Systems, methods, and apparatus for privacy preserving inference

Abstract

The disclosed system and method relate to a method for privacy-preserving inference (PPI), the method comprising: receiving a first set of matrix information from a client device, and using k c – One seed operation is used to generate k from the first CSPRNG associated with the server. c –1 matrix, based on k c The set of matrices is used for computational reasoning to generate matrix S. s Generate k s – 1 random matrix, based on inference matrix Y and matrix S s and k s – 1 random matrix is ​​used to calculate matrix (I), and a second matrix information set is sent to the client device. The second matrix information set includes the matrix corresponding to k. s –1 random matrix k s –1 seed and matrix (I), receive matrix U from the client device, and calculate the inference value y based on matrix U.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. non-provisional application No. 17 / 038,998, filed September 30, 2020, entitled “System, Method and Apparatus for Privacy-Preserving Reasoning,” the contents of which are incorporated herein by reference to the jurisdictions that allow such incorporation. Technical Field

[0003] This invention generally relates to machine learning / neural network systems, and more particularly to systems, methods, and apparatus for privacy-preserving inference (PPI). Background Technology

[0004] Reasoning is a process in which a trained machine learning / neural network model is used to predict the output for a given input. For example, a model trained to classify animal images into different species can be used to identify the species of an animal from an image (the reasoning process). To perform reasoning, information is typically sent from the client device to the server, thus compromising the client's privacy.

[0005] Users operating client devices that perform inference using trained machine learning / neural network models may not want to expose their input, as the input may contain sensitive information. Simultaneously, they may not want to disclose operational parameters associated with the trained machine learning / neural network model, such as weights, to the client device. Therefore, input from the client device containing private information should remain private on the client side, and the weights associated with the trained machine learning / neural network model should remain private on the server side. In this scenario, the server can access the inference without infringing on any privacy. However, the client device cannot access the inference because it might expose the weights.

[0006] Nevertheless, there is an interest in computing the output of a trained machine learning / neural network model on the server while keeping the original input private on the client device, and with the operational parameters (e.g., weights) known only to the server.

[0007] Some proposed systems may exacerbate these challenges. These proposed systems include homomorphic encryption. This encryption is computationally expensive because public-key encryption operations must be applied to every element of the input vector. Furthermore, homomorphic encryption-based systems must handle key management problems, thus straining the hardware components and software processing resources associated with the system. Summary of the Invention

[0008] The embodiments disclosed herein are developed based on the developer’s understanding of the drawbacks associated with the prior art.

[0009] This disclosure provides a privacy-preserving inference (PPI) environment configured to store sensitive information associated with users, organizations, institutions, etc. The sensitive information can be stored on the client side, while the operational parameters associated with the trained machine learning / neural network model can be stored on the server side, without relying on public-key encryption operations that may strain the associated hardware components and software processing resources.

[0010] According to a first generalized aspect of this disclosure, a method for privacy-preserving inference (PPI) is provided, implemented on a server, the method comprising: receiving a first matrix information set from a client device, the first matrix information set including k c -1 seed and matrix Where, k c It is an integer value; by using k c -1 seed operation is used to generate k using a first cryptographically secure pseudorandom number generator (CSPRNG) associated with the server. c -1 matrices, and k c -1 matrix and matrix Represented as k c A set of matrices, wherein the matrix is... It is k c The k-th matrix in the set of matrices c matrix; according to k c For each matrix in the set of matrices, the inference is computed and represented as an inference matrix Y with a first dimension; the generating matrix S s Matrix S s Including k s There are random coefficients, where k s It is an integer value; generate k s -1 random matrices, each with the same dimension as the inference matrix Y; based on the inference matrix Y and matrix S s and k s -1 random matrix calculation matrix and k s -1 random matrix and matrix Represented as k s A set of matrices; send a second set of matrix information to the client device, the second set of matrix information including matrices corresponding to k. s -1 random matrix k s -1 seed and matrix Receive matrix U from the client device; calculate the inference value y based on matrix U.

