detail later, during the verification or voting process prior to model invocation, participants can use the watermark verification data to verify their legitimate identity or as a vote to approve another caller's invocation request. Therefore, to ensure that each participant's verification or voting rights match the amount of data they contributed during model training, the ratio of the amount of training data for each participant in the third training dataset (which is equal to the amount of training data for each participant in the fourth training dataset) to the amount of training data in the first training dataset for each participant can be equal among multiple participants. In other words, an equal proportion of data can be extracted from the training data provided by each participant for watermarking. Therefore, in the verification or voting process described later, participants who provide more training data will have a greater proportion of verification or voting rights.

[0064] According to another embodiment of this specification, Figure 4 As shown, after obtaining the watermarked training dataset based on all first training datasets of one or more participants, the training method may further include:

[0065] Step S132: Return the watermark training sub-data derived from the training data of each participant in the watermark training data to the corresponding participant.

[0066] Specifically, when the training data provided by each participant includes both a feature portion and a corresponding label portion, the entire feature portion of the watermark training data from each participant can be returned to the corresponding participant as watermark training sub-data. Alternatively, when the feature portions of the training data provided by different participants differ, the features from each participant within the feature portion of the watermark training data can be extracted and returned to the corresponding participant as watermark training sub-data. Participants can use the watermark training sub-data received from the Verifiable Computing Engine Platform as their watermark verification data. During subsequent calls to the machine learning model, if a participant needs to verify their identity or consent to another caller's invocation of the machine learning model, they can transmit their watermark verification data to the Verifiable Computing Engine Platform for verification or voting. Because the watermark training sub-data is returned to each participant, no participant can access another participant's watermark training sub-data for verification or voting, effectively ensuring model security and meeting the verification or voting needs of different participants. Furthermore, to prevent leakage of the watermark training sub-data during transmission and ensure its security, the Verifiable Computing Engine Platform can also encrypt or perform other transformations on the watermark training sub-data before transmitting it to the corresponding participant.

[0067] In some embodiments, the ratio of the number of training data for each participant in the third training dataset to the number of training data in the first training dataset for that participant can be determined in advance by mutual agreement among the participants. For example, the ratio can be in the range of 5% to 35%. In specific examples, the ratio can be 10%, 20%, or 30%.

[0068] When merging the fourth training dataset with at least a portion of the second training dataset into a watermarked training dataset, in some embodiments, to maximize the retention of the training data provided by each participant for model training, the fourth training dataset may be merged with the complete second training dataset to generate a watermarked training dataset. Alternatively, in some embodiments, to avoid the merged watermarked training dataset being too large, thereby increasing training costs and reducing training efficiency, the fourth training dataset may be merged with a portion of the second training dataset into a watermarked training dataset.

[0069] return Figure 2 , the training method may also include:

[0070] Step S150: Perform training based on the watermarked training data set in a trusted execution environment to generate a machine learning model.

[0071] During the training process of a machine learning model, a linear / nonlinear model can be fitted based on the distribution or label of the data to achieve an effect close to the true value. Furthermore, after training, the same data can be predicted based on the obtained linear / nonlinear model to obtain corresponding prediction results. This prediction process can be used for the identity verification of participants as described later. The machine learning model trained based on the watermarked training dataset can recognize watermark verification data. That is, when the watermark verification data is input into the machine learning model, the machine learning model will output a watermark label for use in verification or voting in subsequent model calls.

[0072] In another embodiment of this specification, Figure 5 As shown, after training based on the watermarked training data set to generate a machine learning model, the training method may further include:

[0073] Step S171, in a trusted execution environment, encrypting the machine learning model using a public key to generate a ciphertext model; and

[0074] Step S173: Return the ciphertext model to each of the one or more participants, so that the corresponding participant can store the ciphertext model locally.

[0075] In this embodiment, by encrypting the machine learning model to generate a ciphertext model and returning the ciphertext model to each of one or more participants for local storage, the verifiable computing engine platform itself need not store the machine learning model or the ciphertext model, thereby conserving storage resources on the verifiable computing engine platform. Furthermore, neither the plaintext machine learning model nor the participants themselves are involved in the transmission process, thereby ensuring the security of the model. When the machine learning model is needed, the participant can transmit its ciphertext model to the verifiable computing engine platform and decrypt it within the verifiable computing engine platform's trusted execution environment, as will be explained in detail later.

