A model training method and a multi-party secure computing system

Abstract

The embodiment of the present application provides a kind of model training method and multi-party secure computing system.The method in it includes: active party calculates first matrix Z according to sample data subset X1, and sends to each passive party via ciphertext computing platform;Active party calculates second matrix and sends to ciphertext computing platform;The i-1th passive party calculates third matrix according to sample data subset X i And first matrix Z, and sends to ciphertext computing platform;Ciphertext computing platform calculates the model parameter w i Of the i-1th passive party and sends to the i-1th passive party;The i-1th passive party calculates fourth matrix and sends to ciphertext computing platform;Ciphertext computing platform carries out the merging of fourth matrix, obtains merging matrix and sends to active party;Active party calculates its model parameter w1 according to sample data subset X1 and merging matrix.The embodiment of the present application can improve the efficiency of multi-party joint training linear regression model.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of multi-party secure computation, and in particular to a model training method and a multi-party secure computation system. BACKGROUND

[0002] Machine learning is one of the most important breakthroughs in the field of artificial intelligence in the past decade. It has achieved great success in many fields such as speech recognition, natural language processing, computer vision, image and video analysis, multimedia, etc.

[0003] Linear regression model is a mathematical regression model for determining the correlation between variables. The model parameters of the linear regression model can be solved according to the training data, so as to train the linear regression model.

[0004] When the training data of the training model comes from different data providers, the data of multiple parties needs to be fused to solve the linear regression model. In the process of fusing the data of multiple parties, directly collecting the original data for centralized solving faces the risk of data security and privacy leakage. If the linear regression model is trained based on the ciphertext calculation method, although the privacy and security of the data can be protected, as the scale of the training data increases, a large amount of computing, storage and communication overheads are consumed, which cannot be applied to large-scale machine learning scenarios. SUMMARY

[0005] The embodiments of the present application provide a model training method and a multi-party secure computation system, which can improve the efficiency of multi-party joint training of linear regression model and expand the scale of linear regression model.

[0006] To solve the above problems, the embodiments of the present application disclose a model training method, which is applied to a multi-party secure computation system, the multi-party secure computation system includes a ciphertext calculation platform and k data providers, k is an integer greater than 1, the k data providers include one active party and k-1 passive parties, the method is suitable for the scenario that the sample data set relied by the training of linear regression model is distributed vertically in the k data providers, the sample data set is m is the number of samples, n is the number of features of the sample, and the sample data subsets held by the k data providers are respectively n=n1+n2+…+nk, the data label corresponding to the sample data set is held by the active party, and the data label is The method comprises the following steps:

[0007] The active party calculates a first matrix Z=UE according to the held sample data subset X1, and sends the first matrix Z to each passive party through the ciphertext calculation platform, wherein I n is a unit matrix, U is a matrix composed of left singular vectors obtained by singular value decomposition on the sample data subset X1;

[0008] The active party calculates a second matrix according to the first matrix Z and the held data label Y, and sends the second matrix to the ciphertext calculation platform;

[0009] The i-1th passive party calculates a third matrix i according to the held sample data subset X and the received first matrix Z, and sends the third matrix to the ciphertext calculation platform, where i is an integer from 2 to k;

[0010] The ciphertext calculation platform calculates the model parameter w i of the i-1th passive party according to the received second matrix and the third matrix , and sends the model parameter w i of the i-1th passive party to the i-1th passive party;

[0011] The i-1th passive party calculates a fourth matrix i according to the held sample data subset X i and the received model parameter w , and sends the fourth matrix to the ciphertext calculation platform;

[0012] The ciphertext calculation platform combines the received fourth matrix to obtain a combined matrix , and sends the combined matrix to the active party;

[0013] The active party calculates the model parameter of the active party according to the held sample data subset X1 and the received combined matrix

[0014] In another aspect, the embodiment of the present application discloses a multi-party secure calculation system, the multi-party secure calculation system comprises a ciphertext calculation platform and k data providers, k is an integer greater than 1, the k data providers comprise one active party and k-1 passive parties, the multi-party secure calculation system is suitable for a scenario that sample data sets relied on by a linear regression model are longitudinally distributed in k data providers, and the sample data sets are m is the number of samples, n is the number of characteristics of the samples, and the sample data subsets held by the k data providers are respectively n = n1 + n2 + … + nk, the data label corresponding to the sample data set is held by the active party, and the data label is wherein,

[0015] The active party is configured to calculate a first matrix Z = UE according to the held sample data subset X1, and send the first matrix Z to each passive party via the ciphertext calculation platform, wherein, I n is a unit matrix, and U is a matrix composed of left singular vectors obtained by singular value decomposition on the sample data subset X1;

[0016] The active party is further configured to calculate a second matrix according to the first matrix Z and the held data label Y, and send the second matrix to the ciphertext calculation platform;

[0017] The i-1th passive party in the passive parties is configured to calculate a third matrix i according to the held sample data subset X and the received first matrix Z, and send the third matrix to the ciphertext calculation platform, wherein i is 2 to k;

[0018] The ciphertext calculation platform is configured to calculate the model parameter w of the i-1th passive party according to the received second matrix and the third matrix i , and send the model parameter w i of the i-1th passive party to the i-1th passive party;

[0019] The i-1th passive party is further configured to calculate a fourth matrix i according to the held sample data subset X i and the received model parameter w , and send the fourth matrix to the ciphertext calculation platform;

[0020] The ciphertext calculation platform is further configured to merge the received fourth matrix to obtain a merged matrix , and send the merged matrix to the active party;

[0021] The active party is further configured to calculate the model parameter of the active party according to the held sample data subset X1 and the received merged matrix

[0022] In yet another aspect, an embodiment of the present application discloses an apparatus for model training, comprising a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by one or more processors of the apparatus, and the one or more programs contain instructions for performing the model training method according to one or more of the preceding aspects.

[0023] In yet another aspect, an embodiment of the present application discloses a machine readable medium having instructions stored thereon, which when executed by one or more processors of an apparatus, cause the apparatus to perform the model training method according to one or more of the preceding aspects.

[0024] Embodiments of the present application include the following advantages:

[0025] Embodiments of the present application improve the training process of the linear regression model. The singular value decomposition is performed on the sample data subset X1 held by the active party, and the first matrix of size m*n is calculated according to the result of the singular value decomposition, so that the size of the calculation matrix is reduced from m*m to m*n during the whole training process. Wherein, m is the sample number, and n is the feature number. In practical application, the feature number n is usually much smaller than the sample number m. For example, the sample data set includes 1 million bank sample data, and the feature number is at most several tens or hundreds. Embodiments of the present application reduce the space complexity of training the linear regression model from m*m to m*n, greatly reduce the space complexity, and further reduce the calculation and communication overhead, improve the calculation efficiency, thereby improve the efficiency of the multi-party joint training of the linear regression model, and expand the scale of the linear regression model. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the description of the embodiments of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0027] Figure 1 is a step flow chart of an embodiment of a model training method of the present application;

[0028] Figure 2 is a structural block diagram of an embodiment of a multi-party secure computing system 200 of the present application;

[0029] Figure 3 is a block diagram of an apparatus 800 for model training of the present application;

[0030] Figure 4is a structural schematic diagram of a server in some embodiments of the present application. DETAILED DESCRIPTION

[0031] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the protection scope of the present application.