[0011] According to other aspects of this disclosure, the method, wherein the matrix Calculated by the client device as follows:

[0012]

[0013] wherein:

[0014] X is an input matrix corresponding to sensitive information selected by the client device,

[0015] X i is the i-th matrix in a set of k c matrices generated by the client device, c k c -1 matrices in the set of k ci matrices are randomly generated,

[0016] s c is the i-th coefficient in the matrix S c , including k c random coefficients,

[0017] is the k c -th coefficient in the matrix S c .

[0018] According to other aspects of the present disclosure, the method, wherein the k c -1 random matrices are generated by the second CSPRNG associated with the client device using k c -1 seeds.

[0019] According to other aspects of the present disclosure, the method, wherein the value of s is equal to 1.

[0020] According to other aspects of the present disclosure, the method, wherein the matrix is calculated as:

[0021]

[0022] wherein:

[0023] Y i is the i-th matrix in a set of k s matrices,

[0024] s si is the i-th coefficient in the matrix S s ,

[0025] is the k s -th coefficient in the matrix S s .

[0026] According to other aspects of the present disclosure, the method, wherein the value of

[0027] According to other aspects of the present disclosure, the method, wherein the elements of the matrix U are computed as:

[0028] u i ＝ Y i T .S c

[0029] wherein:

[0030] u i is the i-th element of the matrix U,

[0031] Y i T is the transpose of the i-th matrix in the set of k s matrices.

[0032] According to other aspects of the present disclosure, the method, wherein the k s th matrix is computed as:

[0033]

[0034] wherein:

[0035] Y i is the i-th matrix in the set of k s matrices,

[0036] s si is the i-th coefficient in the matrix S s ,

[0037] is the k s th coefficient in the matrix S s .

[0038] According to other aspects of the present disclosure, the method, wherein the value of is equal to 1.

[0039] According to other aspects of the present disclosure, the method, wherein the elements of the matrix U are computed as:

[0040] u i = Y i T .S c

[0041] wherein:

[0042] u i is the i-th element of the matrix U,

[0043] Y iT is the transpose of the i-th matrix in the set of k s matrices.

[0044] According to other aspects of the disclosure, the method, wherein the inference value y is computed as:

[0045]

[0046] wherein:

[0047] u i is the i-th element of the matrix U,

[0048] is the i-th coefficient in the matrix S s

[0049] According to other aspects of the disclosure, the method, wherein the k s -1 random matrices are generated by operating a first CSPRNG associated with the server using the k s -1 seeds.

[0050] According to other aspects of the disclosure, the method, wherein the server is further configured to derive a feature from the inference value y.

[0051] According to other aspects of the disclosure, the method, wherein the server transmits the derived feature to the client device.

[0052] According to a second broad aspect of the disclosure, there is provided a system for privacy-preserving inference (PPI), the PPI system comprising: a server comprising: a processor for executing instructions; a non-transitory storage element for storing instructions that, when executed by the processor, configure the system to perform steps for: receiving, from a client device, a first set of matrix information, the first set of matrix information comprising k c -1 seeds and a matrix wherein k c is an integer value; generating k c -1 matrices by operating a first cryptographically secure pseudo-random number generator (CSPRNG) associated with the server using the k c -1 seeds, and receiving the k c -1 matrices and the matrix is represented as a set of k c matrices, wherein the matrix is the k c -th matrix in the set of k c matrices; computing an inference from each of the matrices in the set of k c matrices, and representing the inferences as an inference matrix Y having a first dimension; generating a matrix S s ​Matrix S s Including k s There are random coefficients, where k s It is an integer value; generate k s -1 random matrices, each with the same dimension as the inference matrix Y; based on the inference matrix Y and matrix S s and k s -1 random matrix calculation matrix and k s -1 random matrix and matrix Represented as k s A set of matrices; send a second set of matrix information to the client device, the second set of matrix information including matrices corresponding to k. s -1 random matrix k s -1 seed and matrix Receive matrix U from the client device; calculate the inference value y based on matrix U.

[0053] According to other aspects of this disclosure, the system, wherein the matrix Calculated by the client device as follows:

[0054]

[0055] in:

[0056] X is the input matrix corresponding to the sensitive information selected by the client device.

