A model prediction method and device with privacy protection, equipment and medium

Abstract

The application discloses a model prediction method and device with privacy protection, equipment and medium in the computer technology field. The application provides a plurality of operation protocols, which can realize the calculation of a relatively complex nonlinear function. In the application, the user private key, the weight parameter and the bias parameter of the model are respectively protected in a secret sharing manner, which can improve the security of the protected data, and the modification of the user public and private keys and the model deployment do not affect each other. It can be seen that the application can improve the prediction accuracy of the model for ciphertext data, and important data such as the user private key, the weight parameter and the bias parameter of the model that need to be protected can also be better protected, and the scheme expansion and subsequent maintenance are also facilitated. Correspondingly, the model prediction device, equipment and medium with privacy protection provided by the application also have the above technical effects.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a privacy-preserving model prediction method, apparatus, device, and medium. Background Technology

[0002] Currently, fully homomorphic encryption is generally used to encrypt model parameters and user data, that is, using the same public-private key pair to encrypt both. This approach is not suitable for calculating complex nonlinear functions and requires simplifying the original activation function of the model. For example, a simple linear function might be used to replace the complex nonlinear activation function, or a piecewise linear approximation might be used to approximate the complex nonlinear activation function. These methods all reduce the accuracy of model predictions. Fully homomorphic encryption also accumulates more computational errors with each prediction attempt, further reducing the accuracy of the prediction results. Furthermore, when a user modifies the public-private key pair, the model needs to be redeployed, adding extra steps.

[0003] Therefore, how to improve the accuracy of model predictions for encrypted data is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0004] In view of this, the purpose of this application is to provide a privacy-preserving model prediction method, apparatus, device, and medium to improve the prediction accuracy of the model for encrypted data. The specific solution is as follows:

[0005] Firstly, this application provides a privacy-preserving model prediction method applied to a main server, comprising:

[0006] Receive ciphertext of user data sent by the user client, which is encrypted using the user's public key;

[0007] The encrypted user data is processed based on the user's private key, which is represented in a secret sharing manner, the operation protocol used to implement the model operation in the target model, and the weight parameters and bias parameters of the target model, which are also represented in a secret sharing manner, to obtain the prediction result encrypted by the target model for the encrypted user data.

[0008] The operation protocol includes at least one or a combination of the following: truncation protocol, comparison protocol, encrypted multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponentiation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol.

[0009] The ciphertext of the prediction result is sent to the user terminal, so that the user terminal can decrypt the ciphertext of the prediction result using the user's private key to obtain the plaintext of the prediction result.

[0010] Optionally, the weight parameters and bias parameters of the target model are divided into first model sub-parameters and second model sub-parameters in a secret sharing manner, and the user private key is divided into first private key sub-parameters and second private key sub-parameters in a secret sharing manner; the first model sub-parameters, the first private key sub-parameters and the model structure of the target model are stored on the master server; the second model sub-parameters and the second private key sub-parameters are stored on the slave master server;

[0011] Accordingly, the step of processing the encrypted user data based on the user's private key represented in a secret sharing manner, the operation protocol used to implement model operations in the target model, and the weight parameters and bias parameters of the target model represented in a secret sharing manner includes: enabling the slave server to cooperate with the master server to process the encrypted user data based on the operation protocol, the first model sub-parameter, the first private key sub-parameter, the second model sub-parameter, and the second private key sub-parameter.

[0012] Optionally, the model uploader randomly divides the weight parameters of the target model into a first sub-weight and a second sub-weight through secret sharing, and randomly divides the bias parameters of the target model into a first sub-bias and a second sub-bias through secret sharing. The first sub-weight and the first sub-bias are used as the first model sub-parameters, and the second sub-weight and the second sub-bias are used as the second model sub-parameters.

[0013] Optionally, the user terminal randomly divides the user's private key into the first private key sub-parameter and the second private key sub-parameter using an additive secret sharing method.

[0014] Optionally, before sending the encrypted user data, the user terminal converts the plaintext user data from a fixed-point number to an integer, and uses the user's public key to encrypt the plaintext user data represented by the integer to obtain the encrypted user data.

[0015] Optionally, the user terminal converts the plaintext user data from fixed-point numbers to integers, including: the user terminal converts the plaintext user data from fixed-point numbers to integers according to a preset conversion formula; wherein, the preset conversion formula is:

[0016]

[0017] in, f represents the plaintext of the user data in fixed-point representation. p The bit length of the user data plaintext in binary fractional form as a fixed-point number, and l represent the bit length of the user data plaintext in integer form after conversion. This represents the plaintext user data, expressed as an integer after conversion.

[0018] Optionally, it also includes: the user terminal adjusting f according to user operations. p The value of .

[0019] Secondly, this application provides a privacy-preserving model prediction device applied to a main server, comprising:

[0020] The receiving module is used to receive ciphertext of user data sent by the user terminal, which is encrypted using the user's public key;

[0021] The processing module is used to process the encrypted user data based on a user's private key represented in a secret sharing manner, a computational protocol for implementing model operations in the target model, and weight parameters and bias parameters of the target model represented in a secret sharing manner, to obtain the ciphertext of the prediction result of the target model for the encrypted user data; wherein, the computational protocol includes at least one or a combination of: truncation protocol, comparison protocol, ciphertext multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponentiation operation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol;

[0022] The sending module is used to send the ciphertext of the prediction result to the user terminal, so that the user terminal can decrypt the ciphertext of the prediction result using the user's private key to obtain the plaintext of the prediction result.

[0023] Thirdly, this application provides an electronic device, comprising:

[0024] Memory, used to store computer programs;

[0025] A processor is configured to execute the computer program to implement the aforementioned privacy-preserving model prediction method.

[0026] Fourthly, this application provides a readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned privacy-preserving model prediction method.

[0027] As can be seen from the above scheme, this application provides a privacy-preserving model prediction method applied to a main server, comprising: receiving encrypted user data sent by a user terminal using a user's public key; processing the encrypted user data based on a user's private key represented in a secret sharing manner, a computational protocol for implementing model operations in a target model, and weight parameters and bias parameters of the target model represented in a secret sharing manner, to obtain an encrypted prediction result of the target model for the encrypted user data; wherein, the computational protocol includes at least one or a combination of: truncation protocol, comparison protocol, encrypted multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponentiation operation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol; sending the encrypted prediction result to the user terminal, so that the user terminal decrypts the encrypted prediction result using the user's private key to obtain the plaintext prediction result.

[0028] As can be seen, the master server in this application can process the encrypted user data based on the user's private key (represented in a secret sharing manner), the computational protocol used to implement model operations in the target model, and the weight and bias parameters of the target model (represented in a secret sharing manner), to obtain the encrypted prediction result of the target model for the encrypted user data. The computational protocol includes at least one or a combination of: truncation protocol, comparison protocol, encrypted multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponentiation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol. This allows for the calculation of relatively complex nonlinear functions without modifying the model activation function, thus ensuring the accuracy of the model's prediction results. Furthermore, the user's private key, model weight parameters, and bias parameters are protected through secret sharing. This enhances the security of these parameters while avoiding computational errors introduced by fully homomorphic encryption. Consequently, the user's public and private keys are not used for encrypting model parameters, meaning modifications to these keys and model deployment are independent; the model does not need to be redeployed after a user modifies the key pair. Therefore, this application improves the model's prediction accuracy for encrypted data, provides better security for critical data such as the user's private key, model weight parameters, and bias parameters, and facilitates solution expansion and subsequent maintenance.

