Homomorphic encryption-based binary convolutional neural network implementation method and system

Abstract

This invention discloses a method and system for implementing a binary convolutional neural network based on homomorphic encryption, comprising: preprocessing the MNIST dataset in the cloud to obtain binary image data; constructing a plaintext binary convolutional neural network model in the cloud and training network parameters; homomorphically encrypting the binary image data using the TFHE encryption scheme on the client side and transmitting the encrypted image data to the cloud; constructing an encrypted neural network based on Boolean circuits or arithmetic circuits in the cloud based on the trained network parameters, performing inference on the encrypted image data to obtain a encrypted result, and transmitting it to the client; and decrypting the encrypted result on the client side to obtain the inference result. This invention combines the TFHE homomorphic encryption algorithm with a binary convolutional neural network to construct an encrypted neural network that supports fast gate bootstrapping technology, improving the ciphertext calculation speed and shortening the neural network runtime while protecting data privacy.

Description

Technical Field

[0001] This invention relates to a method for implementing a binary convolutional neural network based on homomorphic encryption, belonging to the interdisciplinary field of machine learning and information security. Background Technology

[0002] With the rapid development of cloud computing technology, the security and privacy of user data have received widespread attention. Therefore, privacy protection in machine learning has become an important research direction in the field of information security, and homomorphic encryption has become an important technology for realizing privacy computing.

[0003] Homomorphic encryption allows direct homomorphic computation on encrypted ciphertext without prior decryption, and the result obtained by performing the computation on plaintext is the same as performing the computation on ciphertext and then decrypting it. In privacy-preserving computations, the client needs to encrypt the data and upload it to the cloud. The cloud processes the encrypted data, obtains an encrypted result, and sends it back to the client. The client then decrypts the encrypted result to obtain the final result. Throughout this process, the cloud can only access the encrypted data, ensuring data security.

[0004] Currently, there are two development trends in the implementation of neural networks based on homomorphic encryption. The first is based on hierarchical fully homomorphic encryption schemes, constructing encrypted networks that require pre-estimation of the multiplication depth. However, increasing the multiplication depth leads to increased computational complexity; once the depth exceeds the limit, noise will exceed the threshold, and the ciphertext cannot be correctly decrypted. Therefore, it is difficult to implement complex neural networks in this direction. The second is based on fully homomorphic encryption schemes that support fast bootstrapping (TFHE), constructing encrypted networks that do not require pre-estimation of the multiplication depth. The significance of bootstrapping is that it refreshes ciphertext with noise close to the threshold to low-noise ciphertext, making the multiplication depth unlimited, thus enabling the implementation of complex neural networks. Bourse et al. implemented shallow discrete neural networks based on TFHE, but due to severe accuracy loss, they did not consider more complex neural network models. Meehan et al. implemented general convolutional neural networks based on TFHE, but it involves a large number of multi-bit ciphertext multiplication operations, resulting in slow computation speed and long network runtime.

[0005] Chinese patent application No. 201910757674.9, published on August 16, 2019, discloses a handwriting recognition method based on an encrypted neural network. This handwriting recognition method requires estimating the depth of the neural network and can only implement simple, shallow neural networks. Once the depth increases, the noise in the ciphertext exceeds a threshold, making it impossible to decrypt correctly. Summary of the Invention

[0006] Objective: To address the limited depth of ciphertext multiplication in existing technologies, this invention proposes a method for implementing a dense binary convolutional neural network based on homomorphic encryption. It fully utilizes the binary-friendly characteristics of the TFHE scheme, combining it with a binary neural network to construct a dense binary convolutional neural network. Simultaneously, it applies the fast-gate bootstrapping technique provided in the TFHE scheme, which can refresh ciphertext with noise close to the threshold into a new, lower-noise ciphertext within 0.1 seconds. This ensures that the noise of the ciphertext never exceeds the threshold and is not limited by the depth of the neural network. This invention improves the ciphertext calculation speed and shortens the runtime of the dense neural network while protecting data privacy.

[0007] Technical solution: A method for implementing a binary convolutional neural network based on homomorphic encryption, comprising the following steps:

[0008] Step 1: The MNIST dataset is normalized and binarized in the cloud to obtain binary image data; a binary convolutional neural network model with plaintext is built in the cloud, and the network parameters are trained.

[0009] Step 2: The client uses the TFHE encryption scheme to perform homomorphic encryption on the binary image data and transmits the encrypted image data to the cloud;

[0010] Step 3: Based on the network parameters obtained from training, the cloud constructs an encrypted neural network based on Boolean circuits, performs inference on the encrypted image data, and transmits the encrypted inference results to the client.

[0011] Step 4: The client decrypts the secret reasoning result to obtain the final result.

[0012] According to one aspect of this application, step 1, which involves normalizing and binarizing the MNIST dataset in the cloud, specifically includes the following steps:

[0013] Step 11: Perform batch normalization on the MNIST dataset:

[0014] Where x i Represents the original data, y i This represents the processed data, where μ is the mean and σ is the mean. 2 Let be the variance, and ∈ be a constant greater than zero;

[0015] Step 12: Binarize the normalized data to obtain binary image data.

[0016] According to one aspect of this application, step 1, which involves constructing a plaintext-based binary convolutional neural network model in the cloud, specifically includes the following steps:

[0017] Step 13: Determine the structure of the binary convolutional neural network;

[0018] Step 14: Establish the forward propagation process of the binary convolutional neural network, including:

[0019] Step 141: Adjust the weight matrix W l Binary processing is performed to obtain the binary weight matrix sign(W) l );

[0020] Step 142: Calculate the scaling factor γ l Real-value weights and scaling matrix K l ;

[0021]

[0022] Where l represents the l-th layer of the neural network, ω1 and ω2 represent the length and width of the convolutional kernel, respectively, ω3 represents the depth of the convolutional kernel, and k is the index value. l This represents the input matrix of the l-th layer of the neural network; the symbol * represents binary convolution, and the symbol · represents dot product; the scaling factor γ l and scaling matrix K l These are all scale parameters, making γ l ·sign(W l )≈W l K l ·sign(I l )≈I l ;

[0023] Step 143: After performing the binary convolution operation, activate the result using the ReLU nonlinear function;

[0024] Step 15: Define the cross-entropy loss function L, establish the backpropagation process of the binary convolutional neural network, and update the parameters using gradient descent: in, The true value is the target value for training the neural network; y k This is the output value of the fully connected layer, i.e., the result of training the neural network;

[0025] In a binary convolutional neural network, the gradient of the sign function is expressed as:

[0026] Step 16: Determine the optimal model by iteratively training the optimal parameters.

[0027] According to one aspect of this application, in step 2, the client uses the TFHE encryption scheme to perform homomorphic encryption on the binary image data, specifically including the following steps:

[0028] Homomorphic encryption based on Boolean circuits and neural network encryption methods:

[0029] Step 21: Perform non-standard binarization on the binary image data matrix [I], that is, binarize the data with values ​​of ±1 to 0 and 1, to obtain a non-standard binary matrix. The processed image data has a bit width of 1 bit.