[0057] X i k is generated by the client device c The i-th matrix in a set of matrices, k c k in the set of matrices c -1 matrices are randomly generated.

[0058] s ci It is matrix S c The i-th coefficient in the equation includes k c A matrix S with random coefficients c Generated by the client device,

[0059] It is matrix S c The kth c Each coefficient.

[0060] According to other aspects of this disclosure, the system, wherein k c -1 random matrices are obtained by using k c -1 seed, generated by the second CSPRNG associated with the client device.

[0061] According to other aspects of the present disclosure, the system, wherein the value of m is equal to 1.

[0062] According to other aspects of the present disclosure, the system, wherein the matrix is calculated as:

[0063]

[0064] wherein:

[0065] Y i is the i-th matrix in a set of k s matrices,

[0066] s si is the i-th coefficient in the matrix S s

[0067] is the k s -th coefficient in the matrix S s .

[0068] According to other aspects of the present disclosure, the system, wherein the elements of the matrix U are calculated as:

[0069] u i = Y i T .S c

[0070] wherein:

[0071] u i is the i-th element of the matrix U,

[0072] Y i T is the transpose of the i-th matrix in a set of k s matrices.

[0073] According to other aspects of the present disclosure, the system, wherein the inference value y is calculated as:

[0074]

[0075] wherein:

[0076] u i is the i-th element of the matrix U,

[0077] is the i-th coefficient in the matrix S s .

[0078] According to other aspects of the present disclosure, the system, wherein the k s -1 random matrices are generated by using k s ​​- 1 seed, generated by operating a first CSPRNG associated with the server. BRIEF DESCRIPTION OF DRAWINGS

[0079] Other features and advantages of the present application will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, which illustrate, by way of example, the principles of the application.

[0080] Figure 1 A privacy preserving inference (PPI) environment configured to protect a user's privacy and operational parameters associated with a trained machine learning / neural network model is described in accordance with various embodiments of the present disclosure;

[0081] Figure 2A A high level functional block diagram of a client device of the PPI environment of Figure 1 in accordance with various embodiments of the present disclosure;

[0082] Figure 2B A high level functional block diagram of a PPI server of the PPI environment of Figure 1 in accordance with various embodiments of the present disclosure;

[0083] Figure 3 A flow diagram representing processes implemented on a client device is shown in accordance with various embodiments of the present disclosure;

[0084] Figure 4 A flow diagram representing processes implemented on a PPI server is shown in accordance with various embodiments of the present disclosure;

[0085] Figure 5 Various examples of quasi-linear class MLA are shown in accordance with various embodiments of the present disclosure.

[0086] It should be understood that, in all of the drawings and corresponding description, like reference numerals identify like features. In addition, it should also be understood that the drawings and the following description are not limited to the scope of the claims. DETAILED DESCRIPTION

[0087] The present application is directed to solving at least some of the deficiencies of the current technology. Specifically, the present application describes a system and method for privacy preserving inference (PPI).

[0088] In the context of the present specification, a "client device" is any computer hardware capable of running software suitable for handling the relevant tasks in the process. In the context of the present specification, the term "client device" is generally associated with a user of the client device. Thus, some (non-limiting) examples of client devices include personal computers (desktops, laptops, netbooks, etc.), smartphones, and tablets, as well as network devices such as routers, switches, and gateways. It is noted that a device acting as a client device in the context of the present application does not preclude the device from acting as a server of other client devices. The use of the expression "client device" does not preclude multiple client devices from being used to receive / transmit, perform or cause performance of any task or request, or a result of any task or request, or a step of any method described herein.

[0089] In the context of the present specification, unless explicitly specified otherwise, the words "first", "second", "third", etc. are used merely to distinguish the nouns they modify from one another, and not to describe any particular relationship between those nouns. Thus, for example, it is understood that the use of the terms "first processor" and "third processor" does not imply any particular order, type, temporal sequence, hierarchy, or ranking of the servers, for example, nor does it imply that any "second server" must exist in any given case. Furthermore, as discussed herein in other contexts, a reference to a "first" element and a "second" element does not preclude the two elements from being the same actual real-world element. Thus, for example, in some cases, the "first" server and the "second" server can be the same software and / or hardware, and in other cases, they can be different software and / or hardware.