[0076] In some embodiments, each participant's matching public key for encryption and private key for decryption can be generated in a trusted execution environment in a verifiable computing engine platform. In addition, in some embodiments, the private key can be stored in the trusted execution environment. In this way, when the machine learning model needs to be used, the received ciphertext model can be decrypted using the stored private key in the trusted execution environment to obtain the machine learning model, and the machine learning model can be run in the trusted execution environment, thereby avoiding a participant or caller from directly contacting the machine learning model, thereby better ensuring the security of the machine learning model. In some embodiments, the encryption of the machine learning model and the decryption of the ciphertext model can both be performed in a trusted execution environment, so the public keys and private keys corresponding to multiple participants can be the same to save key resources and ensure security. Alternatively, in some embodiments, the matching public keys and private keys of multiple participants can also be different from each other.

[0077] In some embodiments, each participant's matching public and private keys can be generated based on the RSA algorithm. The RSA algorithm is a cryptographic algorithm that uses different public and private keys, making it computationally infeasible to derive the private key from a known public key. This algorithm is highly resistant to various attacks and offers excellent security. It will be appreciated that in other embodiments, other key algorithms can be used to generate the public key and matching private key.

[0078] Furthermore, if Figure 6 As shown, in yet another embodiment of this specification, the training method may further include:

[0079] Step S190: In the trusted execution environment, the watermark recognition accuracy of the machine learning model on the watermark test data with the watermark label is tested and recorded.

[0080] Specifically, in a trusted execution environment, the watermark recognition accuracy of the machine learning model can be separately tested and recorded based on the watermark test data. This watermark recognition accuracy can be used in the method for calling the machine learning model described below. In some embodiments, the watermark test data can include a characteristic portion of the watermark training data in the watermarked training dataset.

[0081] In the training method of the machine learning model provided in one or more embodiments of this specification, the machine learning model is trained based on a watermarked training data set with a watermark label, thereby obtaining a machine learning model that can identify watermark verification data, which provides a basis for the mining, circulation and evaluation of the value of data, and helps to better realize and protect the value of data and models.

[0082] In addition, one or more embodiments of this specification also propose a method for calling a machine learning model, wherein the machine learning model can be configured to be able to perform watermark verification, which can be used to identify whether the data to be verified is watermark verification data with a watermark label. As described above, the watermark verification data can be the characteristic part of the corresponding watermark training data. Alternatively, the watermark verification data can be data obtained by other means, such as by performing some conversion calculations on the characteristic part of the watermark training data. In some embodiments, the training method of the machine learning model described above can be used to train and generate such a machine learning model. Alternatively, other methods can be used to obtain such a machine learning model.

[0083] like Figure 7 As shown, in one embodiment of this specification, the method for calling the machine learning model may include:

[0084] Step S310: The verifiable computing engine platform obtains the call request information from the caller;

[0085] Step S330, in the trusted execution environment of the verifiable computing engine platform, using a machine learning model to perform watermark verification on the data to be verified according to the call request information; and

[0086] Step S350: When it is determined that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to the preset verification number, it is determined that the watermark verification has passed, and in a trusted execution environment, the machine learning model is run according to the calling authority assigned to the caller to generate analysis results based on the data to be analyzed provided by the caller.

[0087] The call request information may include first call request information and second call request information, wherein the first call request information is used to indicate a call request to the machine learning model as a participant, and the second call request information is used to indicate a call request to the machine learning model as a non-participant. In some embodiments, the call request information, especially the second call request information, may be published on a blockchain to reliably record calls to the machine learning model.

[0088] In one embodiment, if Figure 8 As shown, when the call request information is the first call request information, performing watermark verification on the data to be verified using a machine learning model according to the call request information may include:

[0089] Step S331: The verifiable computing engine platform obtains the ciphertext model and the data to be verified from the caller;

[0090] Step S333: decrypting the ciphertext model using the private key in the trusted execution environment to obtain the machine learning model; and

[0091] Step S335: In the trusted execution environment, each piece of data to be verified is input into the machine learning model to determine whether the data is watermark verification data with a watermark label.

[0092] That is, when a participant initiates a call request, as long as the caller can pass the participant identity verification, they can obtain certain call permissions to the machine learning model. To perform identity verification, the participant uploads the locally stored ciphertext model and the data to be verified provided by the participant to the verifiable computing engine platform. The data to be verified can be the watermark training sub-data corresponding to the participant generated based on the watermark training data in the fourth training dataset.