[0032] The terms "first", "second", and the like in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally a class, not limited to the number of objects, for example, the first object can be one or more. In addition, the term "and / or" in the specification and claims is used to describe the relationship between the associated objects, which means that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone. The character " / " generally represents an "or" relationship between the associated objects before and after it. The term "multiple" in the embodiments of the present application means two or more, and other quantifiers are similar.

[0033] The model training method provided by the embodiments of the present application can be used to train a linear regression model. The linear regression model can be a univariate linear regression model or a multivariate linear regression model. In addition, the linear regression model can be a linear regression model including a constant term or a linear regression model not including a constant term, and the embodiments of the present application do not limit this.

[0034] The model training method of the embodiments of the present application can be applied to the scenario that the sample data set relied on by the linear regression model is longitudinally distributed in multiple data providers. It is assumed that the sample data set relied on by the linear regression model is longitudinally distributed in k data providers, k is an integer greater than 1, in other words, the k data providers each locally hold part of the sample data set relied on by the linear regression model, which can be regarded as a data subset obtained by longitudinally dividing the sample data set relied on by the linear regression model. Further, the sample data subsets held by the k data providers are data subsets of the same sample data set in different feature dimensions. For example, the sample data subset held by the data provider 1 is the height data of user A; the sample data subset held by the data provider 2 is the weight data of user A; the sample data subset held by the data provider 3 is the hairstyle data of user A; and so on.

[0035] The model training method of the embodiment of the present application can be applied to a multi-party secure computing system, the multi-party secure computing system comprising a ciphertext computing platform and k data providers, k being an integer greater than 1, the k data providers comprising 1 active party and k-1 passive parties. The ciphertext computing platform is deployed with a ciphertext computing engine, which can perform ciphertext computation based on a multi-party secure computing protocol, which can include pure ciphertext operation or mixed operation of plaintext and ciphertext. Each data provider is deployed with a plaintext computing engine, which can perform plaintext operation, and the data providers can include 2 or more. Further, the multi-party secure computing system can further comprise a result demander, which can be one or more of the data providers or other participants independent of the data providers, and the embodiment of the present application does not limit this.

[0036] Each sample data in the sample data set corresponds to a respective label, which can be obtained by labeling the sample data, and the embodiment of the present application refers to a set composed of labels corresponding to all sample data in the sample data set as a data label corresponding to the sample data set. The data label can be held by one of the k data providers. In order to facilitate subsequent distinction, the embodiment of the present application refers to the data provider holding the data label as an active party, and refers to the other data providers as passive parties. In the embodiment of the present application, the active party is one, and the passive parties can include at least one.

[0037] The linear regression model is trained, that is, the solution of the linear regression model is solved. If the sample data set of the linear regression model is denoted as X, the data label is denoted as Y, and the model parameter is denoted as w, the solution of the linear regression model is solved. (X represents that X is an m×n matrix belonging to the real number field), the data label is (Y represents that Y is an m×1 matrix belonging to the real number field), and the model parameter is (W represents that W is an n×1 matrix belonging to the real number field). The loss function of the linear regression model is the sum of squares of residuals of the predicted points Xw on the sample regression line and the data label Y, and the loss function L(w) is as follows:

[0038] L(w)=(Y-Xw) T (Y-Xw)

[0039] Solving the solution of the linear regression model needs to find the model parameter that minimizes the loss function, that is, the sum of squares of residuals. For the loss function of linear regression, the derivative is taken and the derivative is set to zero to obtain the normal equation group as follows:

[0040] X T (Y-Xw)=0 (1)

[0041] Thus, the ordinary least squares estimation of the model is:

[0042] W=(X T X) -1 (X T Y)

[0043] wherein, (X T X) -1 is the inverse operation of the result of X T X.

[0044] When the sample data set relied on by the training of the linear regression model is distributed longitudinally in multiple data providers, assuming that the data providers are k, k is an integer greater than 1, and the sample data set is wherein, m is the sample size, n is the feature number of the sample, and the sample data subsets held by each data provider are respectively X=[X1,X2,…,X k ], n=n1+n2+...+nk. Exemplarily, the sample data subset held by the active party is X1, the sample data subset held by the first passive party is X2, the sample data subset held by the second passive party is X3, and so on, and the sample data subset held by the k-1th passive party is X k . Correspondingly, the model parameters that can be trained by each data provider are respectively: Based on the sample data subsets held by each data provider, the multiple data providers jointly train the linear regression model according to the block least squares estimation method of the linear regression model (hereinafter referred to as the multi-party joint training linear regression model), and each data provider obtains the model parameters of each data provider.

[0045] To ensure the data privacy and security of each data provider, each data provider can perform local plaintext calculation based on the sample data subset held locally, obtain the intermediate results required for the next calculation, and send the ciphertext of the intermediate results to the ciphertext calculation platform. The ciphertext calculation platform can process the intermediate results based on the ciphertext, obtain the intermediate results required for the next calculation, and distribute them to each data provider, and each data provider performs the next local plaintext calculation. After several rounds of calculation and interaction, the model parameters of the trained linear regression model can be obtained.

[0046] Based on the above idea, the following derivation can be made to determine the calculation method of the model parameters corresponding to each data provider. For ease of illustration, two data providers are taken as an example. The two data providers include an active party and a passive party. The active party holds the sample data subset and the data label The model parameter that needs to be trained by the active party is The passive party holds a sample data subset The model parameters required by the passive party to train are

[0047] From the above formula (1), it can be deduced that

[0048] X T Xw=X T Y (2)

[0049] Substitute the sample data subset held by each of the two data providers and the model parameters required by each of the two data providers to train into the above formula (2), and the following formula (3) can be obtained:

[0050]

[0051] From the above formula (3), it can be deduced that

[0052]

[0053]

[0054] According to the above formulas (4) and (5), the following formula (6) can be obtained:

[0055]

[0056] Wherein, I is a unit matrix.