[0029] Correspondingly, the privacy-preserving model prediction device, equipment, and medium provided in this application also have the aforementioned technical effects. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1 This is a flowchart of a privacy-preserving model prediction method disclosed in this application;

[0032] Figure 2 This is a schematic diagram of one of the scheme architectures disclosed in this application;

[0033] Figure 3 This is a schematic diagram of a privacy-preserving model prediction device disclosed in this application;

[0034] Figure 4 This is a schematic diagram of an electronic device disclosed in this application. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] Currently, existing fully homomorphic encryption techniques are not suitable for calculating complex nonlinear functions, requiring simplification of the original activation function of the model. For example, simple linear functions can be used to replace complex nonlinear activation functions, or piecewise linear approximations can be used to approximate complex nonlinear activation functions. These methods all reduce the accuracy of model predictions. Discretizing the model weights to -1 and 1, and using the activation function y = sign(x) with only integer operations, while suitable for fully homomorphic encryption schemes, often results in low prediction accuracy. Fully homomorphic encryption also accumulates more computational errors with each prediction attempt, further reducing the accuracy of the prediction results. Furthermore, after a user modifies the public / private key pair, the model needs to be redeployed, adding extra steps. Therefore, this application provides a privacy-preserving model prediction scheme that can improve the model's prediction accuracy for encrypted data and enhance the security protection of important data such as the user's private key, model weight parameters, and bias parameters.

[0037] See Figure 1 As shown in the figure, this application discloses a privacy-preserving model prediction method applied to a main server, including:

[0038] S101. Receive user data ciphertext encrypted with the user's public key sent by the user terminal.

[0039] In this embodiment, the plaintext user data can be images, text, or other data. The user's public and private keys are generated using a cryptographic algorithm chosen by the user, for example, by the user choosing the security parameters of a Paillier additive homomorphic encryption scheme. Specifically, using a 1024-bit Paillier additive homomorphic encryption scheme, the user first selects two large 512-bit prime numbers p and q on the user's end. Then, the public and private keys are calculated. The public key pk: n = p·q, g = 1 + n; the private key sk: λ = lcm(p-1, q-1); pk = (n, g), sk = λ; lcm(p-1, q-1) represents finding the least common multiple of p-1 and q-1.

[0040] S102. Based on the user's private key represented in a secret sharing manner, the operation protocol used to implement the model operation in the target model, and the weight parameters and bias parameters of the target model represented in a secret sharing manner, process the user data ciphertext to obtain the prediction result ciphertext of the target model for the user data ciphertext.

[0041] In this embodiment, the target model can be any model trained using deep learning, such as a neural network model. The weight and bias parameters of the target model are represented in an encrypted manner, and user data is also processed in ciphertext, thus ensuring the security of both user data and the model.

[0042] Secret sharing can divide the same secret into several secret subsets, each stored in a different location. The original secret can only be reconstructed by merging the secret subsets from all locations according to specific rules. Therefore, secret sharing effectively prevents attacks. Accordingly, this embodiment protects the user's private key, the model's weight parameters, and bias parameters in this way, effectively improving the security of this data. Specifically, the user's private key can be divided into two parts and stored on two separate servers; similarly, the model's weight parameters and bias parameters can also be divided into two parts and stored on two separate servers. Therefore, in one implementation, the target model's weight parameters and bias parameters are divided into first model sub-parameters and second model sub-parameters using secret sharing, and the user's private key is divided into first private key sub-parameters and second private key sub-parameters using secret sharing; wherein, the first model sub-parameters, the first private key sub-parameters, and the target model's model structure are stored on the master server; the second model sub-parameters and the second private key sub-parameters are stored on the slave master server. Accordingly, processing the encrypted user data based on the user's private key, which is represented in a secret sharing manner, the computation protocol used to implement model operations in the target model, and the weight parameters and bias parameters of the target model, which are represented in a secret sharing manner, includes: enabling the slave server to cooperate with the master server to process the encrypted user data based on the computation protocol, the first model sub-parameter, the first private key sub-parameter, the second model sub-parameter, and the second private key sub-parameter.

[0043] In one example, the model uploader randomly divides the target model's weight parameters into a first sub-weight and a second sub-weight through secret sharing, and randomly divides the target model's bias parameters into a first sub-bias and a second sub-bias through secret sharing. The first sub-weight and the first sub-bias are used as the first model sub-parameters, and the second sub-weight and the second sub-bias are used as the second model sub-parameters.

[0044] For example: Under the operation of the model owner, the model uploader randomly divides the model weight matrix W (i.e., weight parameters) into two parts using an additive secret sharing method: <w>0 (i.e., the first sub-weight) and <w>1 (i.e., the second sub-weight), randomly divide the bias matrix B (i.e., the bias parameters) into two parts: 0 (i.e., first sub-bias) and 1 (i.e., the second sub-bias), where, <w>0 and <w>The opposite element in 1 <w j,k >0、 <w j,k >1 satisfies: ( <w j,k >0+ <w j,k >1) mod 2 l =w j,k , <w i,k >0∈ <w> 0，<w i,k >1∈ <w> 1； 0 and The opposite element in 1 j,k >0、 j,k >1 satisfies: ( j,k >0+ j,k >1) mod 2 l =b j,k , i,k >0∈ 0，<b i,k >1∈ 1. Afterwards, the model uploader will, based on the model owner's upload operation,... <w>0 and 0 is sent to the main server for storage. <w>1 and 1. The data is sent to the slave server for storage. The model uploader communicates with the master server and the slave server via secure, encrypted channels.

[0045] In one example, the client randomly divides its private key into a first private key sub-parameter and a second private key sub-parameter using an additive secret sharing method. For example, under user operation, the client divides its own private key sk into sk0 (i.e., the first private key sub-parameter) and sk1 (i.e., the second private key sub-parameter), satisfying the following condition: n = p·q. Then, using the Chinese Remainder Theorem, we can solve for x = ... <sk> 0+ <sk>1. Perform addition on x and share the secret, thereby dividing x into... <x>0 and <x>1, then let sk0 = <x>0,sk1= <x>You can obtain two secret copies of the private key sk: sk0 and sk1.