[0090] In the context of the present specification, the expression "information" includes any nature or kind of information capable of being stored in a database. Thus, information includes, but is not limited to, audiovisual works (images, movies, sound recordings, presentations, etc.), data (location data, numerical data, etc.), text (opinions, comments, questions, messages, etc.), documents, spreadsheets, user activity logs, etc.

[0091] It is to be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly or indirectly connected or coupled to the other element, and intervening elements can be present. Conversely, when an element is referred to as being "directly connected" or "directly coupled" to another element, there are no intervening elements present. Other words used to describe the relationship between elements, such as "between" versus "directly between", "adjacent" versus "directly adjacent", etc., should be interpreted in a like manner.

[0092] In the context of this specification, when an element is referred to as being "associated with" another element, two elements can be linked directly or indirectly, related, connected, coupled, employed, etc., with one element being employed by the second element in some way in certain embodiments, without limiting the scope of the disclosure.

[0093] The terminology used herein is for the purpose of describing particular representative embodiments only and is not intended to limit the present technology. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0094] Implementations of the present technology include at least one of the above objects and / or aspects, but do not necessarily include all of them. It should be understood that some aspects of the present technology are to try to achieve the above objects, but can not satisfy the object, or can satisfy other objects not specifically described herein.

[0095] The example and conditional language used herein mainly serves the purpose of aiding the reader's understanding of the present technology, and is not to be construed as limiting the scope of the present technology to a specific example or condition. It should be understood that one having ordinary skill in the art can devise various arrangements that, although not explicitly described or shown herein, embody the principles of the technology and are included within its spirit and scope.

[0096] Furthermore, to aid in understanding, the following description can describe relatively simplified implementations of the present technology. As will be appreciated by those skilled in the art, various implementations of the present technology can have greater complexity.

[0097] In some cases, useful examples of modifications that are considered to be modifications of the present technology can also be listed. This is merely to aid in understanding, and, again, is not intended to define the scope of the present technology or to set the bounds of the present technology. These modifications are not an exhaustive list, and one having ordinary skill in the art can make other modifications while remaining within the scope of the present technology. Furthermore, where examples of modifications are not presented, this should not be interpreted as meaning that modifications are not possible and / or that what is described is the only way to implement this element of the present technology.

[0098] Moreover, all statements herein describing principles, aspects, and implementations of the technology, as well as specific examples thereof, are intended to encompass both structural and functional equivalents thereof. Additionally, it is intended that such equivalents include both currently known

[0099] The functions of the various elements shown in the figures, including any functional blocks labeled as“processors” or“graphics processing units,” can be provided through the use of dedicated hardware as well as hardware capable of executing software in association with appropriate software. When provided by a processor, the functions can be provided by a single dedicated processor, by a single shared processor, or by a plurality of individual processors, some of which can be shared. In some embodiments of the present technology, a processor can be a general purpose processor, such as a central processing unit (CPU), or a special purpose processor, such as a graphics processing unit (GPU). Moreover, explicit use of the term“processor” or“controller” should not be construed to refer exclusively to hardware capable of executing software, and can implicitly include, without limitation, digital signal processor (DSP) hardware, network processor, application specific integrated circuit (ASIC), field programmable gate array (FPGA), read-only memory (ROM) for storing software, random access memory (RAM), and nonvolatile memory that function as data storage. Other hardware, conventional and / or custom, can also be included.

[0100] Software modules or simply modules, implied as software, can be represented herein as any combination of flowchart elements or other elements indicating performance of processes and / or textual description of the performance of processes. Such modules can be executed by hardware that is explicitly or implicitly shown.

[0101] Using these basic principles, the present disclosure aims to address at least some of the deficiencies of the current technology. Specifically, the present disclosure describes a system and method for privacy preserving inference (PPI).