[0030] Step 22: Use the TFHE homomorphic encryption scheme to process non-standard binary matrices. Each element in the array is encrypted to obtain a non-standard binary ciphertext matrix. The encryption process includes:

[0031] Map single-bit plaintext information m∈{0,1} onto the real number torus. superior, That is, real numbers modulo 1, yield

[0032] Calculate b =<s,a> +m′ / 2+e, where the private key s=(s1,s2,……,s n ), for the set {0,1} n A random uniform distribution on the public key a = (a1, a2, ..., a...). n ),for The noise e is a random uniform distribution on (0,σ), where σ is the set standard deviation; n is the set key parameter; the ciphertext (a,b) is obtained; [·] represents the ciphertext form;

[0033] Step 23: Apply scaling matrix K l Each element in the array is encrypted with 10 bits of precision. Step 22 is repeated to encrypt each element bit by bit, resulting in the encryption scaling matrix [K]. l ], Encrypted scaling matrix [K l The elements in ] are constructed as ciphertext arrays, i.e., 10-TLWE.

[0034] Homomorphic encryption based on arithmetic circuits and neural network encryption methods:

[0035] Directly apply the following to each element I in the binary image data matrix [I] i,j,t Perform TLWE encryption, i.e., [I i,j,t ]=(a1,a2,……,a n b), Where i, j, and t are index values.

[0036] According to one aspect of this application, in step 3, the cloud constructs a Boolean circuit-based encrypted neural network based on the network parameters obtained from training, and performs inference on the encrypted image data to obtain the encrypted state result, specifically including the following steps:

[0037] Step 31: Construct convolutional layers:

[0038] Step 311: For the binary weight matrix W l Perform non-standard binarization to obtain a non-standard binary weight matrix.

[0039] Step 312: Input the ciphertext matrix and weight matrix Perform a dense binary convolution operation, that is, replace the standard binary multiplication operation with the XOR operation between non-standard binary values ​​and the ciphertext expansion operation, and then use an N-bit homomorphic adder to implement the summation operation to obtain a feature ciphertext matrix.

[0040] Among them, non-standard binary encrypted logic operations can be implemented by calling the bootstrap gate in the TFHE library; the ciphertext expansion operation can expand the ciphertext that encrypts single-bit data {0,1} into a ciphertext array that encrypts multi-bit data {-1,1} bit by bit; an N-bit homomorphic adder is composed of N-1 homomorphic full adders and 2 bootstrap XOR gates;

[0041] Step 313: Compare the feature ciphertext matrix and the encryption scaling matrix [K] l Scaling factor γ l Perform dot multiplication to obtain the ciphertext output matrix; the ciphertext multiplication operation can be implemented by an N-bit homomorphic array multiplier, which is composed of N(N-1) homomorphic full adders;

[0042] Step 32: Construct the activation layer:

[0043] The ReLU function is selected as the activation function, and the activation value is used as the output of the convolutional layer. ReLU activation of the ciphertext can be achieved through the following steps: extract the sign bit of the ciphertext and perform a NOT operation on it to obtain a ciphertext that encrypts 1 bit of data. Then, perform a bitwise AND operation between this ciphertext and the original ciphertext to obtain the activation value of the original ciphertext.

[0044] Step 33: Construct a max pooling layer. The max pooling operation is implemented using a ciphertext comparison algorithm.

[0045] [t0]=0,[v i ] = [A i ]⊙[B i ]

[0046]

[0047] [R i ]=([t N-1 ]&[A i ])⊙(~[t N-1]&[B i ])

[0048] Where [v] and [t] are intermediate variables in the ciphertext comparison algorithm, and [R] is the maximum output of ciphertexts [A] and [B]; the symbol ~ represents the NOT operation, the symbol ⊙ represents the XOR operation, and the symbol The symbol & represents the XOR operation;

[0049] Step 34: Construct the normalization layer:

[0050] The original normalized formula is expressed as follows: Due to the special nature of binary convolutional neural networks, this invention does not need to know the normalized feature matrix values, but only needs to determine whether each item in the matrix is ​​greater than 0. Therefore, only addition operations are required, and multiplication operations are not required.

[0051] Step 35: Construct a fully connected layer. The construction method of a fully connected layer is similar to that of an activation layer, except that each node in the fully connected layer is connected to all nodes in the previous layer.

[0052] According to one aspect of this application, in step 3, the cloud constructs an encrypted neural network based on arithmetic circuits according to the network parameters obtained from training, and performs inference on the encrypted image data to obtain the encrypted state result, specifically including the following steps:

[0053] Step 3a: Establish convolutional layer: Input the preprocessed and TFHE encrypted standard binary image matrix and the standard binary weight matrix, and map each weight value onto the real torus T. Perform convolution operation on the two input matrices to output a high-noise encrypted feature matrix.

[0054] Step 3b: Establish activation layer: Input a high-noise encryption feature matrix, execute the optimized bootstrap algorithm on each item in the matrix, and output a low-noise encryption feature matrix;

[0055] Step 3c: Establish a max pooling layer: Input a low-noise encrypted feature matrix, use the optimized bootstrap algorithm to perform a comparison operation on the two ciphertexts, and output a low-noise dimensionality-reduced encrypted feature matrix.

[0056] Step 3d: Establish a normalization layer: Input a low-noise, dimensionality-reduced encrypted feature matrix, normalize it, perform homomorphic evaluation on the normalized dense state result, and output a new binary feature matrix encrypted with ±1.

[0057] Step 3e: Establish a fully connected layer: Input encrypted binary feature vectors and binary weight matrices, and map each weight value to a real torus. The algorithm performs corresponding multiplication and summation operations on the two inputs and outputs an encrypted result vector.

[0058] According to one aspect of this application, the process of establishing the convolutional layer in step 3a includes:

[0059] Input the preprocessed and TFHE-encrypted standard binary image matrix [I], and the standard binary weight matrix W1, where each element is TLWE ciphertext, i.e., [I] i,j,t ]=(a1,a2,……,a n b), Each weight value in W1 is mapped to a real torus. Above, that is Where the private key s = (s1, s2, ..., s n ), for the set {0,1} n A random uniform distribution on the public key a = (a1, a2, ..., a...). n ),for The noise e is a random uniform distribution on (0,σ), where σ is the set standard deviation and n is the set key parameter.

[0060] Perform convolution operation The output is a noisy [I1], and each item in the encrypted feature matrix [I1] is a TLWE ciphertext, i.e. in Where ω1, ω2, and ω3 are the length, width, and depth of the weight matrix W, respectively;

[0061] Performing a binary convolution operation yields a high-noise encrypted feature matrix [I2]. Each element in the encrypted feature matrix [I2] can be represented as... in

[0062] According to one aspect of this application, step 3b, establishing the activation layer specifically includes the following steps:

[0063] Input a high-noise encryption feature matrix [I2];

[0064] The optimized bootstrap algorithm is executed on each item in the matrix to output a low-noise encrypted feature matrix [I3]. This encrypted feature matrix is ​​the result of ReLU activation of the input matrix.