[0046] In this embodiment, the operation protocol includes at least one or a combination of the following: Trunc protocol, Comparison protocol (SCmp), Ciphertext Multiplication protocol (SMul), Absolute Value Calculation protocol (SABS), First Character Acquisition protocol (SGP), Division protocol (SDiv), Matrix Multiplication protocol (SMMul), Exponentiation protocol (SExp), Average Pooling protocol (SAP), Max Pooling protocol (SMP), and ReLU Activation Function Calculation protocol (SReLU). Among them, the truncation protocol can extract the low k bits of the ciphertext data; the comparison protocol can calculate the comparison result of two ciphertexts; the ciphertext multiplication protocol can calculate the multiplication result of two ciphertexts; the absolute value calculation protocol can calculate the absolute value of the ciphertext data; the first character acquisition protocol can determine the first character of the ciphertext data; the division protocol can calculate the division result of two ciphertexts; the matrix multiplication protocol can perform multiplication operations on the model weight matrix and the model bias matrix; the exponentiation operation protocol can perform exponentiation operations on the input ciphertext data; the average pooling protocol can calculate the mean of multiple ciphertext data; the max pooling protocol can determine the maximum value among multiple ciphertext data; and the ReLU activation function calculation protocol can output the corresponding activation function calculation result for the input ciphertext data.

[0047] S103. Send the ciphertext of the prediction result to the user terminal so that the user terminal can decrypt the ciphertext of the prediction result using the user's private key to obtain the plaintext of the prediction result.

[0048] In one implementation, before sending the encrypted user data, the user terminal converts the plaintext user data from a fixed-point number to an integer, and then encrypts the plaintext user data represented by the integer using the user's public key to obtain the encrypted user data. The conversion of the plaintext user data from a fixed-point number to an integer by the user terminal includes: the user terminal converting the plaintext user data from a fixed-point number to an integer according to a preset conversion formula; wherein the preset conversion formula is:

[0049]

[0050] in, f represents plaintext user data represented in fixed-point numbers. p The bit length of the user data plaintext in binary fractional form as a fixed-point number, and l represent the bit length of the user data plaintext in integer form after conversion. This represents the converted plaintext user data, expressed as an integer. The user terminal can adjust f based on user actions. p The value of f is used to adjust the precision of the fixed-point number. p The subscript p has no actual meaning.

[0051] Referring to the preset conversion formula above, the formula for converting plaintext user data or other data from integers to fixed-point numbers is as follows:

[0052]

[0053] in, f represents the converted data in integer form. p The bit length of the converted data in binary fractional form (represented as a fixed-point number) is given by , and the bit length of the converted data in integer form is given by . This represents the converted data, expressed in fixed-point numbers.

[0054] Generally, schemes that process model and user data in encrypted form are called privacy-preserving model prediction schemes. The scheme provided in this embodiment does not require modification of the model activation function; the calculation of the model activation function and other model operations can be achieved using a corresponding computational protocol. Furthermore, before encrypting the data, this embodiment converts the data from fixed-point numbers to integers according to a preset conversion formula, which can be achieved through f... p By controlling the precision of fixed-point values, the computational precision of the data used in model calculations can be controlled. Furthermore, by having two servers collaborate to complete various calculations, the computational burden can be shared, improving computational efficiency.

[0055] In this embodiment, the main server can process the encrypted user data based on the user's private key (represented in a secret sharing manner), the computational protocol used to implement model operations in the target model, and the weight and bias parameters of the target model (represented in a secret sharing manner), to obtain the encrypted prediction result of the target model for the encrypted user data. The computational protocol includes at least one or a combination of: truncation protocol, comparison protocol, encrypted multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponential operation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol. This allows for the calculation of complex nonlinear functions without modifying the model activation function, thus ensuring the accuracy of the model prediction results. Furthermore, the user's private key, model weight parameters, and bias parameters are protected in a secret sharing manner, which improves the security of the user's private key, model weight parameters, and bias parameters, and avoids computational errors caused by fully homomorphic encryption technology. Therefore, the user's public and private keys in this application are not used for encrypting model parameters; modifications to the user's public and private keys and model deployment are independent, and the model does not need to be redeployed after the user modifies the public and private key pair.

[0056] As can be seen, this embodiment can improve the model's prediction accuracy for encrypted data, and important data such as the user's private key, the model's weight parameters and bias parameters that need to be protected can also be better protected. It also facilitates scheme expansion and subsequent maintenance.

[0057] Based on the above embodiments, it should be noted that the secure truncation protocol (Trunc), secure comparison protocol (SCmp), secure encrypted multiplication protocol (SMul), secure absolute value calculation protocol (SABS), secure first-digit 1 acquisition protocol (SGP), secure division protocol (SDiv), secure matrix multiplication protocol (SMMul), secure exponential operation protocol (SExp), secure average pooling protocol (SAP), secure max pooling protocol (SMP), and secure ReLU calculation protocol (SReLU) provided in this application can achieve secure calculation of common model activation functions, thus enabling privacy-preserving model prediction. Each operational protocol is described below.

[0058] Protocol 1: Trunc Secure Truncation Protocol. The input to this protocol is a ciphertext. Given an integer k, the output is: a ciphertext. The purpose of this agreement is: to [transfer / deal with / etc.] The lowest k bits of the converted integer are truncated, and the result is guaranteed to be... After conversion back to fixed point, it is approximately equal to Because all fixed-point numbers need to be used before encryption can be performed. Converting to integers, and multiplying two fixed-point numbers will result in twice the original precision, and the bit length of the plaintext corresponding to the result will also increase. In order to adjust the bit length of the plaintext corresponding to the ciphertext after the operation back to 1 bit, a secure truncation protocol is used to perform the truncation operation.

[0059] Specifically, during the execution of the secure intercept protocol, the CS0 party (master server) calls SBD to obtain the ciphertext. The ciphertext bit decomposition result: And calculate [-x l-1 ] pk =Mult p ([x l-1 ] pk (n-1); [y] pk =HoAdd([x]) pk ,[-x l-1 ] pk Then, SBD is called to obtain the ciphertext [y]. pk The ciphertext bit decomposition result ([y l-1 ] pk ,…,[y0] pk )←SBD([y] pk ,l) Calculation C fill =Multp([x l-1 ] pk ,2 l -2 l-k +1); [R] pk =HoAdd([R′]) pk C fill The resulting [R] pk That is

[0060] in, Represent a fixed-point number; Represents a fixed-point number pass The converted l-bit integer; Indicates to Ciphertext obtained by encrypting with public key pk; Indicates the ciphertext Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk );x l-1 ,…,x0 is The binary decomposition result, x l-1 x0 is the most significant bit, x0 is the least significant bit, and x0~x l-1 All values ​​are taken from {0,1}; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk This indicates that a homomorphic addition operation is performed on two ciphertexts to obtain a result ciphertext, such that the plaintext corresponding to the result ciphertext is d1+d2; y,R′,C fill These are all intermediate results generated from calculations; [R] pk The final result of the protocol calculation, i.e.

[0061]

[0062] Protocol 2: Secure Comparison Protocol (SCmp). The input to this protocol is two ciphertexts. and The output is: the comparison result of the two ciphertexts corresponding to the plaintexts [r]. pk ,when When r is true, r = 1; otherwise, r = 0. Many functions in common neural network models may use comparison operations, such as max pooling. Therefore, a secure comparison protocol can be used to achieve secure comparison of two ciphertexts without revealing any private data.

