A method for verifying the correctness of AI behavior on blockchain

Abstract

The present invention discloses a method for verifying the correctness of AI behavior on a blockchain, wherein a client node calls data on a blockchain to train an AI model; the client node performs proxy re-encryption on the generated AI behavior record AI-digest and sends it to an endorsement node; the endorsement node performs a plaintext data request on the client node based on the received data to verify the correctness of AI-digest; the sorting node packages and stores the effectively endorsed AI-digest together with the transaction on the blockchain, thereby realizing the verification of the correctness of AI behavior on the blockchain. The present invention is based on the lack of supervision of AI behavior on the blockchain, and designs proxy re-encryption to protect the privacy of data and realize data access control. At the same time, the distributed storage system IPFS is introduced to store the encrypted data in IPFS and the data digest in the blockchain, which reduces the overhead of the blockchain and can also provide a credible basis for the subsequent supervision of AI behavior on the blockchain.

Description

Technical Field

[0001] The present invention relates to the field of AI security and data auditing technology, and specifically to a method for verifying the correctness of AI behavior on a blockchain. Background Art

[0002] As the underlying technical solutions of blockchain are becoming more and more perfect, blockchain presents a broad prospect for application development. However, due to some inevitable problems in the current blockchain platform technology, such as low throughput, high latency, poor scalability, malicious mining / transaction behavior, and vulnerable code in smart contracts developed on the blockchain, these problems have seriously hindered the further development of blockchain technology. AI technology has received more and more attention due to its advanced technical characteristics. More and more companies and individuals are using AI technology to help blockchain to solve these problems on the blockchain. However, current research mainly focuses on how to use AI technology to make blockchain overcome its existing problems and become more intelligent. Few studies focus on how to conduct forensic supervision of AI behavior in the event of disputes and accountability afterwards, and lack in-depth research on consistency issues such as the correctness verification of AI behavior on the blockchain.

[0003] At present, the main purpose of assisting AI on blockchain is to help it solve some existing drawbacks, such as: unsupervised machine learning automatically identifies possible damage or recurring violations in smart contracts with the help of blockchain; deep reinforcement learning can help optimize the performance of industrial IoT systems on blockchain. However, AI is also extremely vulnerable to external attacks. Studies have shown that deep learning is extremely vulnerable to some carefully designed input samples, which are called adversarial samples. By adding some small perturbations to the original samples, the performance of deep learning models is greatly reduced; by doping a small amount of malicious samples in the AI ​​model training samples, the accuracy of model training can be greatly interfered with. These attacks on AI will greatly damage the integrity and privacy of data. To this end, a solution for verifying the correctness of AI behavior on blockchain is needed to determine whether the trained AI model data has been tampered with, and subsequent review can also call out relevant data for verification. So far, research on the correctness verification method of AI behavior on blockchain is extremely rare.

[0004] Therefore, a reasonable way is needed to solve the problem of verifying the correctness of AI behavior on the blockchain to ensure the reliability and accuracy of the AI ​​training model data on the blockchain. Summary of the invention

[0005] Purpose of the invention: In view of the above-mentioned prior art, a method for verifying the correctness of AI behavior on blockchain is proposed.

[0006] Technical solution: A method for verifying the correctness of AI behavior on a blockchain, comprising the following steps:

[0007] 1) The client node calls the data on the blockchain to train the AI ​​model, and records the parameters and intermediate states during the AI ​​model training process to generate an AI-digest data tuple;

[0008] 2) The client node re-encrypts the AI-digest data tuple generated in step 1) and stores the encrypted data in the IPFS distributed storage system, recording the returned address index;

[0009] 3) The client node sends the address index and transaction content in step 2) to the endorsement node for AI behavior training correctness verification, where each transaction content contains the recipient's address information, transaction amount, sender's signature and transaction information;

[0010] 4) The endorsement node determines whether the AI ​​behavior training and transaction content meet the correctness verification. If the verification is passed, the address index and transaction content of the AI-digest data tuple are endorsed and signed to form a valid endorsement; otherwise, the endorsement is rejected to form an invalid endorsement;

[0011] 5) The endorsing node returns the endorsement result, i.e., the address index and transaction content of the signed AI-digest, to the client node, and the client node sends the received endorsement result to the sorting node;

[0012] 6) The sorting node verifies the received AI-digest address index and the endorsement signature of the transaction content, stores the valid endorsed data on the chain, refuses to store the invalid endorsed data on the chain, and punishes the endorsement node.