[0065] According to one aspect of this application, the process of the client decrypting the encrypted reasoning result in step 4 is further as follows:

[0066] The decryption process of a homomorphic encryption neural network based on Boolean circuits is as follows: calculate the phase for each element of the ciphertext array. like The decrypted value is 1 if the value is 1, otherwise it is 0; each element x in the ciphertext array i Each represents a single bit. Calculate ∑ i x i ·2 i This will give you a plaintext message represented by a ciphertext array; the client will then decrypt all the ciphertext arrays to get the final classification result.

[0067] The decryption process of a homomorphic encryption neural network based on arithmetic circuits is as follows: calculate the phase for each item in the encryption result vector. The result is inversely mapped from the torus to the integer field, i.e., the calculation is performed. The final decryption result is obtained.

[0068] In other embodiments, a binary convolutional neural network system based on homomorphic encryption is also provided, comprising:

[0069] In the cloud, it is used to normalize and binarize the MNIST dataset to obtain binary image data and send it to the client;

[0070] A binary convolutional neural network model with plaintext is built in the cloud, the network parameters are trained, and an encrypted neural network based on Boolean circuits is constructed based on the trained network parameters.

[0071] After receiving the encrypted image data sent by the client, the cloud performs inference on the encrypted image data and transmits the encrypted inference result to the client.

[0072] The client is used to receive binary image data from the cloud and perform homomorphic encryption on the binary image data using the TFHE encryption scheme, and then transmit the encrypted image data to the cloud.

[0073] After receiving the encrypted reasoning results returned from the cloud, the encrypted reasoning results are decrypted to obtain the final result.

[0074] Beneficial effects:

[0075] (1) This invention proposes a binary convolutional neural network inference method based on homomorphic encryption. In the dense neural network model, the convolutional layer, activation layer, pooling layer, normalization layer, and fully connected layer are all built based on bootstrap logic gates. Fast gate bootstrap technology is applied to the bootstrap logic gates, reducing the bootstrap time from 0.69s (FHEW scheme) to within 0.1s. Bootstrap is performed once for each logical operation, ensuring that the noise in the ciphertext is always kept within a threshold, and the computational complexity does not increase with the depth of the neural network, thus freeing the neural network from limitations on its depth. This invention improves the speed of dense operations, reduces the growth of ciphertext noise, and increases the depth of the neural network.

[0076] (2) This invention makes full use of the binary-friendly characteristics of the TFHE homomorphic encryption scheme, combines homomorphic encryption with binary neural network to construct a neural network model, uses binary convolution operation to replace general convolution operation, and converts some multi-bit ciphertext multiplication operations into single-bit ciphertext XOR operation, reducing the number of ciphertext multiplications and improving the inference speed of neural network.

[0077] (3) This invention realizes the comparison operation of two ciphertexts and successfully constructs the ReLU function activation layer and the max pooling layer in the neural network, instead of the approximate activation layer. This can reduce the computational overhead of the ciphertext and improve the inference accuracy.

[0078] (4) The encryption neural network construction method proposed in this patent can refresh the high-noise ciphertext into a low-noise new ciphertext after each activation layer. Therefore, it has good scalability and can realize a convolutional neural network with a deeper multiplication depth without the need to estimate the multiplication depth. Attached Figure Description

[0079] Figure 1 This is a schematic diagram of the dense binary convolutional neural network model provided by the present invention.

[0080] Figure 2 This is a schematic diagram of the dense-state addition operation module provided by the present invention.

[0081] Figure 3 This is a schematic diagram of the dense state multiplication operation module provided by the present invention.

[0082] Figure 4 This is a schematic diagram of ReLU bootstrapping provided by the present invention. Detailed Implementation

[0083] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings. Numerous specific details are set forth in the following description to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention can be practiced without one or more of these details. In other instances, certain technical features well-known in the art have not been described to avoid confusion with the present invention.

[0084] Example 1

[0085] This invention proposes a method for implementing a binary convolutional neural network based on homomorphic encryption. The client needs to encrypt the data and upload it to the cloud. The cloud trains the binary model parameters on the plaintext dataset and constructs a dense binary convolutional neural network with the same structure as the plaintext dataset. This network performs inference on the ciphertext and feeds the dense inference results back to the client. The client then decrypts the encrypted results to obtain the final result. During this process, the cloud can only access the encrypted data, ensuring data security.

[0086] The specific steps of this invention include:

[0087] Step 1: The MNIST dataset is preprocessed in the cloud, including batch normalization and binarization operations, to obtain binary image data.

[0088] In this step, the formula for batch normalization can be expressed as:

[0089] The formula for binarization can be expressed as:

[0090] Where x i Represents the original data, y i This represents the data after normalization.

[0091] To avoid the case where the denominator is 0, let ∈ = 0.0001.

[0092] Step 2: Build a binary convolutional neural network model in plaintext on the cloud and train the network parameters.

[0093] In this step, the cloud needs to determine the specific structure of the binary convolutional neural network under plaintext, establish the forward propagation process of the network, define the cross-entropy loss function and establish the back propagation process of the network, use gradient descent to update parameters, and finally iteratively train the optimal parameters to build the optimal model.

[0094] Step 3: The client uses the TFHE encryption scheme to perform homomorphic encryption on the binary image data and transmits the encrypted image data to the cloud.

[0095] In this step, the client performs non-standard binarization on the binary image data, that is, binarizes the data that was originally binary to ±1 into 0 and 1, resulting in a non-standard binary matrix. The processed image data has a bit width of 1 bit. The matrix is ​​encrypted using the TFHE homomorphic encryption scheme. Each element in the array is encrypted to obtain a non-standard binary ciphertext matrix. The encryption process is as follows: map the single-bit plaintext information m∈{0,1} onto the real number torus. superior, That is, real numbers modulo 1, yield Calculate b =<s,a> +m′ / 2+e, where the private key Public Key e←χ, where χ is the second-Gaussian noise distribution on the set of real numbers, yielding the ciphertext (a,b).

[0096] The client then applies the scaling matrix K l Each element in the array is taken with 10 bits of precision, and the TFHE homomorphic encryption scheme is used to encrypt K. l Each element in the array is encrypted bit by bit to obtain the encryption scaling matrix [K]. l ],[K l The elements in ] are constructed as ciphertext arrays, i.e., 10-TLWE.

[0097] Step 4: Based on the network parameters obtained from training, the cloud constructs an encrypted neural network based on Boolean circuits, performs inference on the encrypted image data, and transmits the encrypted inference results to the client.