[0063] Specifically, during the execution of the secure comparison protocol, the CS0 side calls SBD to obtain the ciphertext. and ciphertext The ciphertext bit decomposition result: Then calculate:

[0064] for j = {0, 1, ..., l-1} do:

[0065] [-y j ] pk =Mult p ([y j ] pk (n-1)

[0066] [z j ] pk =HoAdd([x j ] pk ,[-y j ] pk )

[0067] end for

[0068] Then, using the ([z) obtained in the previous step l-1 ] pk ,…,[z0] pk )calculate: Cz′=HoAdd(C z [2] l ] pk Calling SBD yields the ciphertext C. z The ciphertext bit decomposition result of ′: Then, calculate: [r] pk =[z l ′+y l-1 -x l-1 ] pk The obtained [r] pk that is and The encrypted result of the comparison.

[0069] in, Represent two fixed-point numbers; Representing fixed-point numbers respectively pass The converted l-bit integer; They represent respectively to Ciphertext obtained by encrypting with public key pk; These represent the ciphertext. Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk ),([y l-1 ] pk ,…,[y0] pk );x l-1 ..., x0 and y l-1 ,…,y0 are respectively The binary decomposition result, x l-1 ,y l-1 The most significant bit is x0, and the least significant bits are x0 and y0. l-1 ,y0~y l-1 All values ​​are taken from {0,1}; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk This indicates that a homomorphic addition operation is performed on two ciphertexts to obtain a result ciphertext, such that the plaintext corresponding to the result ciphertext is d1 + d2; i ,z i ′,C z C z ′ represents intermediate results generated from the calculation; [r] pk For the final result of the protocol computation, r satisfies when When r = 1, r = 1; otherwise, r = 0.

[0070] Protocol 3: Secure Ciphertext Multiplication Protocol (SMul). The input to this protocol is two ciphertexts [x1]. pk and [x2] pk The output is: the ciphertext of the multiplication result [x1·x2] pk This protocol is primarily used to implement multiplication operations between ciphertexts, because additive homomorphic encryption schemes only support homomorphic addition between ciphertexts and multiplication operations between ciphertext and plaintext.

[0071] Specifically, when executing the secure encrypted multiplication protocol, the CS0 side starts from Z... n Two random numbers r1 and r2 are randomly selected, and the following calculation is performed: [x1 + r1] pk =HoAdd([x1]) pk [r1] pk ), [x2+r2] pk =HoAdd([x2]) pk [r2] pk Then, calculate the result [x1+r1]. pk and [x2+r2] pk Decryption of the execution section: DP1 = Dec p (sk0,[x1+r1) pk ), DP2 = Dec p (sk0,[x2+r2) pk Then, CS0 sends the partial decryption results DP1 and DP2 to CS1 (the slave server), causing CS1 to perform full decryption on the received DP1 and DP2, obtaining x1+r1 and x2+r2. The decryption process can be expressed by the formula: x1+r1=Dec f (sk1,DP1), x2+r2=Dec f (sk1,DP2), then CS1 calculates R=Enc(pk,(x1+r1)·(x2+r2)) and then sends the ciphertext R to CS0.

[0072] After receiving R from CS1, CS0 performs the following calculation: C1 = Mult p ([x1] pk ,n-r2),C2=Mult p ([x2] pk ,n-r1), C3=Enc(pk,(n-r1·r2)mod n), C add =HoAdd(HoAdd(C1,C2),C3),C mul =HoAdd(R,C add ), resulting in C mul It's [x1·x2] pk .

[0073] Where x1 and x2 represent two integers; [x1] pk [x2] pk These represent the ciphertexts obtained by encrypting x1 and x2 using the public key pk, respectively; r1 and r2 are derived from Z. n A random integer is randomly selected from the given information; sk0 and sk1 represent the secret sharing of the private key sk; Dec p (sk0,[d0] pk ) indicates the ciphertext [d0] pk Partial decryption is performed using the secret share sk0 of the private key sk, resulting in a partially decrypted ciphertext DP; DP1 and DP2 represent [x1+r1] respectively. pk [x² + r²] pk Partial decryption results; Dec f (sk1,DP1) represents performing a full decryption operation on the partially decrypted ciphertext DP using the secret sharing sk1 of the private key sk, obtaining the corresponding plaintext; Enc(pk,m) represents performing an encryption operation on the plaintext m using the public key pk, obtaining the corresponding ciphertext; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk This indicates that a homomorphic addition operation is performed on two ciphertexts to obtain a result ciphertext, such that the plaintext corresponding to the result ciphertext is d1 + d2; R, C1, C2, C3, C add These are all intermediate results from the calculation process; C mul The final result calculated for the protocol, namely C mul = [x1·x2] pk .

[0074] Protocol 4: Secure Absolute Value Computation Protocol (SABS). The input to this protocol is a ciphertext. The output is the ciphertext of the absolute value of a fixed-point number. and Ciphertext of the sign bit Among them, if otherwise,

[0075] Specifically, when executing the secure computation absolute value protocol, the CS0 side calls SBD to obtain the ciphertext. The ciphertext bit decomposition result: And calculate: C coe =HoAdd(Mult p ([x l-1 ] pk ,n-2),[1] pk Then call SMul to calculate: C xcoe =SMul([x]) pk C coe ), and use the obtained C xcoe Calculate: C y =HoAdd(C xcoe Mult p ([x l-1 ] pk ,2 l The resulting C y that is And [x] l-1 ] pk that is

[0076] in, Represent a fixed-point number; Represents a fixed-point number pass The converted l-bit integer; Indicates to Ciphertext obtained by encrypting with public key pk; Indicates the ciphertext Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk );x l-1 ,…,x0 is The binary decomposition result, x l-1 x0 is the most significant bit, x0 is the least significant bit, and x0~x l-1 All values ​​are taken from {0,1}; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk ) indicates that a homomorphic addition operation is performed on two ciphertexts to obtain a result ciphertext, such that the plaintext corresponding to the result ciphertext is d1+d2;[1] pk This represents the ciphertext obtained by encrypting the constant 1; SMul represents the algorithm proposed in Protocol 3; C coe C xcoe All are intermediate results generated from calculations; C y The final result of the protocol calculation, i.e.

[0077] Protocol 5: Secure First-Hand Acquisition Protocol (SGP). The input to this protocol is a ciphertext [x]. pk Where x is an integer and satisfies 2 α-1 ≤x<2 α The output is ciphertext [2] α-1 ] pk .

[0078] Specifically, during the secure acquisition of the first 1 protocol, the CS0 side calls SBD to obtain the ciphertext [x]. pk The ciphertext bit decomposition result: ([x l-1 ] pk ,…,[x0] pk )←SBD([x] pk ,l), then BitSum l Set to [0] pk And calculate:

[0079] for j={l-1,l-2,…,0}do:

[0080] C j,0 =Mult p (BitSum j+1 (n-1)

[0081] C j,1 =HoAdd([x j ] pk C i,0 )

[0082] C j,2 =SMul(C j,1 ,[y j ] pk )

[0083] BitSum j =HoAdd(BitSum j+1 C j,2 )

[0084]

[0085] end for

[0086] After l rounds of iterative calculations, the final result is That is [2] α-1 ] pk .