[0057] Let The above formula (6) can be transformed into the following formula (7):

[0058]

[0059] Substitute the above formula (7) into the above formula (4), and the following formula (8) can be obtained:

[0060]

[0061] In the process of training the model parameters w1 of the active party and the model parameters w2 of the passive party, an intermediate result M1 needs to be calculated, M1 is a matrix with a size of m*m. In the training process, the matrix M1 also needs to be transmitted between the active party and the passive party. For a medium-sized machine learning scenario, for example, 100,000 (m=100,000) sample data, the size of the matrix M1 is 10 million*10 million, that is, 10 billion numbers. In this scenario, it is difficult to realize the transmission of the matrix M1 to the passive party through a ciphertext calculation platform or other means, and the required calculation overhead, storage overhead, and communication overhead are very large, which is difficult to apply to large-scale training scenarios and is only applicable to small data training scenarios, for example, a training scenario with a few hundred to a few thousand sample data. However, the data volume of the training data is an important factor in determining the accuracy of the machine learning model, and when the data volume is small, it is difficult to guarantee the accuracy of the machine learning model.

[0062] The model training method of the embodiment of the application improves the above-mentioned federated linear regression process, so that it can be applied to large data training scenarios. The core idea of the application is to avoid generating a matrix M1 with a size of m*m and transmitting a matrix M1 with a size of m*m in the calculation process, but to generate a first matrix Z with a size of only m*n and transmit a matrix with a size of at most m*n. In practical applications, the number of features n is usually much smaller than the number of samples m. For example, a sample data set includes 1 million bank sample data, and the number of features of a sample data is at most a few tens or a few hundred, such as occupation, gender, age, education, etc. The embodiment of the application reduces the space complexity from m*m to m*n, for example, in the case of m=100,000 and n=100, the embodiment of the application can reduce the space complexity from 10 billion to 1 million, greatly reducing the space complexity, thereby reducing the calculation overhead and communication overhead, improving the calculation efficiency, thereby improving the efficiency of the multi-party joint training of the linear regression model, and expanding the size of the linear regression model.

[0063] Reference Figure 1 , a step flowchart of an embodiment of a model training method of the application is shown, the method can be applied to a multi-party secure calculation system, the multi-party secure calculation system includes a ciphertext calculation platform and k data providers, k is an integer greater than 1, the k data providers include 1 active party and k-1 passive parties, the method is applicable to the scenario that the sample data set relied on by the training of the linear regression model is distributed vertically among the k data providers, the sample data set is m is the number of samples, n is the number of features of the sample, and the sample data subsets held by the k data providers are respectively: n=n1+n2+…+nk, the data label corresponding to the sample data set is held by the active party, and the data label is The method can comprise the following steps:

[0064] Step 101, the active party calculates a first matrix Z = UEX1 according to the held sample data subset X1, and sends the first matrix Z to each passive party via the ciphertext calculation platform. I n is a unit matrix, and U is a matrix composed of left singular vectors obtained by singular value decomposition of the sample data subset X1;

[0065] Step 102, the active party calculates a second matrix according to the first matrix Z and the held data label Y, and sends the second matrix to the ciphertext calculation platform.

[0066] Step 103, an i-1th passive party calculates a third matrix i according to the held sample data subset X and the received first matrix Z, and sends the third matrix to the ciphertext calculation platform, where i is an integer from 2 to k.

[0067] Step 104, the ciphertext calculation platform calculates the model parameter w i of the i-1th passive party according to the received second matrix and the third matrix , and sends the model parameter w i of the i-1th passive party to the i-1th passive party.

[0068] Step 105, the i-1th passive party calculates a fourth matrix i according to the held sample data subset X i and the received model parameter w , and sends the fourth matrix to the ciphertext calculation platform.

[0069] Step 106, the ciphertext calculation platform combines the received fourth matrices to obtain a combined matrix , and sends the combined matrix to the active party.

[0070] Step 107, the active party calculates the model parameter of the active party according to the held sample data subset X1 and the received combined matrix

[0071] The model training method provided by the embodiment of the present application can be applied to a secure multi-party computation (MPC) system, the secure multi-party computation system can include a ciphertext computation platform and k data providers, k is an integer greater than 1. The ciphertext computation platform can provide ciphertext computation, and the k data providers can provide plaintext computation. The model training method of the embodiment of the present application trains a linear regression model in a manner of mixed plaintext and ciphertext computation by the data providers and the ciphertext computation platform.

[0072] The secure multi-party computation system is a computing system for protecting data privacy and security. Multiple participants can use the secure multi-party computation technology to perform collaborative computation without leaking their own data, and obtain a computation result. Further, the secure multi-party computation system can be a mixed plaintext and ciphertext computation system, the ciphertext computation platform is deployed with a ciphertext computation engine, the ciphertext computation engine is used to perform ciphertext computation based on a secure multi-party computation protocol, each data provider is deployed with a plaintext computation engine, the plaintext computation engine is used to perform plaintext computation, the data provided by the ciphertext computation platform to the data providers is plaintext data, and the data provided by the data providers to the ciphertext computation platform is ciphertext data.

[0073] In the process of jointly training a linear regression model by the k data providers based on the sample data subsets held by each data provider, the data providers can perform local plaintext computation based on the sample data subsets held locally by each data provider, obtain intermediate results required for next computation, encrypt the intermediate results, and send the encrypted intermediate results to the ciphertext computation platform. The ciphertext computation platform can process the intermediate results based on ciphertext, obtain intermediate results required for next computation, decrypt the intermediate results, and distribute the decrypted intermediate results to the data providers, and the data providers perform next local plaintext computation. After several rounds of computation and interaction, the model parameters of the linear regression model can be obtained.

[0074] The model training method of the embodiment of the present application can be applied to a scenario in which a sample data set relied on by a linear regression model is distributed vertically among k data providers, the sample data set is m is the number of samples, n is the number of features of the samples, the data label corresponding to the sample data set X is The sample data subsets held by the k data providers are respectively X=[X1,X2,…,X k ], n=n1+n2+…+nk. The data label is The data label Y can be held by one of the k data providers, the data provider holding the data label Y is referred to as an active party, and the other k-1 data providers are referred to as passive parties.

[0075] The active party calculates a first matrix Z=UE according to the held sample data subset X1, encrypts the first matrix Z and sends it to the ciphertext calculation platform, and then sends it to each passive party after decryption by the ciphertext calculation platform, wherein, I n is a unit matrix, and U is a matrix composed of left singular vectors obtained by singular value decomposition of the sample data subset X1.

[0076] To avoid calculating the matrix M1, the embodiment of the application first performs singular value decomposition (Singular Value Decomposition, SVD for short) on the sample data subset X1 locally at the active party.