[0013] Preferably, the implementation process of step 1) is:

[0014] 1.5) Build AI training model M0 and P2P network;

[0015] 1.6) Parameter setting: Initialize the parameters of the AI ​​training model M0, including the learning rate η and the learning training batch m; Initialize the parameters of the P2P network, including the default network ID and protocol number; Set the multiplication cycle group G; Generator P; The trusted authority from the outside world acts as the certificate authority CA, and the certificate authority CA selects a random number As its master private key, where is the field of positive integers modulo q, where q is the order of the multiplicative cyclic group G; the public key mpk of the certificate authority CA CA =r×P; select hash function H1: H2: System common parameters

[0016] 1.7) Generate user registration information: First, user U randomly selects a random number At the same time, the user identifier R is calculated U =r U ×G, convert the tuple (id U ,R U ) is sent to the certificate authority CA; the certificate authority CA issues the certificate according to the tuple (id U ,R U ), randomly select a random value And calculate R t =r t ×P, where R t The user identifier calculated for the certificate authority CA; therefore, the certificate of user node U is Cert U =R U +R t , calculate r a =H1(Cert U ||id U )*r t +r,r a is the calculated random number. Finally, the certificate authority CA sends the tuple (r a ,Cert U ) is sent to user node U to complete user information registration;

[0017] 1.8) Generate AI training record data: After the user registers his / her identity information, the client node calls the data on the blockchain for AI training, and records the intermediate states and parameters of the AI ​​training process to generate the data tuple AI-digest.

[0018] Preferably, the implementation process of step 2) is:

[0019] The client node first generates metadata in is the user's identity, T0 is the timestamp, and the data tuple AI-digest is encrypted to obtain the ciphertext C M =Enc(M,filekey), Enc is an encryption algorithm, which contains the machine encrypted data M and the encryption key filekey, where filekey is a randomly generated encryption key and M is the data tuple AI-digest; secondly, the client node selects a random value Perform two-part ciphertext calculation in For XOR operation, pk CN is the public key of the client node, hA It is the hash value generated by calculation; finally, the client node generates a signature in It is the private key of the client node and also determines the signature Is it 0? If it is 0, reselect the random value r; otherwise, the ciphertext information, i.e. the encrypted AI-digest: The IPFS distributed storage system organizes the encrypted information into blocks in the format of Merkle DAG. After storage, the ciphertext information will be represented by the root hash of Merkle DAG to represent the address index of the ciphertext information, and the returned address index will be recorded. The transaction Merkle hash tree generated by the Merkle hash algorithm is used to verify the rationality of the transaction content.

[0020] Preferably, the implementation process of step 3) is:

[0021] 3.1) Data storage: encrypted information After sending it to the IPFS distributed storage system, the IPFS distributed storage system selects a unique address index and returns it to the client node for subsequent data requests. The client node records the returned address index.

[0022] 3.2) Data transfer: The client node passes the received address index and transaction content to the endorsement node to verify the correctness of the AI ​​behavior.

[0023] Preferably, the implementation process of step 4) is:

[0024] 4.1) Data retrieval: First, when the client node receives the transaction request, it And the identity information of the endorsing node and Certificate Calculating random values At the same time, use the public key mpk of the certificate authority CA CA To verify whether the identity information of the endorsing node is correct, if the verification is successful, calculate the re-encryption key:

[0025]

[0026] Next, the proxy server retrieves the encrypted AI-digest according to the received address index, and re-encrypts the encrypted AI-digest using the proxy re-encryption key, and sends the re-encrypted AI-digest to the endorsing node. Finally, when the endorsing node receives the re-encrypted data, it uses its private key to decrypt it and obtain the plaintext AI-digest.