[0102] In certain representative embodiments, organizations or institutions that handle sensitive information, such as financial institutions, health organizations, government organizations, and the like, can be designated to handle the sensitive information that they possess, extract additional value or information, augment the information, and the like. The sensitive information can represent any information that needs to be kept confidential. Some examples of sensitive information can include, but are not limited to, shopping history, financial asset allocation, outstanding loans, checking account balances, healthcare information, social security information, and the like. To handle the sensitive information that the organizations possess and extract more value from it, the organizations can use services provided by external service providers to perform analysis and additional information extraction.

[0103] The external service providers can be equipped with advanced analysis techniques, large resources, access to other available sources of information, and the like. The external service providers can use techniques and resources that the organizations can not have access to, services that the organizations can not be able to provide, and the like. It is noted that the external service providers can be able to perform various computations in an efficient manner, in a manner that provides relatively high value additional information, and the like, using the disclosed techniques, augment the information of the organizations in a relatively short period of time. However, sharing the sensitive information of the organizations with the external service providers can involve the risk of information leakage. The organizations can be required to keep the sensitive information confidential and avoid disclosing the information, even to service providers that are supposed to handle the information themselves.

[0104] On the other hand, in certain cases, the external service providers can rely on machine learning algorithms (MLAs) to process the information of the organizations. The processing results returned to the organizations of the MLAs can leak the operating parameters (e.g., weights, biases, and the like) associated with the MLAs.

[0105] To this end, in certain embodiments, the organizations that use the services of the external service providers can randomize the sensitive information before providing the sensitive information to the external service providers. As a result, the original sensitive information can be kept within the organizations, in their information repositories. Additionally or alternatively, the external service providers can provide derived features based on the sensitive information. The derived features can summarize the sensitive information, can provide an abstract representation of it, and the like. For example, the derived features can be a credit score of a person associated with information based on the sensitive information.

[0106] In certain representative embodiments, the external service providers can operate at least partially off-premises of the organizations. The external service providers can utilize off-premises systems to augment the information, such as software-as-a-service (SaaS) systems, cloud computing systems, and the like. The off-premises systems can be installed and executed in remote facilities, such as server farms, in the cloud, and the like, accessible through computerized networks, such as the Internet. The off-premises systems can not have access to the information kept within the organizations.

[0107] In certain representative embodiments, an organization can keep its sensitive information in its on-premise system. The on-premise system can be installed and executed on client devices within the organization's logical premises. The on-premise system can include internal servers, computing infrastructure, etc. The on-premise system can be controlled by the organization. The on-premise system can be managed by members of the organization. The on-premise system can utilize computing resources of the organization to provide computing functionality for the organization. The on-premise system can be used to execute entities associated with the organization, e.g., programs that provide permissions to execute in the on-premise system. In certain instances, entities associated with external entities, such as service providers, can also be executed by the on-premise system. The organization can be responsible for security, availability, and overall management of the on-premise system.

[0108] It is noted that the terms "on-premise" and "off-premise" used in this disclosure are used to provide a logical distinction, rather than a physical distinction. A system can be referred to as an "on-premise" system even if some or all of the computers that make it up are located at a remote location, so long as they are controlled by the organization. In certain instances, the on-premise system can be included in a local network of the organization, such as an intranet, and can not involve external networks, such as the Internet, other LAN networks, etc. The organization can control the devices in the on-premise system and can consider information kept therein as information kept by the organization itself, rather than information kept by a third party.

[0109] In certain embodiments, information can be kept as records. In certain embodiments, each record can be associated with a person, such as a customer, citizen, subject, etc. of the organization. In some examples, sensitive information can include ID numbers, passport numbers, social security numbers, driver's license numbers, etc.; date or place of birth; biometric records, such as face, fingerprint, or handwriting, etc.; vehicle license plate numbers; credit card numbers; genetic information; login names; aliases; phone numbers; etc. In some examples, sensitive information can include information that is linked or linkable to a person, such as medical, educational, financial, employment information, etc. Other examples of sensitive information can be level, salary, job position, criminal record, web cookies, purchase history, past location, financial status, employment history, etc.