[0077] For any matrix A, assuming that the size of the matrix A is m*n, singular value decomposition will decompose the matrix A into a form composed of singular values and singular vectors, that is, A=USV T . Wherein, the matrix U is a matrix composed of left singular vectors, the matrix V is a matrix composed of right singular vectors, and the matrix S is a diagonal matrix, the size of the matrix S is m*n, and the elements on the diagonal of the matrix S are singular values. The matrix U (size m*m) and the matrix V (size n*n) are both orthogonal matrices, that is, UU T =I, VV T =I, wherein the superscript T represents the transpose of the matrix, and the matrix I is a unit matrix.

[0078] For ease of description, the embodiment of the application mainly takes two data providers as an example for description, and the two data providers include an active party and a passive party. The active party holds a sample data subset and a data label The passive party holds a sample data subset The two data providers jointly train a linear regression model based on the sample data subsets held by each party to train the model parameter w1 of the active party and the model parameter w2 of the passive party, n=n1+n2.

[0079] In the embodiment of the application, the active party performs singular value decomposition on the sample data subset X1, and can obtain X1=USV T , and it can be verified that the following formula is established: X1 T X1=VS T U T USV T .

[0080] Due to the orthogonality of the matrices U and V, UU T =U T U=I m , VVT = V T V = I n , I is an m x n dimensional unit matrix, thus we can get:

[0081] X1 T X1= VS T SV T

[0082] According to the principle of matrix inversion, we can get:

[0083]

[0084] From the above formula (9), we can deduce that:

[0085]

[0086] According to the orthogonality of matrix V, from the above formula (10), we can deduce that:

[0087]

[0088] Since matrix and matrix S is a diagonal matrix, rank(S) = n (i.e. the rank of matrix S is n), then we can verify that the following formula is true:

[0089]

[0090] wherein, is a block matrix, and each element of the block matrix is also a matrix. The first element of the block matrix is I n , I n is an n-dimensional unit matrix, and other elements of the block matrix are all 0, that is, other elements are all 0 matrices.

[0091] Substitute the above formula (12) into the above formula (11), and let then we can get:

[0092]

[0093] From this we can get:

[0094]

[0095] Let the first matrix Z = UE, According to the above formula (14), we can get:

[0096]

[0097] Therefore, we can get:

[0098]

[0099] Therefore, in this embodiment of the invention, matrix M1 is converted into I-ZZ. T Through this transformation, the active party does not need to calculate matrix M1, but only matrix Z. Furthermore, when the active party needs to pass matrix M1 to the passive party, the active party only needs to pass matrix Z. The size of matrix M1 is m*m, while the size of matrix Z is only m*n.

[0100] When calculating w2 using the above formula (6), it is necessary to first calculate matrix M1, and then substitute matrix M1 into the above formula (6) to calculate w2. After the conversion in the embodiment of the present invention, it is not necessary to substitute M1 into the above formula (6) to calculate w2. Specifically, let the second matrix And let the third matrix The second matrix and the third matrix Substituting into equation (6) above, we can obtain:

[0101]

[0102] in:

[0103]

[0104]

[0105] The second matrix and the third matrix After substituting the model parameter w2 of the passive party into equation (17), the model parameter w1 of the active party can be obtained by substituting the obtained w2 into equation (4).

[0106] It can be seen that, in the embodiment of the present invention, matrix M1 is not needed during the training of model parameters w1 and w2; only a matrix Z of size m*n is required. When calculating the second matrix... First calculate Z. T Y, we obtain a matrix of size n*1. Then, we multiply this matrix by the first matrix Z to obtain a matrix of size m*n. Then, we calculate the third matrix... First calculate Z. T X2, obtain an n*n matrix, then multiply this n*n matrix with the first matrix Z to obtain an m*n matrix.

[0107] Through the above transformation, the maximum intermediate result required for calculation in the embodiments of the present invention is only an m*n matrix, and the maximum size of the transmitted matrix is ​​also only an m*n matrix, which greatly reduces the space complexity, thereby reducing computational and communication overhead, improving computational efficiency, thereby improving the efficiency of multi-party joint training of linear regression models, and expanding the scale of linear regression models.

[0108] The derivation process takes two data providers as an example, and the scenario of more than two data providers is similar and can be referred to each other.

[0109] Example one

[0110] Taking k(k>2) data providers as an example, the k data providers include one active party and k-1 passive parties. The active party holds a sample data subset and a data label The passive parties hold sample data subsets respectively. The k data providers jointly train a linear regression model based on the sample data subsets held by each party to train the model parameters w1 of the active party and the model parameters w2, …, w k , n=n1+n2+…+nk.

[0111] Referring to Table 1, an interactive process of jointly training a linear regression model by the k(k>2) data providers in example one is shown.

[0112] Table 1

[0113]

[0114]

[0115] It should be noted that the ciphertext calculation platform merges the received fourth matrix , which means that the ciphertext is added based on the received fourth matrix sent by each passive party. The merged matrix is obtained, that is wherein Each matrix in is a ciphertext, and each matrix in is added based on the ciphertext.

[0116] In an optional embodiment of the present application, the ciphertext calculation platform calculates the model parameter w i of the i-1th passive party according to the received second matrix and the third matrix may include:

[0117] Step S11, the ciphertext calculation platform splices the received third matrix to obtain a first spliced matrix

[0118] Step S12, the ciphertext calculation platform calculates an intermediate inverse matrix according to the first spliced matrix

[0119] Step S13: The ciphertext calculation platform calculates the ciphertext based on the first splicing matrix. The intermediate inverse matrix Z -1 and the received second matrix Calculate the second splicing matrix

[0120] Step S14: The ciphertext calculation platform will concatenate the second splicing matrix w -1 By splitting the model, we can obtain the model parameters w for the (i-1)th passive party. i .

[0121] The encrypted computation platform receives the third matrix sent by each passive party and concatenates all the received third matrices to obtain the first concatenated matrix. After obtaining the first splicing matrix Then, based on the first splicing matrix Calculate the intermediate inverse matrix Then, based on the intermediate inverse matrix Z -1 and the received second matrix Calculate the second splicing matrix Second splicing matrix w -1 This is the matrix obtained by concatenating the model parameters of each passive party, i.e., w -1 =[w2,…,w k The encrypted computing platform will concatenate the second matrix w. -1 By splitting the model, we can obtain the model parameters w for the (i-1)th passive party. i , will w i Send it to the (i-1)th passive party. For example, [w2,…,w k [Split into w2, w3, ..., w] k Assuming k = 5, there is 1 active party and 4 passive parties. Send w2 to the first passive party, w3 to the second passive party, w4 to the third passive party, and w5 to the fourth passive party.

[0122] See Table 2, which illustrates another interactive process for jointly training the linear regression model by k (k>2) data providers in Example 1.