[0027] Data verification: After obtaining the plaintext data AI-digest, the endorsing node follows:

[0028] Verify the correctness of the intermediate state, where X i is the status of the current record, is the previous state value, is the state generated by the execution of the AI ​​algorithm, F(*) is the AI ​​algorithm equation, Δ val is the set deviation value. If the difference between each recorded intermediate state and each calculated intermediate state is ≤Δ val , the endorsing node believes that its status is compliant; verify all intermediate states of the record. If all states are verified, it proves that there is no error in the AI ​​behavior record and the correctness of the AI ​​behavior is verified; the endorsing node then verifies the compliance of the transaction and calculates the Merkle Root Merkle root according to the Merkel Merkel tree algorithm. If the verification passes, it means that the transaction content is compliant and the endorsing node endorses it. Regenerate the merkle hash tree composed of the transaction content according to the Merkle hash algorithm and compare whether the generated root hash is the same as the previous one. If they are the same, it means that the content is compliant, otherwise it is not compliant.

[0029] Preferably, the implementation process of step 5) is as follows: the client node uploads the address index of the AI-digest containing the endorsement node signature and the transaction content to the sorting node for packaging and chaining operations.

[0030] Preferably, the implementation process of step 6) is:

[0031] First, the sorting node verifies the address index and transaction content of the AI-digest containing the endorsement node signature. If the endorsement result of the received transaction content and the address index of the AI-digest is More than 51% of the endorsing nodes in the blockchain network are honest and the endorsement result is Compare Are they equal? ​​If they are equal, it means that the endorsement result is valid. Otherwise, it means that the endorsement node is invalid. The sorting node packages the valid endorsed data and uploads it to the chain. At the same time, the node with an error in the endorsement node is punished and broadcast to the entire network to cancel its endorsement rights.

[0032] Preferably, after canceling the endorsement right, the sorting node stores the validly endorsed transaction content and the address index of AI-digest on the chain to facilitate subsequent audits of the correctness of AI behavior.

[0033] Beneficial effects:

[0034] Aiming at the lack of supervision of AI behavior on blockchain, the present invention designs proxy re-encryption to protect the privacy of data while realizing data access control. At the same time, the distributed storage system (IPFS) is introduced to store the encrypted data in IPFS and the data summary in the blockchain, which reduces the overhead of blockchain and can also provide a credible basis for the subsequent supervision of AI behavior on blockchain. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of the verification method of the present invention;

[0036] Figure 2 It is a schematic diagram of the verification model flow of the present invention;

[0037] Figure 3 It is a schematic diagram of the sequencing model flow of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further explained below in conjunction with the accompanying drawings.

[0039] A method for verifying the correctness of AI behavior on a blockchain, specifically comprising the following steps:

[0040] The client node first records the AI ​​behavior on the blockchain to generate an AI behavior summary. The specific process is as follows:

[0041] The client node calls the data on the blockchain for AI training, and records the intermediate states and parameters of the AI ​​training process to generate an AI behavior record tuple AI-digest. The generated data tuple AI-digest is re-encrypted by proxy to achieve controllable data access control. At the same time, the encrypted AI-digest is stored in the distributed file system IPFS, and the returned address index is connected to the transaction and sent to the endorsement node for AI behavior correctness verification.

[0042] Before the AI ​​behavior record data is sent to the endorsing node for verification, it needs to be processed. The processing process is as follows:

[0043] The client node first generates the relevant metadata in is the user's identity, T0 is the timestamp, and the plaintext message AI-digest is encrypted. M =Enc(M,filekey), where filekey is a randomly generated encryption key and M is the encrypted data AI-digest; secondly, the client node randomly selects a value Perform two-part ciphertext calculation h A =H2(R||M||meta); Finally, the client node generates a signature At the same time, determine whether the signature data is 0. If it is 0, reselect the random value r; otherwise, Transmitted to the distributed storage system IPFS.

[0044] After the client node sends the AI ​​behavior data to the endorsement node, the endorsement verifies its correctness. The process is as follows:

[0045] The endorsing node sends a data retrieval transaction. First, when the client node receives the transaction request, it And the identity information of the endorsing node and Certificate Calculating random values At the same time, use the public key mpk of the certificate authority CA To verify whether the identity information of the endorsing node is correct. If the verification is successful, calculate the re-encryption key Next, the proxy server retrieves IPFS according to the received address index to obtain the encrypted AI-digest, and uses the proxy re-encryption key to re-encrypt the ciphertext AI-digest, and sends the re-encrypted AI-digest to the endorsing node; finally, when the endorsing node receives the relevant re-encrypted data, it uses its private key to decrypt it to obtain the plaintext data AI-digest.