[0087] Where x represents an integer and satisfies 2 α-1 ≤x<2 α ;[x] pk This represents the ciphertext obtained by encrypting x using the public key pk; SBD([x]) pk ,l) represents the ciphertext [x] pk Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk );x l-1 ,…,x0 is The binary decomposition result, x l-1 x0 is the most significant bit, x0 is the least significant bit, and x0~x l-1 All values ​​are taken from {0,1}; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk ) indicates that a homomorphic addition operation is performed on two ciphertexts to obtain a result ciphertext, such that the plaintext corresponding to the result ciphertext is d1+d2; SMul represents the algorithm proposed in Protocol 3; BitSum l BitSum is used to calculate the initial value for iterative computation. i+1 BitSum is the value used in the j-th iteration calculation. i C is the iterative calculation value generated for the next round of calculation in the j-th round; i,0 C i,1 C i,2 For intermediate results generated from round j of calculation; The final result of the protocol calculation, i.e.

[0088] Protocol 6: Secure Division Protocol (SDiv). This protocol takes two ciphertexts as input. and Output a ciphertext The output of the protocol is the encryption result of fixed-point division of the two input ciphertexts.

[0089] Specifically, when executing the secure division protocol, CS0 calls SABS to obtain the ciphertext. Ciphertext corresponding to the absolute value of a fixed-point number and the sign bit of the encryption: Call SGP to obtain ciphertext The corresponding [2] α-1 ] pk : Then calculate: [2] α ] pk =Mult p ([2 α-1 ] pk ,2) CS0 will then partially decrypt and Send to CS1.

[0090] CS1 fully decrypted received The corresponding plaintext is obtained: Then calculate α = log22 α Set C0 to Calculate later: if α≤f p ,but C d =HoAdd(C0,Mult) p (C c (n-2)) otherwise, C d =HoAdd(C0,Mult) p (C c (n-2)) After that, CS1 will Partially decrypted and sent back to CS0:

[0091] CS0 fully decrypted received The corresponding plaintext is obtained: And calculate:

[0092]

[0093] Calculated It is the encryption result of the fixed-point division of the two input ciphertexts.

[0094] in, Represents a fixed-point number; Representing fixed-point numbers respectively pass The converted l-bit integer; They represent respectively to Ciphertext obtained by encryption using the public key pk; SABS represents the algorithm proposed in Protocol 4; This represents the output of SABS, i.e. Ciphertext sum converted from absolute value to integer The sign bit; SGP indicates the algorithm proposed in Protocol 5; [2] α-1 ] pk This represents the output of SGP; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk The expression ) represents a homomorphic addition operation on two ciphertexts, resulting in a single ciphertext such that the plaintext corresponding to the result ciphertext is d1 + d2; sk0 and sk1 represent the secret sharing of the private key sk; Dec p (sk0,[d0] pk ) indicates the ciphertext [d0] pk Using the secret share sk0 of the private key sk to perform partial decryption, we obtain a partially decrypted ciphertext DP; They represent [2] α ] pk , Partial decryption results; Dec f (sk1,DP1) indicates that the partially decrypted ciphertext DP is fully decrypted using the secret sharing of the private key sk1, yielding the corresponding plaintext; Trunc represents the algorithm proposed in Protocol 1; SMul represents the algorithm proposed in Protocol 3; C0, C c C d , C mul , e, C1 and C2 represent intermediate results generated by the calculation; This represents the final result of the protocol computation, namely:

[0095] Protocol 7: Secure Matrix Multiplication Protocol (SMMul). Two servers collaboratively execute this protocol to compute matrix multiplication W. h× d·X d×v +B h×v Among them, matrix X d×v Send to CS1, CS i (i = 0, 1) Calculate: CS1 will <R h×v >1 is sent to CS0, and CS0 calculates R′. h×v = <R h×v >0+ <R h×v After >1, calculate:

[0096] for every r′ j,k ∈R ′ h×v do:

[0097] r j,k =Trunc(r′) j,k ,f p )

[0098] end for

[0099] CS0 yields the final result matrix:

[0100] Among them, Xd ×v This represents the encrypted data matrix of the user or the ciphertext matrix of the output result of the previous layer of a neural network; <W h×d > i Represents CS i The model weights held are secretly shared; h×v > i Represents CS i The biases held (which are also part of the model parameters) are secretly shared; <R h×v > i Represents CS​ i Sharing the secrets of matrix operation results; R′ h×v This indicates that the results of two calculations are secretly shared and merged; r′ j,k Represents matrix R′ h×v The elements in the table; Trunc represents the algorithm proposed in Protocol 1; R h×v The r represents the final result matrix calculated by the protocol. j,k Represents matrix R h×v Elements in;

[0101] Protocol 8: Security Index Calculation Protocol (SExp). This protocol takes a ciphertext as input. and a fixed point number in, Output exponentiation ciphertext result The calculation process is as follows: CS0 calls SBD to obtain the ciphertext. The ciphertext bit decomposition result: Perform the following calculations to from Switch to

[0102] from Randomly select an integer And calculate: C pad =HoAdd([x′]) pk ,[r] pk ), ([y l-1 ] pk ,…,[y0] pk )←SBD(C pad ,l); Calculate We get [(x′+r)mod 2] m ] pk Then CS0 will C mod Partial decryption yields DP mod DP mod =Dec p (sk0,C mod ), CS0 will DP mod Send to CS1.

[0103] CS1 fully decrypts the received DP mod The corresponding plaintext is obtained: M = Dec f (sk1,DP mod ), CS1 will [M exp1 ] pk Send to CS0.

[0104] CS0 calculates [y m ·x l-1 ] pk =SMul([y m ] pk ,[x l-1 ] pk ), C mul =S Mul (C add ,[M exp1 ] pk C exp =Trunc(C mul ,f p ), calculate C exp that is

[0105] in, Represent a fixed-point number; Represents a fixed-point number pass The converted l-bit integer; Indicates to Ciphertext obtained by encrypting with public key pk; Indicates the ciphertext Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk );x l-1 ,…,x0 is The binary decomposition result, x l-1 x0 is the most significant bit, x0 is the least significant bit, and x0~x l-1 All values ​​are taken from {0,1}; Mult p ([d0] pk HoAdd([d1, p0)) obtains a ciphertext R such that the plaintext result corresponding to the ciphertext R is d0·p0; pk [d2] pk The expression represents a homomorphic addition operation on two ciphertexts, resulting in a single ciphertext such that the plaintext corresponding to the resulting ciphertext is d1 + d2; m is an integer, and m <l;[x′] pk It is [x] pk The ciphertext of the integer located in Z2m obtained after conversion; r is an integer randomly selected from Z2m; C pad It is [x′] pk and [r] pk The ciphertext result of performing homomorphic addition; ([y l-1 ] pk ,…,[y0] pk ) indicates that for C pad Performing a secure bit decomposition operation yields l encrypted binary numbers ([y l-1 ] pk ,…,[y0] pk );y l-1 ,…,y0 is C pad The binary decomposition result, y l-1 y0 is the most significant bit, and y0 is the least significant bit. l-1 All values ​​are taken from {0,1}; A fixed-point number obtained by transforming plaintext M; M exp1 It is a fixed-point number arithmetic. Results The integer result after conversion; is a fixed-point number representing the base of the exponentiation operation; SMul represents the algorithm proposed in Protocol 3; Trunc is the algorithm proposed in Protocol 1; C coe C mod ,M,C1,C2,C3,C4,C add C mul All are intermediate results generated from calculations; C exp The final result calculated for the protocol is:

[0106] Protocol 9: Secure Average Pool Protocol (SAP). This protocol takes γ ciphertexts {[x1]} as input. pk ,…,[x γ ] pk Output the encryption result of the average value of the plaintext corresponding to γ ​​ciphertexts.