[0093] In some embodiments, especially when there are multiple participants, the amount of data to be verified can be determined by negotiation among the multiple participants. For example, the amount of data to be verified can be at least half the amount of watermark training data from the participant providing the smallest first training data set among the one or more participants, or can be at least half the amount of watermark training data from the participant issuing the first call request information, etc.

[0094] In some embodiments, when the caller is a participant in the model, the caller can verify the signature through the blockchain node to call the machine learning model based on the assigned calling authority. In this way, the call-related information can be recorded on the blockchain to facilitate future inspections and improve the security of the model. In addition, the machine learning model can run in a trusted execution environment, and the caller can transmit the data to be analyzed to the verifiable computing engine platform, and receive the analysis results output by the machine learning model based on the data to be analyzed from the verifiable computing engine platform. In this way, the caller itself does not directly access the machine learning model in plain text, so the security of the model can be well guaranteed. In addition, as described above, based on the verifiable computing engine platform, the caller can also confirm that the call to the machine learning model is carried out in the manner it expects, ensuring the reliability of the output analysis results.

[0095] In another embodiment, Figure 9 As shown, when the call request information is the second call request information, performing watermark verification on the data to be verified by using a machine learning model according to the call request information may include:

[0096] Step S332: the verifiable computing engine platform broadcasts the second call request information to one or more participants;

[0097] Step S334: When the verifiable computing engine platform obtains the ciphertext model from at least one of the one or more participants, the ciphertext model is decrypted using the private key in the trusted execution environment to obtain the machine learning model.

[0098] Step S336: When the verifiable computing engine platform obtains the data to be verified from at least some of the one or more participants, in the trusted execution environment, each piece of data to be verified is input into the machine learning model to determine whether the data is watermark verification data with a watermark label.

[0099] That is to say, when a call request is initiated as a non-participant, the participants of the machine learning model need to use their watermark verification data to vote to verify whether they agree to the call of the caller. The caller can make the participants agree to vote for verification by purchasing or other means. Specifically, the verifiable computing engine platform can broadcast the second call request information to all participants. When the caller and the participant confirm that the transaction of the right to call the machine learning model can continue, the corresponding participant can upload its watermark verification data to the verifiable computing engine platform for voting verification, otherwise it may not upload its watermark verification data. In some embodiments, if the training data provided by each participant includes a complete feature part and a corresponding label part, and the training data provided by different participants only have different data identifiers, then when watermark verification data greater than or equal to the preset verification number is identified, it can be considered that the call has been agreed by the participants, so the caller can call the machine learning model. In other embodiments, if the training data in the first training data sets of different participants have the same or substantially the same data identifiers, but the feature parts of the training data in the first training data sets of different participants are different, or even the corresponding label part of the machine learning model is only distributed in the training data of one or some participants, rather than distributed in the training data of all participants among multiple participants, then in the voting verification process, one or more participants (usually all participants) who can provide complete feature parts and label parts need to agree to the transaction, so that watermark verification data greater than or equal to the preset verification number is identified, and the transaction can continue.

[0100] In addition, when it is determined that the number of watermark verification data with watermark labels in the data to be verified is less than the preset verification number, or the verifiable computing engine platform fails to obtain the ciphertext model, it can be determined that the watermark verification has failed, and a call rejection message is returned to inform the caller that the call failed, and the call request information is recorded for subsequent inspection, so as to better ensure the security of the machine learning model.

[0101] In some embodiments, the verifiable computing engine platform can obtain ciphertext models from any one or more participants for watermark verification. In order to avoid resource occupation caused by repeated uploading of ciphertext models, once the verifiable computing engine platform obtains a usable ciphertext model from any participant, it can also send a signal to other participants to avoid other participants from repeatedly uploading ciphertext models. Alternatively, in some embodiments, the verifiable computing engine platform can obtain ciphertext models only from the participant who provides the largest first training data set. In this way, the call to the machine learning model can only continue if the participant who provides the most training data agrees to the call, and if the participant who provides the most training data disagrees with the caller's call, the call cannot proceed, that is, the participant who provides the most training data has greater power in deciding whether to agree to the call.