[0098] In this step, the normalization layer, convolutional layer, activation layer, pooling layer, and fully connected layer of the encrypted neural network are all implemented based on Boolean circuits. This involves a dense-state multiplication module, a dense-state addition module, a dense-state absolute value solving module, a dense-state ReLU activation module, and a ciphertext comparison module. These modules can be constructed using the bootstrap gates proposed in the TFHE scheme.

[0099] Step 5: The client decrypts the secret reasoning result to obtain the final result.

[0100] In this step, the client calculates the phase for each element of the ciphertext array. like The decrypted value is 1 if the value is 1, otherwise it is 0. Each element x in the ciphertext array... i Each represents a single bit. Calculate ∑ i x i ·2 i This yields a plaintext message represented by a ciphertext array. The client then decrypts all the ciphertext arrays to obtain the final classification result.

[0101] Example 2

[0102] Based on the implementation method of a binary convolutional neural network based on homomorphic encryption proposed in Embodiment 1, the implementation process of the binary convolution operation proposed in this embodiment is as follows.

[0103] The first step is to adjust the weight matrix W. l Binary processing is performed to obtain the binary weight matrix sign(W) l ):

[0104]

[0105] The second step is to calculate the scaling factor γ. l :

[0106]

[0107] The third step is to calculate the real-valued weights.

[0108]

[0109] Fourth step, calculate the scaling matrix K. l :

[0110]

[0111]

[0112] K l =B l *C l

[0113] Fifth step, perform binary convolution operation:

[0114] I l *W l =[sign(I l )*sign(W l )]·K l ·γ l

[0115] Where l represents the l-th layer of the neural network, ω1 and ω2 represent the length and width of the convolutional kernel, respectively, ω3 represents the depth of the convolutional kernel, and I l Let B represent the input matrix of the l-th layer of the neural network. l Describe a matrix I of length. l The length and width are matrix I l A two-dimensional matrix of width, C l This represents a matrix of size (ω1, ω2), where the symbol * denotes convolution operation. The scaling factor γ... l and scaling matrix K l These are all scale parameters, making γ l ·sign(W l )≈W l K l ·sign(I l )≈I l .

[0116] When performing dense binary convolution, the bootsXNOR function in the TFHE library is called to perform a dense XOR operation on the input and weights, and then the dense addition operation module is called to perform a summation operation to obtain the dense convolution result.

[0117] Binary convolution reduces computational overhead by binarizing the input and weights, transforming floating-point multiplication into an XOR operation between two 1-bit data points. Table 1 shows a comparison of the runtime of dense-state binary convolution with that of general convolution.

[0118] Table 1 Comparison of running times for dense binary convolution and dense general convolution operations.

[0119] Dense-state convolution operation runtime 5×5 binary convolution 25s 5×5 general convolution 2576s

[0120] Example 3

[0121] Based on Example 2, the dense-state binary convolutional neural network model proposed in this example is as follows: Figure 1 As shown.

[0122] The network consists of a first convolutional layer, an activation layer, a pooling layer, a second convolutional layer, an activation layer, a pooling layer, a fully connected layer, and an activation layer. The first convolutional layer uses three 5×5×1 convolutional kernels, takes a 28×28 two-dimensional encrypted image as input, and outputs a 24×24×3 encrypted feature image. The second convolutional layer uses six 5×5×3 convolutional kernels, takes a 12×12×3 encrypted feature image as input, and outputs an 8×8×6 encrypted feature image. The pooling layers all use 2×2 max pooling with a stride of 2. The fully connected layer takes a 1×96 encrypted feature vector as input and outputs a 1×10 encrypted vector. The activation layers all use the ReLU activation function. Before passing through the second convolutional layer and the fully connected layer, the input data is normalized.

[0123] The specific steps in this example include:

[0124] The first step is to construct the convolutional layer:

[0125] For the ciphertext input matrix and weight matrix Performing a dense binary convolution operation XNOR_CONV(·) yields an encrypted feature matrix. The dense binary convolution operation uses non-standard binary XOR operations and ciphertext augmentation operations to replace multiplication operations.

[0126]

[0127] The ciphertext expansion operation EXTEND(·) can expand the ciphertext that encrypts 1-bit data {0,1} into a ciphertext array that encrypts multi-bit data {-1,1} bit by bit. I represents a non-standard binary matrix. l W l Let the standard binary matrix be the characteristic ciphertext matrix. Each element in can be represented as:

[0128]

[0129] Encryption feature matrix With the encrypted scaling matrix [K l Scaling factor γ l Performing a dot product operation yields the encrypted output matrix [MATRIX_OUT]:

[0130]

[0131] Wherein, scaling factor Scaling matrix

[0132] Where l represents the l-th layer of the neural network, w and h represent the length and width of the convolutional kernel, respectively, and c represents the depth of the convolutional kernel. l This represents the input matrix of the l-th layer of the neural network; the symbol * represents binary convolution, and the symbol · represents dot product; the scaling factor γ l and scaling matrix K l These are all scale parameters, making γ l ·sign(W l )≈W l K l ·sign(I l )≈I l

[0133] The second step is to construct an activation layer, selecting the ReLU function as the activation function to activate the encrypted output matrix from the first step. The implementation process of Boolean-based encrypted ReLU activation is as follows: extract the sign bit of the ciphertext and perform a NOT operation on it to obtain a ciphertext that encrypts 1 bit of data. Then, perform a bitwise AND operation between this ciphertext and the original ciphertext to obtain the activation value of the original ciphertext. For each element [out] in the encrypted output matrix [MATRIX_OUT]... i Calculate the activation value, and output the result as ReLU(out) i ) = max(0,out i ).

[0134] The third step involves constructing a pooling layer to perform max-pooling on the encrypted output matrix from the second step. The boolean-based dense-state max-pooling operation can be implemented using the following ciphertext comparison algorithm:

[0135] [t0]=0,[v i] = [A i ]⊙[B i ]

[0136]

[0137] [R i ]=([t N-1 ]&[A i ])⊙(~[t N-1 ]&[B i ])

[0138] Where [v] and [t] are intermediate variables in the ciphertext comparison algorithm, and [R] is the maximum value output of ciphertexts [A] and [B]. The symbol ~ represents the NOT operation.

[0139] The fourth step is to construct a normalization layer to normalize the encrypted output matrix from the third step. The original normalization formula is expressed as follows: Due to the unique nature of binary convolutional neural networks, this invention does not require knowledge of the normalized feature matrix values. Instead, it only needs to determine whether each item in the matrix is ​​greater than 0. Therefore, only addition operations are required, without the need for multiplication. The addition operation is implemented using an N-bit homomorphic adder. After addition, each item in the resulting encryption matrix is ​​a ciphertext array encrypted with multi-bit data. Binarization of the ciphertext can be achieved through the following steps: extracting the sign bit of the ciphertext and performing a NOT operation on it to obtain a TLWE ciphertext that encrypts a single-bit data. This ciphertext is one item in the output new binary feature matrix.