[0107] The calculation process is as follows: CS0 calculates the cumulative sum of the γ numbers: Then, the method for calculating the average value is determined based on the value of γ: if γ = 2 k ,but

[0108] C avg =Trunc(C sumx ,k); otherwise, C mul =Mult p (C sumx M), C avg =Trunc(C mul ,f p ); the obtained C avg that is

[0109] Where γ represents the number of elements calculated by average pooling; C sumx M represents the sum of γ elements; M represents... go through The converted integer; Trunc represents the algorithm proposed in Protocol 1; C mul Indicates intermediate results generated during the calculation process; C avg This represents the average of γ elements, which is the final result calculated by the protocol.

[0110] Protocol 10: Secure Maximum Pooling Protocol (SMP). This protocol takes γ ciphertexts {[x1] as input. pk ,…,[x γ ] pk },in, Output the encryption result of the γ ciphertexts corresponding to the maximum value of the plaintext.

[0111] The calculation process is as follows: At the CS0 end, let C max =[x1] pk ,calculate:

[0112] for j={2,3,…,γ}do:

[0113] C r =SCmp(C max ,[x j ] pk )

[0114] C 1-r =HoAdd([1]) pk Mult p (C r ,n-1))

[0115] C1 = SMul(C max C r )

[0116] C2 = SMul([x j ] pk C 1-r )

[0117] Set C max =HoAdd(C1,C2)

[0118] end for

[0119] After γ-1 iterations of calculation, the final C is obtained. max that is

[0120] Where γ represents the number of elements computed in max pooling; {[x1] pk ,…,[x γ ] pk } represents a set of γ ciphertexts; C max Indicates the maximum value generated by the current iteration; SCmp represents the algorithm proposed in Protocol 2; SMul represents the algorithm proposed in Protocol 3; C r C 1-r C1 and C2 are intermediate results generated during the calculation process.

[0121] Protocol 11: Secure Computation ReLU Protocol (SReLU). This protocol takes a ciphertext input. Output ciphertext result exist At that time, the result was exist When the result is 0, the answer is 0.

[0122] The calculation process is as follows: CS0 calls SBD to obtain the ciphertext. The ciphertext bit decomposition result: Then calculate: C drelu =HoAdd([1]) pk Mult p ([x l-1 ] pk (n-1)) C relu =SMul(C drelu [x] pk ), resulting in C relu that is

[0123] in, Represents a fixed-point number; Represents a fixed-point number pass The converted l-bit integer; Indicates to Ciphertext obtained by encrypting with public key pk; Indicates the ciphertext Performing a secure bit decomposition operation yields l encrypted binary numbers ([x l-1 ] pk ,…,[x0] pk );x l-1 ,…,x0 is The binary decomposition result, x l-1 x0 is the most significant bit, x0 is the least significant bit, and x0~x l-1 All values ​​are taken from {0,1}; C drelu express The ciphertext of the derivative; C relu This represents the final result of the protocol computation, namely:

[0124] As can be seen, each computational protocol specifies the computational steps that CS0 and CS1 must complete. Therefore, when CS1 collaborates with CS0 to perform a certain computational protocol, CS0 and CS1 execute their respective computational steps according to the settings in the corresponding protocol. Based on the above computational protocols, various model operations in a model can be completed, including complex exponential operations, so there is no need to modify the model activation function.

[0125] Please see Figure 2 By leveraging the aforementioned computational protocols and based on additive homomorphic encryption technology, the model can be securely deployed on an untrusted, semi-honest cloud server, ensuring the privacy of model parameters and user data on the untrusted cloud server during deployment and use.

[0126] Specifically, the solution involves four endpoints: a user-side client used by the user, a model upload client used by the model owner, cloud server CS0, and cloud server CS1. The user transmits user data, their public key PK, and a copy of their private key SK0 to cloud server CS0 via the user-side client, and transmits their public key PK and another copy of their private key SK1 to cloud server CS1. The model owner, through the model upload client, uses additive homomorphic encryption to divide the trained model into two parts (SSW0 and SSW1) and deploys them to the two cloud servers respectively. Cloud server CS0 stores a secret copy of the model, SSW0 (i.e.,...). <w>0 and 0) The user's public key PK and a copy of the user's private key SK0 are used to receive the user's encrypted data and collaborate with the cloud server CS1 to execute a secure computing protocol to complete the model prediction process. The cloud server CS1 stores another secret copy of the model, SSW1 (i.e., <w>1 and 1) The user's public key PK and another user's private key SK1 are used to assist the cloud server CS0 in executing the secure computing protocol.

[0127] The following explanation uses a neural network model with a 784-300-10 structure as an example. 784-300-10 indicates that the model has two layers: the input layer receives a 784-dimensional column vector, the first layer has 300 neurons, and the second layer has 10 neurons. Here, we choose the activation function... The implementation process of the solution includes:

[0128] Step 1: On the model upload end, the model owner performs model training in plaintext to obtain a trained model. The weight matrix of the model is denoted as W, and the bias matrix is ​​denoted as B.

[0129] Step 2: The model owner uses additive secret sharing on the model upload end to randomly divide the model weight matrix W and bias matrix B into two secret sharing matrices. <w> 0、 <w>1 and 0、 1. Make the elements at corresponding positions in the two secret shared matrices satisfy the following equation: ( <w j,k >0+ <w j,k >1) mod 2 l =w j,k 、( j,k >0+ j,k >1) mod 2 l =b j,k ,in: <w i,k >0∈ <w> 0,<w i,k >1∈ <w> 1、<b i,k >0∈ 0,<b i,k >1∈ 1.

[0130] Step 3: The model owner makes <w>0 and 0 is sent from the model uploader to the cloud server CS0 via a secure channel, enabling... <w>1 and 1. The model is sent from the uploader to the cloud server CS1 via a secure channel.

[0131] Step 4: The model owner informs the CSO neural network model of its structure (including the number of layers and the number of neurons in each layer) and the type of activation function via the model uploader.

[0132] Step 5: The user generates the public key pk and private key sk for additive homomorphic encryption.