[0102] In some embodiments, the number of data to be verified may be determined by the participants in advance. For example, the number of data to be verified may be at least half of the number of watermark training data in the watermarked training dataset.

[0103] In some embodiments, before running the machine learning model according to the calling permissions assigned to the caller, the calling method may further include:

[0104] When it is determined that the watermark verification is passed, the verifiable computing engine platform obtains a ciphertext model from at least one participant among the one or more participants; and

[0105] In a trusted execution environment, the ciphertext model is decrypted using the private key to obtain the machine learning model.

[0106] In some embodiments, the verifiable computing engine platform can obtain ciphertext models from any one or more participants. To avoid resource consumption caused by repeated uploads of ciphertext models, once the verifiable computing engine platform obtains a usable ciphertext model from any participant, it can also send a signal to other participants to prevent them from repeatedly uploading ciphertext models. Alternatively, in some embodiments, the verifiable computing engine platform can obtain the ciphertext model from the participant that provides the largest watermarked training dataset.

[0107] The decryption of the ciphertext model and the execution of the resulting machine learning model can both be performed within a trusted execution environment. The caller can upload the data to be analyzed to the verifiable computing engine platform and receive the analysis results generated by the machine learning model based on the data to be analyzed from the verifiable computing engine platform. This prevents the caller or other participants from directly accessing the machine learning model, helping to better ensure the security of machine learning. Furthermore, as mentioned above, based on the verifiable computing engine platform, the caller can confirm that the call to the machine learning model is carried out in the manner they expect, ensuring the reliability of the output analysis results.

[0108] In some embodiments, the preset number of verifications can be determined based on at least the watermark recognition accuracy of the machine learning model. For example, if the participants agree that each verification requires all participants to provide at least 100 pieces of watermark verification data in total for verification to pass, and the watermark recognition accuracy of the machine learning model obtained through testing is 95%, then the preset number of verifications can be 100*95%=95 pieces, that is, when the machine learning model determines that there are at least 95 pieces of watermark verification data with watermark tags in the data to be verified, the watermark verification will pass.

[0109] In some embodiments, in order to avoid possible attack risks caused by malicious callers frequently calling the machine learning system, and / or to help realize customizable transactions for calling rights, calling rights can be limited. For example, calling rights can be the right to call the machine learning model a preset number of times within a preset time period after passing the watermark verification. It is understandable that calling rights can also have other specific forms. If the call to the machine learning model exceeds the calling rights, the caller who initiates the call as a participant can obtain new calling rights by re-verifying the identity, and the caller who initiates the call as a non-participant can obtain new calling rights by re-purchasing, etc., so that participants can vote for verification. It is understandable that the caller can also obtain new calling rights through other agreed methods, which are not limited here.

[0110] In some embodiments, the participant-related information of the machine learning model can be stored on the blockchain. The participant-related information may include at least one of the hash value of the watermark training data from each participant, the number of watermark training data from each participant, and the participant identity of each participant. This information can help determine each participant's contribution to the training of the machine learning model. In a specific example, the watermark training data of each participant can be MD5 hashed to obtain a 128-bit hash value, and then this hash value can be stored on the blockchain to form an NFT. Accordingly, the calling method may also include:

[0111] After watermark verification, corresponding benefits are distributed to each of one or more participants based on the participant-related information recorded on the blockchain.

[0112] Based on the calling method of the machine learning model described above, the caller can call the machine learning model. During the calling process, the caller itself does not directly contact the machine learning model, thereby effectively ensuring the security of the data and model. In addition, the calling method in one or more embodiments of this specification solves the problem that the plaintext machine learning model, which is an important data asset, cannot be circulated freely, so that other callers other than the participants can also call the machine learning model, thereby better exploring the value of the data and model, and also helping participants to obtain more benefits under the premise of ensuring data security.

[0113] One or more embodiments of this specification also provide a machine learning system, such as Figure 1 As shown, the machine learning system may include a verifiable computing engine platform 910, which may include:

[0114] The first communication unit 911 may be configured to obtain call request information from the caller;

[0115] A verification unit 912 is provided in the trusted execution environment of the verifiable computing engine platform 910 and can be configured to perform watermark verification on the data to be verified using a machine learning model according to the call request information, wherein the machine learning model is configured to be able to perform watermark verification, and the watermark verification is used to identify whether the data to be verified is watermark verification data with a watermark tag;

[0116] an allocating unit 913 , which may be configured to allocate calling rights to the caller; and

[0117] The model running unit 914 can be set in a trusted execution environment and configured to run the machine learning model to implement the caller's call to the machine learning model.