[0123] Table 2

[0124]

[0125]

[0126]

[0127] In an optional embodiment of the present invention, the ciphertext calculation platform calculates the ciphertext based on the first splicing matrix. Calculate the intermediate inverse matrix This may include: the ciphertext calculation platform first performs calculations based on the ciphertext. Then calculate the results The ciphertext is decrypted into plaintext, and then calculations are performed based on the plaintext.

[0128] The complexity of inverting a matrix based on ciphertext in a ciphertext-based computation platform is high, which will affect the efficiency of model training. Therefore, the ciphertext computation platform in this embodiment of the invention calculates the intermediate inverse matrix. First, calculate based on the ciphertext. Then calculate the results The result (which is ciphertext) is decrypted into plaintext, and then calculations are performed based on the plaintext. Performing matrix inversion operations based on plaintext can improve computation speed and thus improve the efficiency of model training.

[0129] It should be noted that when k=2, there is only one passive party, and the ciphertext computing platform receives the third matrix sent by this single passive party. That is The first spliced ​​matrix is ​​obtained after merging. Still The calculated intermediate inverse matrix remember The calculated second concatenation matrix

[0130] In an optional embodiment of the present invention, when k=2, the data provider includes one active party and one passive party, and the passive party calculates the third matrix. Then the fifth matrix was calculated. The fifth matrix Z2 is sent to the ciphertext computing platform; the ciphertext computing platform calculates the value based on the received second matrix. and the third matrix Calculate the model parameters w for the (i-1)th passive party. i This may include: the encrypted calculation platform based on the received second matrix Third matrix And the fifth matrix Z2, calculate the model parameters of the passive side. The model parameter w2 is then sent to the passive party.

[0131] When k=2, there is only one passive party, which holds a subset of sample data X2. Let the fifth matrix be Z2, since the intermediate inverse matrix... The calculation of the fifth matrix Z2 only needs to use the sample data X2 of the passive party, and therefore, the embodiment of the application performs the calculation of the fifth matrix Z2 locally at the passive party in plaintext, which can improve the efficiency of calculating the fifth matrix Z2, thereby further improving the efficiency of model training.

[0132] Example Two

[0133] Taking two data providers as an example, the two data providers include an active party and a passive party. The active party holds a sample data subset and data labels The passive party holds a sample data subset The two data providers jointly train a linear regression model based on the sample data subsets held by the respective parties, to train the model parameter w1 of the active party and the model parameter w2 of the passive party, n = n1 + n2.

[0134] Referring to Table 3, an interaction process of the two data providers jointly training a linear regression model in Example Two is shown.

[0135] Table 3

[0136]

[0137]

[0138] In an optional embodiment of the application, the method can further include:

[0139] Step S21, the active party sends the held model parameter w1 to the ciphertext calculation platform;

[0140] Step S22, the i-1th passive party sends the held model parameter w i to the ciphertext calculation platform;

[0141] Step S23, the ciphertext calculation platform combines the received model parameter w1 and the model parameter w i to obtain the model parameter W of the linear regression model, and sends the model parameter W to the result demander.

[0142] It should be noted that the embodiment of the application does not limit the specific manner of combining the model parameter w1 and the model parameter w i (i is 2 to k). For example, the model parameter w1 and the model parameter w i may be directly added to obtain the model parameter W of the linear regression model. For example, assuming that k = 5, W = w1 + w2 + w3 + w4 + w5. For another example, the model parameter w1 and the model parameter w iThe weighted addition is performed to obtain the model parameter W of the linear regression model. Exemplarily, assuming that k=5, W=k1w1+k2w2+k3w3+k4w4+k5w5, wherein k1, k2, k3, k4, and k5 are weights corresponding to w1, w2, w3, w4, and w5 respectively, and the weights can be set according to actual needs.

[0143] The result demander can be multiple parties in the multiple data providers or other participants independent of the data providers, and embodiments of the present application do not limit this.

[0144] The active party sends the encrypted model parameter w1 held by the active party to the ciphertext calculation platform, and the i-1th passive party sends the encrypted model parameter w i to the ciphertext calculation platform, and the ciphertext calculation platform can call the ciphertext calculation engine to combine the ciphertext of w1 and the ciphertext of w i to obtain the model parameter W of the linear regression model. i

[0145] In an optional embodiment, the ciphertext calculation platform can directly send the ciphertext of the model parameter W to the result demander, and the result demander decrypts the ciphertext of W to obtain the model parameter W of the linear regression model.

[0146] In an optional embodiment, when the result demander includes multiple parties, the ciphertext calculation platform can split the ciphertext of W, and then distribute the ciphertext of each split part to the corresponding result demander.

[0147] The subsequent result demander can use the trained linear regression model for other calculations such as data prediction, and embodiments of the present application do not limit this.

[0148] In summary, embodiments of the present application improve the training process of the linear regression model, decompose the sample data subset X1 held by the active party through singular value decomposition, and calculate the first matrix of size m*n according to the result of singular value decomposition, so that the size of the calculation matrix is reduced from m*m to m*n during the entire training process. Wherein, m is the sample number, and n is the feature number. In actual application, the feature number n is usually much smaller than the sample number m. For example, the sample data set includes 1 million bank sample data, and the feature number is at most several tens or several hundreds. Embodiments of the present application reduce the space complexity of training the linear regression model from m*m to m*n, greatly reduce the space complexity, and further reduce the calculation and communication overheads, improve the calculation efficiency, thereby improve the efficiency of the multi-party joint training of the linear regression model, and expand the size of the linear regression model.

[0149] ​It should be noted that for the method embodiments, for the sake of simple description, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited by the action sequence described, because according to the embodiments of the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily essential for the embodiments of the present application.

[0150] Referring to Figure 2 , a structural block diagram of an embodiment of a multi-party secure computing system 200 of the present application is shown, the multi-party secure computing system 200 comprising a ciphertext computing platform 201 and k data providers 202, k being an integer greater than 1, the k data providers comprising 1 active party 2021 and k-1 passive parties 2022, the multi-party secure computing system 200 being applicable to a scenario in which sample data sets relied on by a linear regression model are longitudinally distributed among the k data providers, the sample data sets being m being the number of samples, n being the number of characteristics of the samples, the sample data subsets respectively held by the k data providers being n = n1 + n2 + … + nk, the data label corresponding to the sample data set being held by the active party, the data label being wherein,

[0151] The active party 2021 is configured to calculate a first matrix Z = UE according to the sample data subset X1 held by the active party, and send the first matrix Z to each passive party via the ciphertext computing platform, wherein, I n is a unit matrix, and U is a matrix composed of left singular vectors obtained by singular value decomposition of the sample data subset X1;

[0152] The active party 2021 is further configured to calculate a second matrix according to the first matrix Z and the data label Y held by the active party, and send the second matrix to the ciphertext computing platform;