[0133] Step 6: The user secretly shares the private key sk by adding it together, resulting in sk0 and sk1.

[0134] Step 7: The user sends sk0 and sk1 obtained in step 6 to CS0 and CS1 respectively through a secure channel via the user terminal.

[0135] Step 8: The user uses the public key pk generated in Step 5 on the user's end to encrypt the data (784-dimensional vector) to be uploaded to the cloud server, obtaining ([x1]). pk [x2] pk ,…,[x 784 ] pk ).

[0136] Step 9: The user sends the encryption vector obtained in step 8 to CS0 through the public channel via the user terminal.

[0137] Step 10: After receiving the user's encrypted vector, CS0 first calls SMMul to perform matrix multiplication calculation according to the model structure, and obtains the ciphertext result W·X+B.

[0138] Step 11: For In the function calculation, CS0 first calls SExp to calculate e. x , where e = 2.71828, and x is an element of the matrix calculation result (vector) in step 10.

[0139] Step 12: After obtaining e x Afterwards, CS0 uses HoAdd to calculate 1+e locally. x .

[0140] Step 13: After steps 11 and 12, CS0 now holds e x and 1+e x At this point, CS0 calls SDiv to perform the calculation. To obtain the result of the Sigmoid function.

[0141] Step 14: After calculating the activation function, CS0 will obtain a vector of 300 elements. This vector will be used as the input vector for the next layer to continue the prediction process. Steps 10-13 will be repeated until the final result is obtained, which is the prediction result of the neural network.

[0142] Step 15: CS0 sends the neural network prediction result (ciphertext) to the user terminal, completing the entire secure prediction process of the neural network.

[0143] Step 16: The user terminal decrypts the received result using the private key sk to obtain the corresponding plaintext prediction result.

[0144] As can be seen, performing neural network prediction according to this embodiment allows for the selection of a computational protocol corresponding to the current model from numerous computational protocols to implement the relevant model operations, resulting in high compatibility. Specifically, different types of activation functions can be further combined based on various protocols, applicable to various neural network models, without requiring modification to the original model. Regarding model confidentiality, an additive secret sharing technique is used to divide the model into two secret shares, which are then stored on two separate, non-colluding cloud servers, achieving model confidentiality to the cloud servers. Furthermore, the computational cost of dividing the model using additive secret sharing is very small, effectively reducing the additional computational and communication overhead associated with model deployment. For user data confidentiality, additive homomorphic encryption is also used to protect data privacy. Both user public and private keys are generated by the user themselves; changing the key has no impact on model prediction and deployment. Therefore, users can generate public and private keys with different security levels according to their own security needs and computational capabilities, thus providing different levels of security guarantees for different users. Moreover, unlike fully homomorphic encryption, this scheme does not require encrypting the model and user data with the same public key; therefore, changing users or keys does not require model redeployment. In addition, when performing data conversion before encrypting data, the precision of the fixed-point number can be controlled. Therefore, this scheme supports variable high-precision calculation, that is, it can achieve predictions with corresponding precision according to different precision requirements.

[0145] In summary, this scheme achieves model confidentiality through additive secret sharing, which significantly reduces the computational burden of encrypting the model. Furthermore, since the model and user data do not need to be encrypted with the same key, updating the key no longer requires re-encrypting the model, making key updates more convenient. Based on various high-precision fixed-point arithmetic protocols, this scheme can construct secure computations for various activation functions, thereby effectively avoiding model prediction loss.

[0146] The following describes a privacy-preserving model prediction device provided by an embodiment of this application. The privacy-preserving model prediction device described below and the privacy-preserving model prediction method described above can be referred to each other.

[0147] See Figure 3 As shown in the figure, this application discloses a privacy-preserving model prediction device applied to a main server, comprising:

[0148] The receiving module 301 is used to receive ciphertext of user data encrypted with the user's public key sent by the user terminal;

[0149] Processing module 302 is used to process the encrypted user data based on the user's private key represented in a secret sharing manner, the operation protocol used to implement the model operation in the target model, and the weight parameters and bias parameters of the target model represented in a secret sharing manner, to obtain the ciphertext of the prediction result of the target model for the encrypted user data; wherein, the operation protocol includes at least one or a combination of: truncation protocol, comparison protocol, ciphertext multiplication protocol, absolute value calculation protocol, first character acquisition protocol, division protocol, matrix multiplication protocol, exponentiation operation protocol, average pooling protocol, max pooling protocol, and ReLU activation function calculation protocol;

[0150] The sending module 303 is used to send the ciphertext of the prediction result to the user terminal, so that the user terminal can use the user's private key to decrypt the ciphertext of the prediction result and obtain the plaintext of the prediction result.

[0151] In one implementation, the weight parameters and bias parameters of the target model are divided into first model sub-parameters and second model sub-parameters in a secret sharing manner, and the user private key is divided into first private key sub-parameters and second private key sub-parameters in a secret sharing manner; the first model sub-parameters, the first private key sub-parameters and the model structure of the target model are stored on the master server; the second model sub-parameters and the second private key sub-parameters are stored on the slave master server;

[0152] Accordingly, the processing module is specifically used to enable the slave server to collaborate with the master server to process the encrypted user data based on the operation protocol, the first model sub-parameter, the first private key sub-parameter, the second model sub-parameter, and the second private key sub-parameter.

[0153] In one implementation, the model uploader randomly divides the weight parameters of the target model into a first sub-weight and a second sub-weight through secret sharing, and randomly divides the bias parameters of the target model into a first sub-bias and a second sub-bias through secret sharing. The first sub-weight and the first sub-bias are used as the first model sub-parameters, and the second sub-weight and the second sub-bias are used as the second model sub-parameters.

[0154] In one implementation, the user terminal randomly divides the user's private key into a first private key sub-parameter and a second private key sub-parameter using an additive secret sharing method.

[0155] In one implementation, before the user terminal sends the encrypted user data, the user terminal converts the plaintext user data from a fixed-point number to an integer, and then encrypts the plaintext user data represented by the integer using the user's public key to obtain the encrypted user data.

[0156] In one implementation, the user terminal converts plaintext user data from fixed-point numbers to integers, including: the user terminal converts plaintext user data from fixed-point numbers to integers according to a preset conversion formula; wherein, the preset conversion formula is:

[0157]

[0158] in, f represents plaintext user data represented in fixed-point numbers. p The bit length of the user data plaintext in binary fractional form as a fixed-point number, and l represent the bit length of the user data plaintext in integer form after conversion. This represents the plaintext user data, expressed as an integer after conversion.

[0159] In one implementation, the client also adjusts f based on user actions. p The value of .

[0160] For more detailed information on the working process of each module and unit in this embodiment, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0161] As can be seen, this embodiment provides a privacy-preserving model prediction device that can improve the model's prediction accuracy for encrypted data and enhance the security protection of important data such as user private keys, model weight parameters, and bias parameters that need to be protected.

[0162] The following describes an electronic device provided in an embodiment of this application. The electronic device described below can be referred to in conjunction with the privacy-preserving model prediction method and apparatus described above.