[0140] The fifth step involves constructing a fully connected layer, taking the encrypted feature vector and a binary weight matrix as input. Each element of the encrypted feature vector is a TLWE ciphertext encrypted with a single bit of data, and each element of the binary weight matrix is ​​a 1-bit plaintext, with each weight value mapped to a real torus. Therefore, when computing neurons, the multiplication operation between plaintext and ciphertext can be converted into an XOR operation between single-bit plaintext and ciphertext. This step is implemented using a bootstrap XOR gate. After the bootstrap gate, a ciphertext expansion operation is required, which expands the ciphertext that encrypts 1-bit data {0,1} into a ciphertext array that encrypts N-bit data {-1,1} bit by bit. The addition operation is implemented using an N-bit homomorphic adder. The output vector is the encryption result vector, where each item is a TLWE ciphertext array that encrypts the neuron's computation result bit by bit. It is important to note that before inputting the encrypted feature vector into the fully connected layer, the encrypted feature matrix needs to be flattened into an encrypted feature vector.

[0141] The method for establishing the activation layer after the fully connected layer is the same as in step two.

[0142] The sixth step involves executing steps one through four twice, step five once, and step two once to construct a homomorphic encryption neural network based on Boolean circuits.

[0143] Example 4

[0144] Based on Embodiment 3, the N-bit homomorphic adder proposed in this invention is as follows: Figure 2 As shown.

[0145] The N-bit homomorphic adder can perform addition operations on two N-bit ciphertexts, outputting a new N-bit ciphertext. A homomorphic full adder can be implemented using combinations of bootstrap XOR gates, bootstrap AND gates, and bootstrap OR gates. Combining N-1 homomorphic full adders with two bootstrap XOR gates will implement an N-bit homomorphic adder.

[0146] This module is composed of N-1 homomorphic full adders and 2 bootstrap XOR gates. The Boolean algebra representation of the homomorphic full adder is:

[0147]

[0148] [C i ] = [A i ]&[B i ]^([C i-1 ]&([A i ]^[B i ]))

[0149] Among them, symbols The symbol '&' represents the XOR operation, '&' represents the AND operation, and '^' represents the OR operation. These operations can be implemented using the bootsXOR, bootsAND, and bootsOR functions in the TFHE scheme.

[0150] Example 5

[0151] Based on Embodiment 4, the dense-state multiplication operation module proposed in this invention is as follows: Figure 3 As shown. HFA stands for Homomorphic Full Adder.

[0152] An N-bit homomorphic array multiplier can perform multiplication of two N-bit ciphertexts, outputting a new 2N-bit ciphertext. This module is composed of N(N-1) homomorphic full adders, and its derivation is as follows:

[0153] Let [A] and [B] be two N-bit ciphertexts, and [P] = [A]·[B], then:

[0154]

[0155]

[0156]

[0157] By setting N=4, a 4-bit dense-state multiplication operation module was implemented.

[0158] Example 6

[0159] Based on the homomorphic encryption-based binary convolutional neural network proposed in Example 1, classification of the encrypted MNIST dataset can be achieved. Table 2 shows a comparison of the runtime and inference accuracy of the encrypted network model provided in this invention with other encrypted network models. The BCCI network implements only one layer of convolutional neural network, lacks ciphertext normalization, and involves more ciphertext multiplication operations than in this example, resulting in a longer runtime and lower inference accuracy. The HCNN network only implements a general convolutional neural network based on homomorphic encryption, resulting in less precision loss and higher accuracy. However, it involves a large number of multi-bit ciphertext multiplication operations during convolution, thus its runtime is approximately four times that of this example.

[0160] Table 2 shows the overall evaluation results for different dense network models.

[0161] Dense-state network model Dense network runtime Reasoning accuracy This example 8h 17m 4s 97.35％ BCCI 16h 12m 39s 97.11％ HCNN 33h 9m 15s 99.00％

[0162] Example 7

[0163] like Figure 4 As shown, based on an arithmetic circuit-based encrypted neural network, this invention improves the original bootstrapping algorithm, which can perform ReLU activation operation on the ciphertext while bootstrapping the high-noise ciphertext [m], thereby outputting a low-noise ciphertext bs_ReLU[m].

[0164] The specific steps in this example include:

[0165] Step 2-1: Input a TLWE to encrypt plaintext m s The ciphertext, i.e., [m] = (a1, a2, ..., a n b), where m is an integer ranging from [-B, B-1]; input a key BK in TGSW format, a key switching key KS, and a test vector testv. Let n = 600 and 2B = 1024.

[0166] Step 2-2: Let Where k∈[1,n]; let in This represents mapping the real number x to the real torus. superior, Let N represent the integer closest to the real number x. Let N = 1024.

[0167] Steps 2-3: Calculation For k∈[1,n], execute the loop. in B g Both 'l' and 'b' are pre-defined parameter values; BK k The key is in TGSW format, i.e. The ciphertext is in TGSW format; ACC is represented in TRLWE format, i.e. The symbol ⊙ represents the outer product, and the result of TGSW⊙TRLWE is the TRLWE ciphertext. Let B g =2 10 l = 3, k = 1.

[0168] Steps 2-4: Extract the TLWE ciphertext from the TRLWE ciphertext ACC, and the torus polynomial. The corresponding constant term is the extracted result TLWE. s′ (ReLU(m)).

[0169] Steps 2-5: Using the key switching key KS, and according to the key switching algorithm provided in the TFHE homomorphic encryption scheme, switch TLWE... s′ (ReLU(m)) is converted to TLWE s (ReLU(m)). Where s represents the original private key, s ′ This is the new private key generated during the bootstrapping process.

[0170] Test results show that the ReLU bootstrap algorithm in this example is valid in the range m∈[-B / 2,B / 2]. Furthermore, using this bootstrap algorithm, the activation layer of a binary convolutional neural network can be successfully constructed, and correct calculation results can be obtained.

[0171] Example 8

[0172] Based on the improved bootstrapping algorithm proposed in Example 1, this example proposes a homomorphic encryption neural network model based on arithmetic circuits, as follows: Figure 2 As shown.

[0173] The specific steps in this example include:

[0174] Operation 1: Constructing a convolutional layer: Input the preprocessed and TFHE-encrypted standard binary image matrix and the standard binary weight matrix, and map each weight value to a real torus. The algorithm performs a binary convolution operation on the two input matrices, outputting a high-noise encrypted feature matrix. It's important to note that the preprocessing and encryption steps are performed on the MNIST dataset. In practical applications, these steps are executed by the client, while the cloud platform constructs the encrypted neural network and processes the encrypted data. This example proposes a method for implementing a homomorphic encrypted neural network based on arithmetic circuits from a cloud perspective.