[0110] Nevertheless, Figure 1A privacy preserving inference (PPI) environment 100 configured to protect the privacy of users and operational parameters associated with trained machine learning / neural network models is described in accordance with various embodiments of the present disclosure. The PPI environment 100 can include a plurality of client devices 110 (only one client device 110 is shown for simplicity) located at different geographic locations that are configured to communicate with each other through a communication network 112 and a PPI server 114. The plurality of client devices 110 can be associated with (e.g., used by) a user of the PPI environment 100, i.e., a user 116. Although Figure 1 One client device 110 is shown associated with one user 116, but it should be understood that in alternative embodiments, the PPI environment 100 can include any number of client devices 110 associated with any number of users 116. Further, in other alternative embodiments, a client device 110 can be associated with multiple users 116.

[0111] Further, in certain embodiments, the plurality of client devices 110 can be associated with an on-premise system. In certain embodiments, one or more of the electronic devices 110 can be used as an internal server for the on-premise system, while other electronic devices 110 can be associated with one or more users 116 of the PPI environment 100. Further, in certain embodiments, the PPI server 114 can be associated with an off-premise system.

[0112] Figure 2A A high-level block diagram of components of a client device 110 is described in accordance with various embodiments of the present disclosure. It should be understood that Figure 2A The description of one implementation of a client device 110 is provided and is not meant to imply any limitation of the environments in which different embodiments can be implemented. Numerous modifications to the described environments can be made to implement a client device 110 without departing from the principles presented herein. The client device 110 can be a server, a desktop computer, a laptop computer, a tablet computer, a smartphone, a personal digital assistant, or any device that can be used to implement the present technology, as should be understood by those skilled in the art.

[0113] As shown, client device 110 uses one or more processors 202, one or more computer- readable random access memories (RAM) 204, one or more computer-readable read only memories (ROM) 206, one or more computer-readable storage media 208, device drivers 214, read / write (R / W) interfaces 216, network interfaces 218, all interconnected through a communication structure 220. Communication structure 220 can be implemented with any architecture designed for passing data and / or control information between processors (such as microprocessors, communications and network processors, etc.), memory, peripheral devices, and any other hardware components within a system.

[0114] One or more operating systems 210 and one or more application programs 212 are stored on one or more of the computer-readable storage media 208 for execution by one or more of the processors 202 via one or more of the respective RAMs 204 (which typically include cache memory). In the illustrated embodiment, each of the computer-readable storage media 208 can be a magnetic disk storage devices of internal hard drives, CD-ROMs, DVDs, memory sticks, magnetic tapes, magneto-optical disks, semiconductor memory devices, such as RAM, ROM, EPROM, flash, or the like, or computer-readable tangible storage devices that can store data which are accessible by a computer.

[0115] The R / W drive interfaces 216 read from and / or write to one or more portable computer-readable storage media 226. The application programs 212 can be stored on one or more of the portable computer-readable storage media 226, read via one or more of the respective R / W drives or interfaces 216, and loaded into the respective computer-readable storage media 208.

[0116] In addition, network interfaces 218 can be based on technology, such as Ethernet, Bluetooth, 4G wireless technology, or near-field communication technology. This enables the client device 110 to communicate with external computers or external storage devices over a communication network, such as the Internet, a local area network, or other wide area networks or wireless networks. The application programs 212 can be downloaded to the client device 110 from external computers or external storage devices through the communication network and network interfaces 218. The application programs 212 can be loaded from the network interfaces 218 to the computer-readable storage media 208. The client device 110 can be connected to a router, a firewall, a switch, a gateway computer, and / or an edge server of a communication network using copper wires, fiber optics, wireless transmission, or the like.

[0117] The client device 110 can also include a display screen 222, a keyboard or keypad 224, and a computer mouse or touchpad 228. The device drivers 214 can interface with the display screen 222 for imaging, with the keyboard or keypad 224, with the computer mouse or touchpad 228, and / or with the display screen 222 (in the case of a touchscreen display) for pressure sensing of alphanumeric character input and user selection. The device drivers 214, the R / W drive interface 216, and the network interface 218 can include hardware and software (stored on the computer-readable storage medium 208 and / or the ROM 206).