[0046] After obtaining the plaintext data AI-digest, the endorsing node follows Verify the correctness of the intermediate state, where X i is the status of the current record, is the previous state value, F(*) is the AI ​​algorithm equation, Δ valFor the set allowable deviation value, if the difference between each recorded intermediate state and each calculated intermediate state is within a certain range, the endorsing node considers that its state is compliant, and verifies all recorded intermediate states in the above manner. If all states are verified, it proves that there is no error in the AI ​​behavior record and the correctness of the AI ​​behavior is verified; the endorsing node then verifies the transaction compliance and calculates the MerkleRoot according to the Merkel algorithm. If the verification passes, it means that the transaction content is compliant and the endorsing node endorses it.

[0047] The client node sends the AI ​​behavior records and transactions verified by the endorsement node to the sorting node for on-chain processing. The processing process is as follows:

[0048] The sorting node receives data from the client node and first verifies the endorsement result of the received data. If the endorsement result of the received transaction and the address summary of AI-digest is If most of the endorsing nodes are honest and the endorsement result is Compare Are they equal? ​​If they are equal, it means that the endorsement result is valid. Otherwise, it means that the endorsement node is invalid. The sorting node packages the valid endorsed data and uploads it to the chain. At the same time, it punishes those endorsement nodes with errors and broadcasts them to the entire network to cancel their endorsement rights. The sorting node stores the valid endorsed transaction data and AI-digest on the chain, which satisfies and verifies the correctness of AI behavior, and also facilitates the subsequent audit of the correctness of AI behavior.

[0049] If both the endorsement node and the sorting node pass the verification of the correctness of the recorded AI behavior, it means that the AI ​​behavior on the blockchain is correct.