[0175] The specific steps of this operation include:

[0176] Step 1: Input the preprocessed and TFHE encrypted dimensions as follows The standard binary image matrix [C] and the standard binary weight matrix W1 of size (ω1, ω2, ω3, ω3′). Each item in [A] is a TLWE ciphertext, i.e., [c i,j,t ]=(a1,a2,……,a n b), Each weight value is mapped to a real torus. Above, that is Where the private key s = (s1, s2, ..., s n ), for the set {0,1} n A random uniform distribution on the public key a = (a1, a2, ..., a...). n ),for The input matrix W is a random uniform distribution on (0,σ); the noise e is a Gaussian distribution on (0,σ), where σ is the set standard deviation, and n is the set key parameter; ω1, ω2, and ω3 are the length, width, and depth of the weight matrix W, respectively, and ω3 is also the depth of the input matrix. Let ω1 be the length and width of the input matrix, and ω3′ be the depth of the output matrix. In this example, let ω1 = ω2 = 5. In different convolutional layers, The settings for ω3 and ω3′ are changing.

[0177] Step 2: Perform convolution operation Output a high-noise encrypted feature matrix [C1]. Each item in [C1] is the TLWE ciphertext, i.e. For any t ′ ∈[1,ω3′], k∈[1,n], there are

[0178] Step 3: Perform binary convolution to obtain a high-noise encryption feature matrix [C2]. Each item in [C2] can be represented as... in

[0179] Operation 2: Establish activation layer: Input a high-noise encrypted feature matrix, execute the optimized bootstrap algorithm on each item in the matrix, and output a low-noise encrypted feature matrix.

[0180] The specific steps of this operation include:

[0181] Step 1: Input dimensions as The high-noise encryption feature matrix [C2].

[0182] Step 2: Execute the optimized bootstrap algorithm on each item in the matrix, outputting a low-noise encrypted feature matrix [C3]. This encrypted feature matrix is ​​the result of ReLU activation of the input matrix, and its output size is...

[0183] Operation 3: Establish a max pooling layer: Input a low-noise encrypted feature matrix, use the optimized bootstrap algorithm to compare the two ciphertexts, and output a low-noise dimensionality-reduced encrypted feature matrix.

[0184] The specific steps of this operation include:

[0185] Step 1: Input the low-noise encryption feature matrix [C3].

[0186] Step 2: Utilize the optimized bootstrap algorithm to compare the two ciphertexts and output a low-noise, dimensionality-reduced encrypted feature matrix [C4]. Compare the four TLWE ciphertexts [x1], [x2], [x3], and [x4], and calculate the maximum value. Specifically, y1 = max([x1], [x2]) = [x1] + bs_ReLU([x2] - [x1]), y2 = max([x3], [x4]) = [x3] + bs_ReLU([x4] - [x3]), max([x1], [x2], [x3], [x4]) = max([y1], [y2]) = [y1] + bs_ReLU([y2] - [y1]). The size of the output matrix is...

[0187] Operation 4: Establish a normalization layer: Input a low-noise, dimensionality-reduced encrypted feature matrix, normalize it, perform homomorphic evaluation on the normalized dense state result, and output a new binary feature matrix encrypted with ±1.

[0188] The specific steps of this operation include:

[0189] Step 1: Input the low-noise dimensionality-reduced encrypted feature matrix [C4] and normalize it. The original normalization formula is: Due to the special nature of binary convolutional neural networks, this invention does not require knowledge of the normalized feature matrix values. Instead, it only needs to determine whether each item in the matrix is ​​greater than 0. Therefore, only subtraction operations are required, and division operations are unnecessary. The normalization layer can be optimized as follows: for each item [c] in [C3]... i″,j″,t″ ], calculate each term in [C4] That's fine. (Among them) t″∈[1,ω3′], μ is the known mean.

[0190] Step 2: Use the original bootstrap algorithm to perform homomorphic evaluation on the normalized dense state result, and output a new binary feature matrix encrypted with ±1 [C5], i.e. The size of the output matrix is

[0191] Operation 5: Establish a fully connected layer: Input the encrypted feature vector and the binary weight matrix, and map each weight value to a real torus. The algorithm performs corresponding multiplication and summation operations on the two inputs, outputting a one-dimensional encrypted result vector. It's important to note that the encrypted feature matrix needs to be flattened into an encrypted feature vector before inputting the encrypted feature vector into the fully connected layer.

[0192] The specific steps of this operation include:

[0193] Step 1: Input the encrypted binary feature vector c and the binary weight matrix W2, and map each weight value to the real number torus. superior.

[0194] Step 2: Perform the corresponding multiplication and summation operations on the two inputs, and output a one-dimensional encrypted result vector. The j-th term of this vector can be represented as ∑ i [c i ]·w i,j , where the value of i ranges from [1, length(c)].

[0195] The method for establishing fully connected layers is similar to that for convolutional layers. For the method for establishing activation layers after fully connected layers, refer to operation 2.

[0196] Table 3 shows a comparison of the bootstrap number and running time between the homomorphic encryption neural network based on Boolean circuits and the homomorphic encryption neural network based on arithmetic circuits provided by this invention. The homomorphic encryption neural network based on arithmetic circuits achieves an approximately 584-fold increase in running speed.

[0197] Table 3 Evaluation results based on arithmetic circuit networks and Boolean circuit networks

[0198] Dense-state network model Number of times Dense network runtime Based on Boolean circuits ≈2.8M 8h 17m 4s Based on arithmetic circuits 5184 51s

[0199] In summary, this embodiment expands the plaintext message space of the TFHE scheme. The original TFHE library only supports calculations on binary data, which has significant limitations. This invention expands the plaintext message space from {0,1} to [-B,B-1], enabling TFHE to support direct multiplication and addition operations based on arithmetic circuits. The original bootstrap algorithm is also improved. The original bootstrap algorithm only supports bootstrapping using the sign function. To construct a binary convolutional neural network, this algorithm cannot perform ReLU activation on high-noise ciphertext. The improved algorithm in this invention can perform ReLU activation on ciphertext while bootstrapping high-noise ciphertext, outputting low-noise ciphertext. The improved bootstrap algorithm allows the activation layer to be successfully constructed, and the entire encrypted neural network to operate correctly. A method for implementing a homomorphic encrypted neural network based on arithmetic circuits is proposed, solving the problems of high computational overhead and slow execution time of existing Boolean circuit-based encrypted neural networks. Compared to Boolean circuits, arithmetic circuits only introduce bootstrap gates in the activation and pooling layers, while each layer of a Boolean circuit requires bootstrap gates. Operations such as multiplication and addition require combining different bootstrap gates. Therefore, a Boolean circuit-based cryptographic neural network requires far more bootstrap gates than an arithmetic circuit-based cryptographic neural network, resulting in huge computational overhead and slow runtime.