[0163] See Figure 4 As shown in the figure, an embodiment of this application discloses an electronic device, including:

[0164] Memory 401 is used to store computer programs;

[0165] Processor 402 is configured to execute the computer program to implement the method disclosed in any of the above embodiments.

[0166] The following describes a readable storage medium provided in an embodiment of this application. The readable storage medium described below can be referred to in conjunction with the privacy-preserving model prediction method, apparatus and device described above.

[0167] A readable storage medium is provided for storing a computer program, wherein the computer program, when executed by a processor, implements the privacy-preserving model prediction method disclosed in the foregoing embodiments. Specific steps of the method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0168] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0169] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of readable storage medium known in the art.

[0170] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application. < / w> < / w> < / w> < / w> ​​ < / w> < / w> < / w> < / w> < / x> < / x> < / x> < / x> < / sk> < / sk> < / w> < / w> ​​​​​ < / w> < / w> < / w> < / w> < / w> < / w>

Claims

1. A model predictive method with privacy protection, characterized in that, The application is applied to a master server, comprising: receiving user data ciphertext encrypted by a user public key sent by a user terminal; processing the user data ciphertext based on a user private key represented in a secret sharing manner, an operation protocol for implementing model operation in a target model, and weight parameters and bias parameters of the target model represented in a secret sharing manner, to obtain prediction result ciphertext of the target model for the user data ciphertext; wherein the operation protocol comprises at least one or a combination of a truncation protocol, a comparison protocol, a ciphertext multiplication protocol, a calculation absolute value protocol, a first character acquisition protocol, a division protocol, a matrix multiplication protocol, an exponential operation protocol, an average pooling protocol, a maximum pooling protocol, and a ReLU activation function calculation protocol; different types of activation functions are constructed based on each protocol combination, which is suitable for various neural network models and does not need to modify the original model; sending the prediction result ciphertext to the user terminal, so that the user terminal decrypts the prediction result ciphertext using a user private key to obtain prediction result plaintext; wherein before the user terminal sends the user data ciphertext, the user terminal converts user data plaintext from a fixed-point number to an integer, encrypts the user data plaintext represented by the integer using the user public key, and obtains the user data ciphertext; wherein the user terminal converts user data plaintext from a fixed-point number to an integer, comprising: the user terminal converts the user data plaintext from a fixed-point number to an integer according to a preset conversion formula; wherein the preset conversion formula is: ； wherein, represents the user data plaintext expressed in fixed-point number, represents the bit length of the binary fraction of the user data plaintext expressed in fixed-point number, and l represents the bit length of the user data plaintext expressed in integer after conversion, represents the user data plaintext expressed in integer after conversion; the user terminal adjusts the value of according to user operation. wherein the weight parameters and bias parameters of the target model are divided into a first model sub-parameter and a second model sub-parameter in a secret sharing manner, the user private key is divided into a first private key sub-parameter and a second private key sub-parameter in a secret sharing manner; the user terminal randomly divides the user private key into the first private key sub-parameter and the second private key sub-parameter in an additive secret sharing manner; the first model sub-parameter, the first private key sub-parameter, and the model structure of the target model are stored in the master server; the second model sub-parameter and the second private key sub-parameter are stored in a slave server; correspondingly, the processing of the user data ciphertext based on the user private key represented in a secret sharing manner, the operation protocol for implementing model operation in a target model, and the weight parameters and bias parameters of the target model represented in a secret sharing manner comprises: making the slave server cooperate with the master server to process the user data ciphertext based on the operation protocol, the first model sub-parameter, the first private key sub-parameter, the second model sub-parameter, and the second private key sub-parameter.

2. The method of claim 1, wherein the model uploading terminal randomly divides the weight parameters of the target model into a first sub-weight and a second sub-weight by a secret sharing manner, randomly divides the bias parameters of the target model into a first sub-bias and a second sub-bias by a secret sharing manner, takes the first sub-weight and the first sub-bias as the first model sub-parameter, and takes the second sub-weight and the second sub-bias as the second model sub-parameter. ​ 3. A model predictive device with privacy protection, characterized by, The application is applied to a master server, comprising: a receiving module, configured to receive user data ciphertext encrypted by a user public key sent by a user terminal; a processing module, configured to process the user data ciphertext based on a user private key represented in a secret sharing manner, an operation protocol for implementing model operation in a target model, and weight parameters and bias parameters of the target model represented in a secret sharing manner, to obtain prediction result ciphertext of the target model for the user data ciphertext; wherein the operation protocol comprises at least one or a combination of a truncation protocol, a comparison protocol, a ciphertext multiplication protocol, a calculation absolute value protocol, a first character acquisition protocol, a division protocol, a matrix multiplication protocol, an exponential operation protocol, an average pooling protocol, a maximum pooling protocol, and a ReLU activation function calculation protocol; different types of activation functions are constructed based on each protocol combination, which are suitable for various neural network models and do not need to modify the original model; a sending module, configured to send the prediction result ciphertext to the user terminal, so that the user terminal decrypts the prediction result ciphertext by using a user private key to obtain prediction result plaintext; wherein, before the user terminal sends the user data ciphertext, the user terminal converts user data plaintext from a fixed-point number to an integer, encrypts the user data plaintext represented by the integer by using the user public key, and obtains the user data ciphertext; wherein, the user terminal converts user data plaintext from a fixed-point number to an integer, comprising: the user terminal converts the user data plaintext from a fixed-point number to an integer according to a preset conversion formula; wherein the preset conversion formula is: ； wherein, represents the user data plaintext expressed in fixed-point number, represents the bit length of the binary fraction of the user data plaintext expressed in fixed-point number, and l represents the bit length of the user data plaintext expressed in integer after conversion, represents the user data plaintext expressed in integer after conversion; the user terminal adjusts the value of according to user operation. wherein, the weight parameters and bias parameters of the target model are divided into a first model sub-parameter and a second model sub-parameter in a secret sharing manner, and the user private key is divided into a first private key sub-parameter and a second private key sub-parameter in a secret sharing manner; the user terminal randomly divides the user private key into the first private key sub-parameter and the second private key sub-parameter in an additive secret sharing manner; the first model sub-parameter, the first private key sub-parameter, and the model structure of the target model are stored in the master server; and the second model sub-parameter and the second private key sub-parameter are stored in a slave server; correspondingly, the processing of the user data ciphertext based on the user private key represented in a secret sharing manner, the operation protocol for implementing model operation in a target model, and the weight parameters and bias parameters of the target model represented in a secret sharing manner comprises: making the slave server cooperate with the master server to process the user data ciphertext based on the operation protocol, the first model sub-parameter, the first private key sub-parameter, the second model sub-parameter, and the second private key sub-parameter.

4. An electronic device, comprising: comprising: a memory, configured to store a computer program; a processor, configured to execute the computer program to implement the method in any one of claims 1 to 2.

5. A readable storage medium characterized by, a computer program for saving, wherein the computer program is executed by a processor to implement the method in any one of claims 1 to 2.

Images