[0153] The i-1th passive party 2022 among the passive parties is configured to calculate a third matrix i according to the sample data subset X held by the i-1th passive party and the first matrix Z received by the i-1th passive party, and send the third matrix to the ciphertext computing platform, i taking a value from 2 to k;

[0154] The ciphertext computing platform 201 is configured to calculate a fourth matrix according to the second matrix computing model parameters w of the i-1th passive party i and sending the model parameters w of the i-1th passive party to the i-1th passive party i

[0155] The i-1th passive party 2022 is further configured to compute a fourth matrix Z according to the held sample data subset X i and the received model parameters w i The i-1th passive party 2022 is further configured to compute a fourth matrix Z according to the held sample data subset X and sending the model parameters w of the i-1th passive party to the i-1th passive party to the ciphertext computing platform;

[0156] The ciphertext computing platform 201 is further configured to merge the received fourth matrix Z to obtain a merged matrix Z and sending the model parameters w of the i-1th passive party to the i-1th passive party to the active party;

[0157] The active party 2021 is further configured to compute model parameters w of the active party according to the held sample data subset X1 and the received merged matrix Z

[0158] Optionally, the ciphertext computing platform is specifically configured to splice the received third matrix Z to obtain a first spliced matrix Z The ciphertext computing platform is specifically configured to compute an intermediate inverse matrix Z according to the first spliced matrix Z The ciphertext computing platform is specifically configured to compute a second spliced matrix Z according to the first spliced matrix Z -1 and the received second matrix Z The ciphertext computing platform is specifically configured to compute a second spliced matrix Z The ciphertext computing platform is specifically configured to split the second spliced matrix Z -1 to obtain model parameters w of the i-1th passive party i .

[0159] Optionally, the ciphertext computing platform is specifically configured to first perform ciphertext calculation and then decrypt the calculated ciphertext into plaintext, and then perform plaintext calculation

[0160] Optionally, when k=2, the data provider includes one active party and one passive party, and the passive party is further configured to, after computing the third matrix Z compute a fifth matrix Z and send the fifth matrix Z2 to the ciphertext computing platform;

[0161] ​​​The ciphertext calculation platform is specifically configured to calculate a second matrix Z2 according to the received second matrix Z1 The third matrix and a fifth matrix Z2, calculate the model parameter of the passive party and send the model parameter w2 to the passive party.

[0162] Optionally, the active party is further configured to send the held model parameter w1 to the ciphertext calculation platform.

[0163] The i-1 passive party is further configured to send the held model parameter w i to the ciphertext calculation platform.

[0164] The ciphertext calculation platform is further configured to combine the received model parameter w1 and the model parameter w i to obtain the model parameter W of the linear regression model, and send the model parameter W to the result demand party.

[0165] Optionally, the sample data subsets held by the k data providers are data subsets of the same sample data set in different feature dimensions.

[0166] Optionally, the multi-party secure calculation system is a plaintext-ciphertext hybrid calculation system, the ciphertext calculation platform is deployed with a ciphertext calculation engine, the ciphertext calculation engine is configured to perform ciphertext calculation based on a multi-party secure calculation protocol, the data provider is deployed with a plaintext calculation engine, the plaintext calculation engine is configured to perform plaintext operation, the data sent by the ciphertext calculation platform to the data provider is plaintext data, and the data sent by the data provider to the ciphertext calculation platform is ciphertext data.

[0167] The training process of the linear regression model is improved in the embodiment of the application. The active party performs singular value decomposition on the sample data subset X1 held by the active party, calculates a first matrix of m*n size according to the singular value decomposition result, and reduces the size of the calculation matrix from m*m to m*n in the whole training process. Wherein, m is the sample number, and n is the feature number. In actual application, the feature number n is usually much smaller than the sample number m. For example, the sample data set includes 1 million bank sample data, and the feature number is at most several tens or several hundreds. The spatial complexity of training the linear regression model is reduced from m*m to m*n in the embodiment of the application, the spatial complexity is greatly reduced, and then the calculation cost and the communication cost can be reduced, the calculation efficiency is improved, the efficiency of the multi-party joint training of the linear regression model is improved, and the size of the linear regression model is expanded.

[0168] For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the related parts refer to the part of the method embodiment.

[0169] Each embodiment in the specification is described in a progressive manner, and each embodiment focuses on the difference from other embodiments. The same or similar parts between embodiments can be referred to each other.

[0170] As to the apparatus in the above embodiments, the specific manner in which each module performs operations has been described in detail in the embodiments related to the method. No detailed description will be given here.

[0171] The embodiment of the application provides a device for model training, comprising a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more processors are configured to execute the one or more programs, including instructions for performing the model training method described in any of the above embodiments.

[0172] Figure 3 Fig. 8 is a block diagram of a device 800 for model training according to an example embodiment. For example, the device 800 can be a mobile phone, a computer, a digital broadcast terminal, a messaging device, a game console, a tablet device, a medical device, a fitness device, a personal digital assistant, and the like.

[0173] Referring to Figure 3 , the device 800 can include one or more of the following components: a processing component 802, a memory 804, a power supply component 806, a multimedia component 808, an audio component 810, an input / output (I / O) interface 812, a sensor component 814, and a communication component 816.

[0174] The processing component 802 usually controls the overall operation of the device 800, such as operations associated with displaying, making phone calls, data communications, camera operations and recording operations. The processing component 802 can include one or more processors 820 to execute instructions to complete all or part of the steps of the above methods. In addition, the processing component 802 can include one or more modules to facilitate interaction between the processing component 802 and other components. For example, the processing component 802 can include a multimedia module to facilitate the interaction between the multimedia component 808 and the processing component 802.

[0175] The memory 804 is configured to store various types of data to support the operation of the device 800. Examples of such data include instructions for any application or method operating on the device 800, contact data, phonebook data, messages, pictures, videos, and the like. The memory 804 can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0176] The power supply component 806 supplies electrical power for the various components of the device 800. The power supply component 806 can include a power supply management system, one or more power supplies, and other components associated with generating, managing and distributing electrical power for the device 800.

[0177] The multimedia component 808 includes a screen providing an output interface between the device 800 and a user. In some embodiments, the screen can include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touch, swiping and gestures on the touch panel. The touch sensors can not only sense a boundary of a touching or swiping action, but also detect duration and pressure associated with the touching or swiping action. In some embodiments, the multimedia component 808 includes a front camera and / or a rear camera. The front and / or rear camera can receive external multimedia data when the device 800 is in an operation mode, such as a shooting mode or a video mode. Each of the front and rear camera can be a fixed optical lens system or have a focal length and optical zoom capability.