Claims

1. A method for implementing a binary convolutional neural network based on homomorphic encryption, characterized in that, The method comprises the following steps: Step 1: The cloud end normalizes and binarizes the MNIST dataset to obtain binary image data; The cloud end constructs a binary convolutional neural network model under plaintext, and trains network parameters; Step 2: The client uses the TFHE encryption scheme to homomorphically encrypt the binary image data, and transmits the encrypted image data to the cloud end; Step 3: The cloud end constructs an encrypted neural network based on a Boolean circuit according to the trained network parameters, performs inference on the encrypted image data, and transmits the ciphertext inference result to the client; Step 4: The client decrypts the ciphertext inference result to obtain the final result; In step 3, the cloud end constructs an encrypted neural network based on a Boolean circuit according to the trained network parameters, performs inference on the encrypted image data, and obtains a ciphertext result, which comprises the following steps: Step 31: Construct a convolutional layer: Step 311, performing non-standard binarization on the binary weight matrix W l to obtain a non-standard binary weight matrix Step 312, performing ciphertext input matrix and weight matrix The ciphertext binary convolution operation is performed, that is, the exclusive OR operation between non-standard binary and the ciphertext expansion operation are used to replace the multiplication operation between standard binary, and then a sum operation is realized through an N-bit homomorphic adder to obtain a feature ciphertext matrix; Wherein, the ciphertext logic operation between non-standard binary is realized by calling the bootstrap gate in the TFHE library; the ciphertext expansion operation expands the ciphertext of encrypting single-bit data {0, 1} into a ciphertext array of encrypting multi-bit data {-1, 1} bit by bit; an N-bit homomorphic adder is composed of N-1 homomorphic full adders and 2 bootstrap XOR gates; Step 313, point multiplication operation is performed on the feature ciphertext matrix and the encryption scaling matrix [K l ] and the scaling factor γ l to obtain a ciphertext output matrix; wherein the homomorphic multiplication operation is implemented by an N-bit homomorphic array multiplier composed of N(N-1) homomorphic full adders. Step 32: Construct an activation layer: Select the ReLU function as the activation function, and take the activation value as the output of the convolutional layer; the ReLU activation of the ciphertext can be realized by the following steps: extracting the sign bit of the ciphertext and performing the NOT operation on it to obtain a ciphertext of encrypting 1-bit data, and then performing bitwise AND operation between the ciphertext and the original ciphertext to obtain the activation value of the original ciphertext; Step 33: Construct a max pooling layer, and the max pooling operation is realized by a ciphertext comparison algorithm: [t0] = 0, [v i ] = [A i ] ⊙ [B i ] [R i ] = ([t N-1 ] & [A i ]) o (~[t N-1 ] & [B i ]) Wherein, [v] and [t] are intermediate variables in the ciphertext comparison algorithm, [R] is the maximum value output of the ciphertexts [A] and [B]; the symbol ~ represents the non-operation, the symbol represents the Xor operation, the symbol represents the Xor operation, and the symbol & represents the And operation. Step 34: Construct a normalization layer: The original normalization formula is expressed as where x i represents the original data, y i represents the processed data, μ is the mean, σ 2 is the variance, and * is a constant greater than zero; Step 35: Construct a fully connected layer, which is similar to the activation layer, except that each node in the fully connected layer is connected to all nodes in the previous layer; In step 3, the cloud end constructs an encrypted neural network based on an arithmetic circuit according to the trained network parameters, performs inference on the encrypted image data, and obtains a ciphertext result, which comprises the following steps: Step 3a, establishing convolution layer: input the pre-processed and TFHE-encrypted standard binary image matrix and the standard binary weight matrix, and map each weight value to the real number ring surface Above, the convolution operation is performed on the two input matrices, and an encrypted feature matrix with high noise is output. Step 3b, establish an activation layer: input the encrypted feature matrix with high noise, execute the optimized bootstrap algorithm on each item in the matrix, and output the encrypted feature matrix with low noise; The optimized bootstrap algorithm realizes the ReLU activation operation of the ciphertext while bootstrapping the high-noise ciphertext [m], thereby outputting a low-noise ciphertext bs_ReLU[m]; Step 3b-1: input a TLWE which encrypts plaintext m s Ciphertext, i.e. [m] = (a1, a2, …, a n , b), m is an integer, the value range is [-B, B-1]; input a TGSW form key BK, a key switching key KS, a test vector testv; take n = 600, 2B = 1024; Step 3b-2: Let where k e [1, n]; Let where represents the mapping of a real number x to the real torus , represents the integer closest to the real number x; take N = 1024; Step 3b-3: Calculation For k ∈ [1, n], loop execution Wherein B g , l are set parameter values; BK k is a key in the form of TGSW, that is is a ciphertext in the form of TGSW; ACC is in the form of TRLWE, that is The symbol ⊙ represents an outer product, and the result of TGSW ⊙ TRLWE is a TRLWE ciphertext; Let B g = 2 10 , l = 3, k = 1; Step 3b-4: Extracting TLWE ciphertext from TRLWE ciphertext ACC, torus polynomial The constant term in the middle corresponds to the result TLWE s ′(ReLU(m)); Step 3b-5: Convert TLWE (ReLU(m)) to TLWE (ReLU(m)) using the key switching key KS according to the key switching algorithm provided in the TFHE homomorphic encryption scheme. s Step 3b-5: Convert TLWE (ReLU(m)) to TLWE (ReLU(m)) using the key switching key KS according to the key switching algorithm provided in the TFHE homomorphic encryption scheme. s Step 3b-5: Convert TLWE (ReLU(m)) to TLWE (ReLU(m)) using the key switching key KS according to the key switching algorithm provided in the TFHE homomorphic encryption scheme. where s represents the original private key, and s' is the new private key generated in the bootstrap process. Step 3c, establish a max pooling layer: input the encrypted feature matrix with low noise, realize the comparison operation of two ciphertexts by using the optimized bootstrap algorithm, and output the low-noise reduced-dimension encrypted feature matrix; Step 3d, establish a normalization layer: input the low-noise reduced-dimension encrypted feature matrix, normalize it, and homomorphically evaluate the normalized ciphertext result, output a new binary feature matrix encrypted for ±1; Step 3e, establishing a full connection layer: inputting an encrypted binary feature vector and a binary weight matrix, and mapping each weight value to a real number ring surface In summary, corresponding multiplication and summation operations are performed on two inputs, and an encrypted result vector is output. Step 3c specifically comprises: Step 1: input the encrypted feature matrix [C3] with low noise; Step 2: Perform comparison operation on the two ciphertexts using the optimized bootstrap algorithm, and output a low-noise reduced-dimension encrypted feature matrix [C4]; Compare the four TLWE ciphertexts [x1], [x2], [x3], [x4], calculate the maximum value, and the specific implementation is as follows: y1 = max([x1], [x2]) = [x1] + bs_ReLU([x2] - [x1]), y2 = max([x3], [x4]) = [x3] + bs_ReLU([x4] - [x3]), max([x1], [x2], [x3], [x4]) = max([y1], [y2]) = [y1] + bs_ReLU([y2] - [y1]); The size of the output matrix is ω1, ω2, ω3 are the length, width, and depth of the weight matrix W, respectively, ω1' and ω2' are the length and width of the input matrix, and ω3' is the depth of the output matrix. Step 3d specifically includes: Step 1: Input the low-noise reduced-dimension encrypted feature matrix [C4] and normalize it; The original normalization formula is The establishment mode of the normalization layer can be optimized as follows: for each term [c i″,j″,t″ ] in [C3], each term in [C4] is calculated That is, wherein t" e [1, ω3'], μ is a known mean value; Step 2: Homomorphically evaluate the normalized ciphertext results with the original bootstrapping algorithm, output a new binary feature matrix [C5] encrypted to ±1, that is The size of the output matrix is 2.The method of claim 1, wherein, In step 1, the cloud performs normalization and binarization processing on the MNIST dataset, which includes the following steps: Step 11: Batch normalization on the MNIST dataset: where x i represents raw data, y i represents processed data, μ is the mean, σ 2 is the variance, and * is a constant greater than zero; Step 12: binarization processing is performed on the normalized data to obtain binary image data In step 1, the cloud constructs a binary convolutional neural network model under plaintext, which includes the following steps: Step 13, determine the binary convolutional neural network structure; Step 14, establish the forward propagation process of the binary convolutional neural network, including: Step 141, binarizing the weight matrix W l to obtain a binary weight matrix sign(W l ). Step 142, compute scaling factor γ l , real-valued weights and scaling matrix K l ; where l denotes the l-th layer of the neural network, ω1 and ω2 denote the length and width of the convolution kernel respectively, ω3 denotes the depth of the convolution kernel, I l denotes the input matrix of the l-th layer of the neural network, the symbol * denotes the binary convolution operation, and the symbol · denotes the dot product operation; the scaling factor γ l and the scaling matrix K l are both scale parameters, such that γ l · sign(W l ) ≈ W l , K l · sign(I l ) ≈ I l ; Step 143, after performing binary convolution operation, use ReLU nonlinear function to activate the operation result; Step 15: define the cross-entropy loss function L, establish the back propagation process of the binary convolutional neural network, and update the parameters by gradient descent method: Wherein, is the true value, that is, the target of neural network training; y k is the output value of the full connection layer, that is, the result of neural network training; In a binary convolutional neural network, the gradient of the sign function is expressed as: Step 16: Determine the optimal model by iteratively training the optimal parameters.