[0050] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for verifying the correctness of AI behavior on a blockchain, comprising the following steps: 1) The client node calls the data on the blockchain to train the AI ​​model, and records the parameters and intermediate states during the AI ​​model training process to generate an AI-digest data tuple; 2) The client node re-encrypts the AI-digest data tuple generated in step 1) and stores the encrypted data in the IPFS distributed storage system, recording the returned address index; 3) The client node sends the address index and transaction content in step 2) to the endorsement node for AI behavior training correctness verification, where each transaction content contains the recipient's address information, transaction amount, sender's signature and transaction information; 4) The endorsement node determines whether the AI ​​behavior training and transaction content meet the correctness verification. If the verification is passed, the address index and transaction content of the AI-digest data tuple are endorsed and signed to form a valid endorsement; otherwise, the endorsement is rejected to form an invalid endorsement; 5) The endorsing node returns the endorsement result, i.e., the address index and transaction content of the signed AI-digest, to the client node, and the client node sends the received endorsement result to the sorting node; 6) The sorting node verifies the Al-digest address index and endorsement signature of the transaction content received, stores the valid endorsed data on the chain, refuses to upload the invalid endorsed data to the chain, and punishes the endorsement node; The implementation process of step 1) is: 1.1) Build AI training model M0 and P2P network; 1.2) Parameter setting: Initialize the parameters of the AI ​​training model M0, including the learning rate η and the learning training batch m; Initialize the parameters of the P2P network, including the default network ID and protocol number; Set the multiplication cycle group G; Generator P; The trusted authority from the outside world acts as the certificate authority CA, and the certificate authority CA selects a random number As its master private key, where is the field of positive integers modulo q, where q is the order of the multiplicative cyclic group G; the public key mpk of the certificate authority CA CA =r×P; select hash function System common parameters 1.3) Generate user registration information: First, user U randomly selects a random number Also calculate the user identifier The tuple (id U, R U ) is sent to the certificate authority CA; the certificate authority CA issues the certificate according to the tuple (id U , R U ), randomly select a random value And calculate R t =r t ×P, where R t The user identifier calculated for the certificate authority CA; therefore, the certificate of user node U is Cert U =R U +R t , calculate r a =H1(Cert U ||id U )*r t +r,r a is the calculated random number. Finally, the certificate authority CA sends the tuple (r a , Cert U ) is sent to user node U to complete user information registration; 1.4) Generate AI training record data: After the user registers the identity information, the client node calls the data on the blockchain for AI training, and records the intermediate state and parameters of the AI ​​training process to generate the data tuple AI-digest; The implementation process of step 2) is: The client node first generates metadata meta=(id CN ||T0), where id CN is the user's identity, T0 is the timestamp, and the data tuple AI-digest is encrypted to obtain the ciphertext C M =Enc(M, filekey), Enc is an encryption algorithm, which contains machine encrypted data M and encryption key filekey, where filekey is a randomly generated encryption key and M is the data tuple AI-digest; secondly, the client node selects a random value Perform two-part ciphertext calculation in For XOR operation, pk CN is the public key of the client node, h A It is the hash value generated by calculation; finally, the client node generates a signature in It is the private key of the client node and also determines the signature Is it 0? If so, reselect the random value r; otherwise, the encrypted information, i.e. the encrypted AI-digest: C = (C A ,meta,h A , SigCN ) is transmitted to the IPFS distributed storage system, which organizes the encrypted information in the format of Merkle DAG Merkel directed acyclic graph and stores it in blocks. After the storage is completed, the ciphertext information will use the root hash of Merkle DAG to represent the address index of the ciphertext information, and the returned address index will be recorded; The implementation process of step 3) is: 3.1) Data storage: After the encrypted information C = (C A ,meta,h A , Sig CN ) is sent to the IPFS distributed storage system, the IPFS distributed storage system selects a unique address index and returns it to the client node for subsequent data requests, and the client node records the returned address index; 3.2) Data transfer: The client node passes the received address index and transaction content to the endorsement node to verify the correctness of the AI ​​behavior; The implementation process of step 4) is: 4.1) Data retrieval: First, when the client node receives the transaction request, it retrieves the data according to the ciphertext information C = (C A ,meta,h A , Sig CN ) and the identity information id of the endorsing node EN and Certificate EN , calculate the random value r = Sig CN -h A *sk CN , and use the public key mpk of the certificate authority CA CA To verify whether the identity information of the endorsing node is correct, if the verification is successful, calculate the re-encryption key: Next, the proxy server retrieves the encrypted AI-digest according to the received address index, and re-encrypts the encrypted AI-digest using the proxy re-encryption key, and sends the re-encrypted AI-digest to the endorsing node. Finally, when the endorsing node receives the re-encrypted data, it uses its private key to decrypt it and obtain the plaintext AI-digest. Data verification: After obtaining the plaintext data AI-digest, the endorsing node follows: Verify the correctness of the intermediate state, where X i is the status of the current record, is the previous state value, is the state generated by the execution of the AI ​​algorithm, F(*) is the AI ​​algorithm equation, Δ val is the set deviation value. If the difference between each recorded intermediate state and each calculated intermediate state is ≤Δ val , the endorsing node believes that its status is compliant; verify all the intermediate states of the record. If all the states are verified, it proves that there is no error in the AI ​​behavior record and the correctness of the AI ​​behavior is verified; the endorsing node then verifies the compliance of the transaction and calculates the Merkle Root according to the Merkel tree algorithm. If the verification passes, it means that the transaction content is compliant and the endorsing node endorses it; The implementation process of step 5) is as follows: the client node uploads the address index of the AI-digest signed by the endorsement node and the transaction content to the sorting node for packaging and chaining; The implementation process of step 6) is: First, the sorting node verifies the address index and transaction content of the AI-digest containing the endorsement node signature. If the endorsement result of the received transaction content and the address index of the AI-digest is More than 51% of the endorsing nodes in the blockchain network are honest and the endorsement result is Compare Are they equal? ​​If they are equal, it means that the endorsement result is valid. Otherwise, it means that the endorsement node is invalid. The sorting node packages the valid endorsed data and uploads it to the chain. At the same time, the node with an error in the endorsement node is punished and broadcast to the entire network to cancel its endorsement rights.

2. A method for verifying the correctness of AI behavior on a blockchain as claimed in claim 1, characterized in that: In taking After canceling the endorsement rights, the sorting node will store the valid endorsed transaction content and the address index of AI-digest on the chain. This facilitates subsequent audits of the correctness of AI behavior.

Images