[0178] The audio component 810 is configured to output and / or input audio signals. For example, the audio component 810 includes a microphone (MIC) that is configured to receive an external audio signal when the device 800 is in an operation mode, such as a calling mode, a recording mode and a voice recognition mode. The received audio signal can be further stored in the memory 804 or transmitted via the communication component 816. In some embodiments, the audio component 810 also includes a speaker for outputting audio signals.

[0179] The I / O interface 812 provides an interface between the processing component 802 and peripheral interface modules, which can be a keyboard, a click wheel, buttons, and the like. The buttons can include, but are not limited to, a home button, a volume button, a start button and a lock button.

[0180] The sensor component 814 includes one or more sensors for providing status assessments for various aspects of the device 800. For example, the sensor component 814 can detect an open / closed position of the device 800, relative positioning of components, such as a display and keypad of the device 800, changes in position of the device 800 or a component of the device 800, presence or absence of user contact with the device 800, orientation or acceleration / deceleration of the device 800, and temperature changes of the device 800. The sensor component 814 can include proximity sensor(s) configured to detect presence of nearby objects without any physical contact. The sensor component 814 can further include a light sensor, such as a CMOS or CCD image sensor, for use in imaging applications. In some embodiments, the sensor component 814 can further include an acceleration sensor, a gyroscope sensor, a magnetic sensor, a pressure sensor, or a temperature sensor.

[0181] The communication component 816 is configured to facilitate wired or wireless communication between the device 800 and another device. The device 800 can access a wireless network based on a corresponding communication standard, such as WiFi, 2G, or 3G, or a combination thereof. In an exemplary embodiment, the communication component 816 receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component 816 further includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on Radio Frequency Identification (RFID) technology, Infrared Data Association (IrDA) technology, Ultra-WideBand (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0182] In an exemplary embodiment, the device 800 can be implemented using one or more Application Specific Integrated Circuits (ASICs), Digital Signal Processors (DSPs), Digital Signal Processing Devices (DSPDs), Programmable Logic Devices (PLDs), Field Programmable Gate Arrays (FPGAs), controllers, microcontrollers, or other electronic units to perform the above-described methods.

[0183] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions, such as the memory 804 including instructions, is also provided, which can be executed by the processor 820 of the device 800 to perform the above-described methods. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disc, and an optical data storage device, etc.

[0184] Figure 4Figure 19 is a schematic diagram of a server in some embodiments of the application. The server 1900 can vary greatly due to configuration and performance differences, and can include one or more central processing units (CPU) 1922 (e.g., one or more processors) and memory 1932, one or more storage media 1930 (e.g., one or more mass storage devices) storing applications 1942 or data 1944. The memory 1932 and the storage media 1930 can be of the same type or different types, and can be of any type as known to those of skill in the art. The storage media 1930 can include short term storage or long term storage. The applications 1942 stored in the storage media 1930 can include one or more modules (not shown), each of which can include a series of instructions for operation by the server. Further, the CPU 1922 can be configured to communicate with the storage media 1930 to execute the series of instructions of the storage media 1930 on the server 1900.

[0185] The server 1900 can also include one or more power supplies 1926, one or more wired or wireless network interfaces 1950, one or more input / output interfaces 1958, one or more keyboards 1956, and / or one or more operating systems 1941, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0186] A non-transitory computer readable storage medium having instructions stored therein, which when executed by a processor of an apparatus (a server or a terminal), cause the apparatus to perform Figure 1 the model training method shown.

[0187] A non-transitory computer readable storage medium having instructions stored therein, which when executed by a processor of an apparatus (a server or a terminal), cause the apparatus to perform the foregoing Figure 1 description of the model training method in the corresponding embodiments, and therefore, will not be repeated here. In addition, the description of the beneficial effects of using the same method will also not be repeated. For technical details not disclosed in the computer program product or computer program embodiments involved in the present application, please refer to the description of the method embodiments of the present application.

[0188] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the application embrace any and all variations of the application that fall within the scope of the present application. Accordingly, many modifications and variations of this application can be made in light of the above teachings without departing from the spirit and scope of the application. It is therefore to be understood that, within the scope of the claims and their equivalents, the application can be practiced otherwise than as specifically described. The description and examples are intended for purposes of illustration only and are not intended as an inhibition on the scope of the application. The scope of the application is limited solely by the claims.

[0189] It is to be understood that the application is not limited to the precise construction and method described above and illustrated in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the application is limited only by the claims that follow.

[0190] The above description is only the preferred embodiment of the present application, and is not intended to limit the present application, any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application should be included in the protection scope of the present application.

[0191] The model training method and the multi-party secure computing system provided by the present application are described in detail above. The principles and implementation modes of the present application are described by applying specific examples. The above embodiment description is only used to help understand the method of the present application and its core idea; at the same time, for those skilled in the art, according to the idea of the present application, the specific implementation mode and application range will be changed; in summary, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A model training method, characterized in that, The method is applied to a multi-party secure computation system, which includes a ciphertext computation platform and k data providers, where k is an integer greater than 1. The k data providers include one active party and k-1 passive parties. The method is suitable for scenarios where the sample dataset used to train a linear regression model is vertically distributed across the k data providers. m is the number of samples, n is the number of features in the samples, and the subsets of sample data held by each of the k data providers are as follows: n = n1 + n2 + ... + nk, where the data labels corresponding to the sample dataset are held by the active party, and the data labels are... The method includes: The active party calculates a first matrix Z = UE based on the sample data subset X1 it holds, and sends the first matrix Z to each passive party via the encrypted computing platform, wherein... I n1 U is the identity matrix, and U is the matrix composed of left singular vectors obtained by performing singular value decomposition on the sample data subset X1. The initiating party calculates the second matrix based on the first matrix Z and the held data tag Y. and the second matrix Send to the encrypted computing platform; The (i-1)th passive party, based on the sample data subset X it holds... i Calculate the third matrix using the received first matrix Z. and the third matrix The message is sent to the encrypted computing platform, where the value of i ranges from 2 to k. The encrypted computing platform calculates based on the received second matrix. and the third matrix Calculate the model parameters w for the (i-1)th passive party. i And the model parameters w of the (i-1)th passive party i Send to the (i-1)th passive party; The (i-1)th passive party, based on the sample data subset X it holds... i and the received model parameters w i Calculate the fourth matrix and the fourth matrix Send to the encrypted computing platform; The ciphertext calculation platform processes the received fourth matrix. Merge to obtain a merge matrix and the merged matrix Send to the initiating party; The initiating party uses the sample data subset X1 it holds and the received merge matrix. Calculate the model parameters of the active party.