3. The homomorphic encryption based binary convolutional neural network implementation method according to claim 2, characterized in that, In step 2, the client uses the TFHE encryption scheme to homomorphically encrypt the binary image data, which includes the following steps: The encryption method of the encrypted neural network based on Boolean circuit is: Step 21: non-standard binary processing is performed on the binary image data matrix [I], i.e. the data with values of ±1 is binary processed into 0 and 1 to obtain a non-standard binary matrix The processed image data has a bit width of 1 bit. Step 22: Encrypt each element in the non-standard binary matrix using the TFHE homomorphic encryption scheme, resulting in a non-standard binary ciphertext matrix The encryption process includes: Map a single-bit plaintext message m e {0,1} to the real torus Above, i.e. real numbers modulo 1, yielding Compute b = <s, a> + m' / 2 + e, where the private key s = (s1, s2, …, s n ) is a random uniform distribution over the set {0, 1} n}; the public key a = (a1, a2, …, a n ) is a random uniform distribution over the set }; the noise e is a Gaussian distribution over (0, σ), σ is a set standard deviation value; n is a set key parameter; the ciphertext (a, b) is obtained; [·] represents the ciphertext form; Step 23: Taking 10-bit precision for each element in the scaling matrix K l , repeating step 22, performing bit-by-bit encryption on the elements to obtain an encrypted scaling matrix [K l ], the elements in the encrypted scaling matrix [K l ] constitute a ciphertext array in the form of 10-TLWE; The encryption method of the encrypted neural network based on arithmetic circuit is: Directly apply the following to each element I in the binary image data matrix [I] i,j,t Perform TLWE encryption, i.e., [I i,j,t ]=(a1,a2,……,a n b), Where i, j, and t are index values.

4. The homomorphic encryption based binary convolutional neural network implementation method according to claim 3, characterized in that, In step 4, the process of decrypting the ciphertext inference result by the client is further: The encryption neural network decryption process based on the Boolean circuit is: calculating the phase of each element of the ciphertext array If the decrypted value is 1, otherwise 0; each element x i in the ciphertext array represents a bit, and the calculation of ∑ i x i ·2 i can obtain a plaintext message represented by a ciphertext array; the client decrypts all the ciphertext arrays to obtain the final classification result; The encryption neural network decryption process based on the arithmetic circuit is: calculating the phase of each item in the encryption result vector Reflecting the obtained result from the torus to the integer field, that is, calculating The final decryption result is obtained.

5. The binary convolutional neural network implementation method based on homomorphic encryption according to claim 1, characterized in that, In step 3a, the process of establishing a convolutional layer includes: Input the preprocessed and TFHE-encrypted standard binary image matrix [I], and the standard binary weight matrix W1, where each element is TLWE ciphertext, i.e., [I] i,j,t ]=(a1,a2,……,a n b), Each weight value in W1 is mapped to a real torus. Above, that is Where the private key s = (s1, s2, ..., s n ), for the set {0,1} n A random uniform distribution on the public key a = (a1, a2, ..., a...). n ),for The noise e is a random uniform distribution on (0,σ), where σ is the set standard deviation and n is the set key parameter. Performing convolution operations Output high noise [I1], encrypt each item in the feature matrix [I1] as TLWE ciphertext, that is wherein wherein ω1, ω2, ω3 are the length, width, depth of the weight matrix W, respectively. The binary convolution operation is performed to obtain a high-noise encrypted feature matrix [I2], each item in the encrypted feature matrix [I2] is expressed as wherein In step 3b, the establishment of the activation layer specifically includes the following steps: Input the high-noise encrypted feature matrix [I2]; Perform the optimized bootstrap algorithm bs_ReLU on each item in the matrix to output a low-noise encrypted feature matrix [I3], which is the result of ReLU activation on the input matrix.

6. The system for homomorphic encryption based binary convolutional neural network implementation method according to claim 1, wherein, Including: The cloud is used to normalize and binarize the MNIST dataset to obtain binary image data and send it to the client; Construct a binary convolutional neural network model under plaintext on the cloud, train the network parameters, and construct an encrypted neural network based on Boolean circuit according to the trained network parameters; After receiving the encrypted image data sent by the client, the cloud performs inference on the encrypted image data and transmits the ciphertext inference result to the client; The client is used to receive the binary image data from the cloud and homomorphically encrypt the binary image data using the TFHE encryption scheme, and transmit the encrypted image data to the cloud; After receiving the ciphertext inference result returned by the cloud, decrypt the ciphertext inference result to obtain the final result.

Images