[0118] Furthermore, if Figure 1 As shown, the verifiable computing engine platform 910 may further include at least one of the following:

[0119] A testing unit 915 , which may be provided in a trusted execution environment and configured to test the watermark recognition accuracy of the machine learning model on watermark test data having a watermark label;

[0120] A key unit 916, which may be provided in a trusted execution environment and configured to generate a public key for encrypting the machine learning model to generate a ciphertext model, and a private key matching the public key for decrypting the ciphertext model to generate a machine learning model; and

[0121] The storage unit 917 may be provided in a trusted execution environment and configured to store a private key and / or record a watermark recognition accuracy rate.

[0122] like Figure 1 As shown, the machine learning system may further include one or more participating devices 920, each of which is disposed in a one-to-one correspondence at a local location of a participant corresponding to the participating device 920, and each of which may include:

[0123] The second communication unit 921 may be configured to communicate with the first communication unit 911 to transmit at least one of the first training data set, the ciphertext model, the data to be verified, the data to be analyzed, and the analysis result.

[0124] Furthermore, if Figure 1 As shown, the machine learning system may further include a blockchain 930 having one or more nodes 931, wherein the one or more nodes 931 may record at least one of the call request information of the machine learning model and the participant-related information.

[0125] One or more embodiments of this specification also propose a non-transitory computer-readable storage medium, on which computer instructions can be stored. When the computer instructions are executed by a processor, the steps of the training method or calling method of the machine learning model as described above can be implemented.

[0126] The non-transitory computer-readable storage medium in one or more embodiments of the present specification may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. It should be noted that the computer-readable storage medium described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0127] One or more embodiments of this specification also propose a computer program product, which may include instructions that, when executed by a processor, can implement the steps of the training method or calling method of the machine learning model as described above.

[0128] The instructions may be any set of instructions to be executed directly by one or more processors, such as machine code, or any set of instructions to be executed indirectly, such as a script. The terms "instructions," "application," "process," "steps," and "program" are used interchangeably herein. The instructions may be stored in object code format for direct processing by one or more processors, or as a script or collection of independent source code modules in any other computer language, including those interpreted on demand or compiled in advance. The instructions may include instructions that cause one or more processors to act as the various neural networks herein. The functions, methods, and routines of the instructions are explained in more detail elsewhere herein.

[0129] In one or more embodiments of the present specification, based on a verifiable computing engine platform, a machine learning training task based on a WASM virtual machine can be encapsulated and run in a WASM virtual machine. The computing task can provide an external trusted and verifiable machine learning modeling service in the form of TAPP, and the computing task can also exist in the form of TAPP. In addition, a machine learning model that can recognize watermark verification data with a watermark label is generated based on a watermarked training data set. The trained machine learning model can be distributed to each participant and stored in the form of a ciphertext model, and can only be decrypted in a trusted execution environment. In the process of calling the machine learning model, the watermark verification data can be used to verify the identity of the caller or the voting verification of the participant, and the machine learning model can be run in the trusted execution environment of the verifiable computing engine platform after passing the watermark verification. By combining the training of a highly robust watermarked machine learning model with a trusted execution environment technology that can well protect privacy, the identity of the participant can be verified, and the abnormal access of the participant to the machine learning model interface can be effectively restricted. The entire training and deployment process of a machine learning model remains a black box, with only the final analysis results in plaintext. This effectively protects against all known privacy attacks (such as side-channel attacks, membership inference attacks, and model theft attacks) from training to deployment, ensuring the security of the machine learning model. Furthermore, while ensuring data and model security, the free circulation of models is enabled, helping to fully tap and unlock the value of data and provide greater benefits to data and model owners. Furthermore, information related to model training and deployment can be stored on the blockchain, ensuring the legitimacy and reliability of transactions. Accordingly, the trained machine learning model can be treated as a non-fungible token (NFT) and circulated according to the corresponding transaction rules on the blockchain. Furthermore, the revenue generated by the circulation of machine learning models can incentivize data owners, especially those with big data, to build better machine learning models, thereby increasing the value of their data and generating more revenue, thus forming a virtuous cycle.