2. The method according to claim 1, characterized in that, The encrypted computing platform calculates based on the received second matrix. and the third matrix Calculate the model parameters w for the (i-1)th passive party. i ,include: The ciphertext calculation platform processes the received third matrix By concatenating the matrices, we obtain the first concatenated matrix. The ciphertext calculation platform calculates based on the first splicing matrix. Calculate the intermediate inverse matrix The ciphertext calculation platform calculates based on the first splicing matrix. The intermediate inverse matrix Z -1 and the received second matrix Calculate the second splicing matrix The ciphertext calculation platform will use the second splicing matrix w -1 By splitting the model, we can obtain the model parameters w for the (i-1)th passive party. i .

3. The method according to claim 2, characterized in that, The ciphertext calculation platform calculates based on the first splicing matrix. Calculate the intermediate inverse matrix include: The ciphertext computation platform first performs ciphertext computation. Then calculate the results The ciphertext is decrypted into plaintext, and then calculations are performed based on the plaintext.

4. The method according to claim 1, characterized in that, When k=2, the data provider includes one active party and one passive party, and the passive party calculates the third matrix. Then the fifth matrix was calculated. The fifth matrix Z2 is sent to the ciphertext computing platform; the ciphertext computing platform calculates the value based on the received second matrix. and the third matrix Calculate the model parameters w for the (i-1)th passive party. i ,include: The encrypted computing platform calculates based on the received second matrix. Third matrix And the fifth matrix Z2, calculate the model parameters of the passive side. The model parameter w2 is then sent to the passive party.

5. The method according to claim 1, characterized in that, The method further includes: The active party sends the model parameter w1 it holds to the encrypted computing platform; The (i-1)th passive party will hold the model parameters w i Send to the encrypted computing platform; The encrypted computing platform will receive the model parameters w1 and w... i The parameters W of the linear regression model are obtained by merging the parameters and then sent to the result requester.

6. The method according to any one of claims 1 to 5, characterized in that, The sample data subsets held by each of the k data providers are subsets of the same sample dataset on different feature dimensions.

7. The method according to any one of claims 1 to 5, characterized in that, The multi-party secure computation system is a plaintext-ciphertext hybrid computation system. The ciphertext computation platform is equipped with a ciphertext computation engine, which is used to perform ciphertext computation based on the multi-party secure computation protocol. The data provider is equipped with a plaintext computation engine, which is used to perform plaintext operations. The data sent from the ciphertext computation platform to the data provider is plaintext data, and the data sent from the data provider to the ciphertext computation platform is ciphertext data.

8. A multi-party secure computation system, characterized in that, The multi-party secure computation system includes a ciphertext computation platform and k data providers, where k is an integer greater than 1. The k data providers include one active party and k-1 passive parties. This multi-party secure computation system is suitable for scenarios where the sample dataset used to train a linear regression model is vertically distributed across the k data providers. The sample dataset is... m is the number of samples, n is the number of features in the samples, and the subsets of sample data held by each of the k data providers are as follows: n = n1 + n2 + ... + nk, where the data labels corresponding to the sample dataset are held by the active party, and the data labels are... in, The active party is used to calculate a first matrix Z = UE based on the sample data subset X1 it holds, and send the first matrix Z to each passive party via the encrypted computing platform, wherein... I n1 U is the identity matrix, and U is the matrix composed of left singular vectors obtained by performing singular value decomposition on the sample data subset X1. The active party is further configured to calculate a second matrix based on the first matrix Z and the held data tag Y. and the second matrix Send to the encrypted computing platform; The (i-1)th passive party in the passive party is used to determine the sample data subset X it holds. i Calculate the third matrix using the received first matrix Z. and the third matrix The message is sent to the encrypted computing platform, where the value of i ranges from 2 to k. The ciphertext calculation platform is used to calculate the received second matrix. and the third matrix Calculate the model parameters w for the (i-1)th passive party. i And the model parameters w of the (i-1)th passive party i Send to the (i-1)th passive party; The (i-1)th passive party is also used to determine the subset of sample data X it holds. i and the received model parameters w i Calculate the fourth matrix and the fourth matrix Send to the encrypted computing platform; The encrypted computation platform is also used to process the received fourth matrix. Merge to obtain a merge matrix and the merged matrix Send to the initiating party; The active party is further configured to, based on the sample data subset X1 it holds and the received merging matrix... Calculate the model parameters of the active party.

9. The multi-party secure computation system according to claim 8, characterized in that, The ciphertext calculation platform is specifically used to process the received third matrix. By concatenating the matrices, we obtain the first concatenated matrix. According to the first splicing matrix Calculate the intermediate inverse matrix According to the first splicing matrix The intermediate inverse matrix Z -1 and the received second matrix Calculate the second splicing matrix The second splicing matrix w -1 By splitting the model, we can obtain the model parameters w for the (i-1)th passive party. i .

10. The multi-party secure computation system according to claim 9, characterized in that, The ciphertext computation platform is specifically used for first performing ciphertext computation. Then calculate the results The ciphertext is decrypted into plaintext, and then calculations are performed based on the plaintext.

11. The multi-party secure computation system according to claim 8, characterized in that, When k=2, the data provider includes one active party and one passive party, and the passive party is also used in calculating the third matrix. Next, calculate the fifth matrix. And the fifth matrix Z2 is sent to the ciphertext computing platform; The encrypted computation platform is specifically used to calculate the encrypted data based on the received second matrix. Third matrix And the fifth matrix Z2, calculate the model parameters of the passive side. The model parameter w2 is then sent to the passive party.

12. The multi-party secure computation system according to claim 8, characterized in that, The active party is also used to send the model parameters w1 it holds to the encrypted computing platform; The (i-1)th passive party is also used to transfer the held model parameters w i Send to the encrypted computing platform; The encrypted computing platform is also used to process the received model parameters w1 and w... i The parameters W of the linear regression model are obtained by merging the parameters and then sent to the result requester.

13. The multi-party secure computing system according to any one of claims 8 to 12, characterized in that, The sample data subsets held by each of the k data providers are subsets of the same sample dataset on different feature dimensions.

14. The multi-party secure computing system according to any one of claims 8 to 12, characterized in that, The multi-party secure computation system is a plaintext-ciphertext hybrid computation system. The ciphertext computation platform is equipped with a ciphertext computation engine, which is used to perform ciphertext computation based on the multi-party secure computation protocol. The data provider is equipped with a plaintext computation engine, which is used to perform plaintext operations. The data sent from the ciphertext computation platform to the data provider is plaintext data, and the data sent from the data provider to the ciphertext computation platform is ciphertext data.

15. An apparatus for model training, characterized in that, It includes a memory and one or more programs, wherein one or more programs are stored in the memory and configured to be executed by one or more processors, wherein the one or more programs contain instructions for performing the model training method as described in any one of claims 1 to 7.

16. A machine-readable medium having instructions stored thereon, which, when executed by one or more processors of a device, cause the device to perform the model training method as described in any one of claims 1 to 7.

Images