[0130] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using physical hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly performed using software called a "logic compiler." This is similar to the software compilers used during program development. Before compilation, the original code must be written in a specific programming language, called a Hardware Description Language (HDL). There are many types of HDL, including ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that simply by programming a method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0131] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the memory control logic. Those skilled in the art will also appreciate that, in addition to implementing the controller purely in computer-readable program code, the controller can also be implemented in the form of logic gates, switches, an application-specific integrated circuit, a programmable logic controller, an embedded microcontroller, etc. by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the means for implementing the various functions included therein can also be considered as structures within the hardware component. Alternatively, the means for implementing the various functions can be considered both a software module implementing the method and a structure within the hardware component.

[0132] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude that with the future development of computer technology, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, an in-vehicle human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0133] Although one or more embodiments of this specification provide method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is only one way of executing the steps among many, and does not represent the only execution order. When a device or terminal product is actually executed, the method sequence shown in the embodiments or figures can be executed sequentially or in parallel (for example, in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, product, or device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, product, or device. Without further limitation, it does not exclude the presence of other identical or equivalent elements in the process, method, product, or device that includes the elements. For example, if words such as first and second are used to indicate names, they do not indicate any particular order.

[0134] For the convenience of description, the above devices are described in terms of functions divided into various modules. Of course, when implementing one or more of the present specifications, the functions of each module can be implemented in the same or multiple software and / or hardware, or the module that implements the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0135] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0136] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0137] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0138] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0139] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0140] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0141] Those skilled in the art will appreciate that one or more embodiments of this specification may be provided as methods, systems, or computer program products. Thus, one or more embodiments of this specification may take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0142] One or more embodiments of this specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. One or more embodiments of this specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In distributed computing environments, program modules may be located in local and remote computer storage media, including storage devices.

[0143] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between the various embodiments can be referenced across them. Each embodiment focuses on the differences from the other embodiments. In particular, since the system embodiments are generally similar to the method embodiments, their description is relatively simple. For relevant parts, reference can be made to the description of the method embodiments. Throughout this specification, reference to the terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and integrate the different embodiments or examples, and features of different embodiments or examples, described in this specification, without conflict.

[0144] The foregoing is merely an example of one or more embodiments of this specification and is not intended to limit the one or more embodiments of this specification. It will be apparent to those skilled in the art that various modifications and variations may be made to one or more embodiments of this specification. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this specification shall be included within the scope of the claims.

Claims

1. A method for training a machine learning model, comprising: Obtaining, by the verifiable computing engine platform, a first training data set including training data for each of the one or more participants; In a trusted execution environment of the verifiable computing engine platform, obtaining a watermarked training dataset based on all first training datasets of the one or more participants, wherein the watermarked training dataset includes watermarked training data with a watermark label and training data without a watermark label; and In the trusted execution environment, training is performed based on the watermarked training data set to generate the machine learning model, The step of obtaining a watermarked training dataset based on all first training datasets of the one or more participants includes: merging all first training datasets of the one or more participants to generate a second training dataset; extracting a third training dataset from the second training dataset, wherein the third training dataset is a non-empty proper subset of the second training dataset, and the third training dataset includes training data from each of the one or more participants; generating a fourth training data set based on the third training data set, wherein a feature portion of each piece of training data in the fourth training data set is generated by watermarking the feature portion of the corresponding training data in the third training data set, and a label portion of each piece of training data in the fourth training data set is generated by modifying the label portion of the corresponding training data in the third training data set into a watermark label; and The fourth training dataset and at least a portion of the second training dataset are combined into the watermarked training dataset.

2. The training method according to claim 1, after obtaining the watermarked training dataset based on all first training datasets of the one or more participants, the training method further comprises: The watermark training sub-data derived from the training data of each participant in the watermark training data are returned to the corresponding participants respectively.

3. The training method according to claim 1, after performing training based on the watermarked training dataset to generate the machine learning model, the training method further comprises: In the trusted execution environment, encrypting the machine learning model using a public key to generate a ciphertext model; as well as The ciphertext model is returned to each of the one or more participants respectively, so that the corresponding participant can store the ciphertext model locally.

4. The training method according to claim 3, wherein: Matching public and private keys for each participant are generated in the trusted execution environment, and the private key is stored in the trusted execution environment.

5. The training method according to claim 3, wherein: Each participant's matching public and private keys are generated based on the RSA algorithm.

6. The training method according to claim 1, wherein: Merging all first training datasets of the one or more participants to generate a second training dataset includes: Merging the training data of each of the one or more participants with the same or corresponding data identifier into a same piece of training data in the second training data set, and treating the training data of each of the one or more participants with different and non-corresponding data identifiers as different pieces of training data in the second training data set; and The feature part and the label part of each piece of training data in the second training data set are arranged in the same manner.

7. The training method according to claim 1, wherein: Extracting a third training data set from the second training data set includes: Using a participant identification identifier corresponding to each participant, labeling all training data in the first training data set of the corresponding participant; and Part of the training data in the second training data set is extracted based on the participant identity as the training data in the third training data set, so that the third training data set includes training data from each participant of the one or more participants.

8. The training method according to claim 7, wherein: When there are multiple participants, among the multiple participants, the ratio of the number of training data of each participant in the third training dataset to the number of training data in the first training dataset of the participant is equal to each other.

9. The training method according to claim 7, wherein: A ratio of the number of training data of each participant in the third training dataset to the number of training data of the participant in the first training dataset is in a range from 5% to 35%.

10. The training method according to claim 7, wherein: The training data of each participant in the third training data set is randomly extracted from the first training data set of the participant.

11. The training method according to claim 1, wherein: The feature portion of each piece of training data in the fourth training data set is generated by performing watermarking processing on the feature portion of the corresponding training data in the third training data set, including: superimposing the noise with the characteristic portion of the training data in the third training data set, and using the superimposed result as the characteristic portion of the corresponding training data in the fourth training data set; The dimension of the noise, the dimension of the characteristic portion of the training data in the third training data set, and the dimension of the characteristic portion of the training data in the fourth training data set are equal to each other.

12. The training method according to claim 11, wherein: Noise includes noise generated based on non-training data; or Noise includes noise generated by image adversarial algorithms; or Noise includes Gaussian noise.

13. The training method according to claim 1, wherein: When the machine learning model is a classification model, the watermark label is set to a label corresponding to the watermark type.

14. The training method according to claim 1, wherein: When the machine learning model is a regression model, the watermark label is set to a label corresponding to the minimum output value or the maximum output value of the machine learning model.

15. The training method according to claim 1, wherein: The machine learning model includes a multi-party learning model or a deep learning model.

16. The training method according to claim 1, after generating the machine learning model, further comprising: In the trusted execution environment, the watermark recognition accuracy of the machine learning model on the watermark test data with the watermark label is tested and recorded.

17. A method for calling a machine learning model, wherein: The machine learning model is configured to be capable of performing watermark verification, the machine learning model is trained and generated by the training method according to any one of claims 1 to 16, the watermark verification is used to identify whether the data to be verified is watermark verification data with a watermark label, and the calling method includes: The verifiable computing engine platform obtains the call request information from the caller; In the trusted execution environment of the verifiable computing engine platform, using the machine learning model to perform watermark verification on the data to be verified according to the call request information; and When it is determined that the number of watermark verification data with watermark labels in the data to be verified is greater than or equal to the preset verification number, it is determined that the watermark verification has passed, and in the trusted execution environment, the machine learning model is run according to the calling authority assigned to the caller to generate an analysis result based on the data to be analyzed provided by the caller.

18. The calling method according to claim 17, wherein: The watermark verification data is the characteristic part of the corresponding watermark training data.

19. The calling method according to claim 17, wherein: When the caller requests to call the machine learning model as a participant, the call request information is the first call request information.

20. The calling method according to claim 19, wherein: When the call request information is first call request information, performing watermark verification on the data to be verified by using the machine learning model according to the call request information includes: The verifiable computing engine platform obtains the ciphertext model and the data to be verified from the caller; In the trusted execution environment, decrypting the ciphertext model using a private key to obtain the machine learning model; and In the trusted execution environment, each piece of data to be verified is input into the machine learning model to determine whether the data is watermark verification data with a watermark label.

21. The calling method according to claim 19, wherein: The number of data to be verified is at least half the number of watermark training data originating from a participant providing a smallest first training data set among the one or more participants.

22. The calling method according to claim 17, wherein: When the caller requests to call the machine learning model as a non-participant, the call request information is second call request information.

23. The calling method according to claim 22, wherein: When the call request information is the second call request information, performing watermark verification on the data to be verified by using the machine learning model according to the call request information includes: The verifiable computing engine platform broadcasts the second call request information to the one or more participants; When the verifiable computing engine platform obtains the ciphertext model from at least one of the one or more participants, decrypting the ciphertext model using the private key in the trusted execution environment to obtain the machine learning model; When the verifiable computing engine platform obtains the data to be verified from at least some of the one or more participants, in the trusted execution environment, each piece of data to be verified is input into the machine learning model respectively to determine whether the data is watermark verification data with a watermark label.

24. The calling method according to claim 23, wherein: The verifiable computing engine platform obtains the ciphertext model only from a participant that provides the largest first training data set among the one or more participants.

25. The calling method according to claim 23, wherein: The number of data to be verified is at least half the number of watermarked training data in the watermarked training dataset.

26. The calling method according to claim 22, wherein: Before running the machine learning model according to the calling permission assigned to the caller, the calling method further includes: When it is determined that the watermark verification is successful, the verifiable computing engine platform obtains a ciphertext model from at least one of the one or more participants; and In the trusted execution environment, the ciphertext model is decrypted using a private key to obtain the machine learning model.

27. The calling method according to claim 17, wherein: The preset verification number is determined at least based on the watermark recognition accuracy of the machine learning model.

28. The calling method according to claim 17, wherein: The calling permission is the permission to call the machine learning model a preset number of times within a preset time period after passing the watermark verification.

29. The calling method according to claim 17, wherein: The call request information is published on the blockchain.

30. The calling method according to claim 17, further comprising: When it is determined that the number of watermark verification data with watermark labels in the data to be verified is less than the preset verification number, or the verifiable computing engine platform fails to obtain the ciphertext model, it is determined that the watermark verification has not passed, and a call rejection message is returned and the call request information is recorded.

31. The calling method according to claim 17, wherein: The participant-related information of the machine learning model is stored on the blockchain, and the calling method further includes: After watermark verification, corresponding benefits are allocated to each of the one or more participants based on the participant-related information recorded on the blockchain.

32. The calling method according to claim 31, wherein: The participant-related information includes at least one of the following: The hash value of the watermarked training data from each participant; The amount of watermarked training data from each participant; and The participant identifier for each participant.

33. A machine learning system comprising a verifiable computing engine platform, the verifiable computing engine platform comprising: a first communication unit, configured to obtain call request information from a caller; a verification unit, the verification unit being provided in a trusted execution environment of the verifiable computing engine platform, and the verification unit being configured to perform watermark verification on the data to be verified using the machine learning model according to the call request information, wherein the machine learning model is configured to be able to perform watermark verification, the machine learning model being trained and generated by the training method according to any one of claims 1 to 16, and the watermark verification being used to identify whether the data to be verified is watermark verification data having a watermark label; an allocating unit, configured to allocate a calling right to the caller; and A model running unit is provided in the trusted execution environment, and the model running unit is configured to run the machine learning model.

34. The machine learning system of claim 33, wherein the verifiable computing engine platform further comprises at least one of the following: a testing unit, the testing unit being provided in the trusted execution environment and configured to test the watermark recognition accuracy of the machine learning model on watermark test data having a watermark label; a key unit, the key unit being provided in the trusted execution environment and configured to generate a public key for encrypting the machine learning model to generate a ciphertext model, and a private key matching the public key and for decrypting the ciphertext model to generate the machine learning model; as well as A storage unit is provided in the trusted execution environment, and the storage unit is configured to store a private key and / or record a watermark recognition accuracy rate.

35. The machine learning system of claim 33, further comprising one or more participating devices, each of the one or more participating devices being disposed locally at a participant corresponding thereto in a one-to-one correspondence, and each of the one or more participating devices comprising: A second communication unit is configured to communicate with the first communication unit to transmit at least one of the first training data set, the ciphertext model, the data to be verified, the data to be analyzed, and the analysis result.

36. The machine learning system of claim 33, further comprising a blockchain having one or more nodes, wherein: The one or more nodes record at least one of the call request information of the machine learning model and the participant-related information.

37. A non-transitory computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the training method according to any one of claims 1 to 16 or the calling method according to any one of claims 17 to 32.

38. A computer program product comprising computer instructions, which, when executed by a processor, implement the steps of the training method according to any one of claims 1 to 16 or the calling method according to any one of claims 17 to 32.

Images