[0118] Figure 2B A high-level functional block diagram of the PPI server 114 of the PPI environment 100 is described in accordance with various embodiments of the present disclosure. Figure 1 The PPI server 114 is a physical machine (e.g., a physical server) or a virtual machine (e.g., a virtual server) that executes ERP software to enable the client device 110 to communicate with the PPI server 114 in the present embodiment. The PPI server 114 includes a processor 252, a memory 254, and a network interface 256.

[0119] The processor 252 of the PPI server 114 can include one or more of a CPU, an accelerator, a microprocessor, a GPU, an ASIC, an FPGA, a special-purpose logic circuit, a special-purpose artificial intelligence processing unit, or a combination thereof.

[0120] The memory 254 can include volatile memory (e.g., RAM) and non-volatile or non-transitory memory (e.g., flash memory, magnetic storage, and / or ROM). The one or more non-transitory memories store a platform that controls overall operation of the PPI server 114. The platform, when executed by the processor 252, implements the PPI application. The platform stores a unique identifier for each user of the PPI application in the memory and manages the unique identifiers or each user of the PPI application. The unique identifier of the user can be a username or an email address of the user. A password can also be associated with the unique identifier of the user and stored in the memory 254.

[0121] The network interface 256 can include one or more radios configured for wireless communication with the communication network 112 or one or more network adapters configured for wired communication with the communication network 112. Generally, the network interface 256 is configured to correspond to a network architecture for implementing a link between the PPI server 114 and the communication network 112.

[0122] It is noted that the PPI server 114 is shown as a standalone computer. However, implementations of various other embodiments of the present application can include any client-server model in which a client device can run a client version of the PPI software. Other examples of the PPI server 114 can include a distributed computing system running a server version of the PPI software, a virtual machine (or multiple virtual machines) instantiated by the infrastructure of a public or private cloud, or a cloud service provider offering the PPI software as a service (SaaS). Such implementations or any other similar implementations should not limit the scope of the present application.

[0123] In other non-limiting embodiments, the client device 110 can use a web browser, such as Chrome TM , Safari TM , Mozilla TM , etc., to facilitate the PPI application. It is noted that how the client device 110 is configured to facilitate the PPI application should not limit the scope of the present application in any way.

[0124] Returning to Figure 1 , in certain embodiments, the user 116 can be willing to use certain services provided by the PPI server 114. As an example, the user 116 can want to check his / her credit rating at a bank. The bank can rely on a server including a trained machine learning / neural network model to predict the credit rating based on the user’s 116 consumption habits. However, the user 116 can not be willing to share his / her consumption information with the bank because such information can reveal personal and / or sensitive information associated with the user 116. At the same time, the bank can also not be willing to provide the user 116 with operational parameters associated with the trained machine learning / neural network model for inference. In another embodiment, the user 116 can be willing to classify images stored in the client device 110 based on facial recognition. To do so, the user 116 can have to send the images to a server including a trained machine learning / neural network model to classify the images. However, the user 116 can not be willing to share his / her personal images.

[0125] Accordingly, there is interest in computing the output of the trained machine learning / neural network model at the PPI server 114 while maintaining the privacy of the original input at the client device 110 and the operational parameters (e.g., weights, biases, etc.) are only known to the PPI server 114.

[0126] In certain embodiments, the PPI environment 100 can rely on a non-cryptographic algorithm based on random matrix sampling (RMS) to protect sensitive information on the client device 110 while protecting operational parameters (e.g., weights, biases, etc.) on the PPI server 114. In certain embodiments, RMS can be an algorithm that generates k c -1 random matrices from an input matrix X and k c -1 random coefficients and constructs a set of matrices that can be recovered by the PPI server 114, but without the values of the k c -1 random coefficients, the unauthorized service provider cannot identify the set of matrices. By doing so, no encryption algorithm is needed to maintain privacy.

[0127] Nevertheless, Figure 3 A flowchart representing a process 300 implemented on the client device 110 is shown in accordance with various embodiments of the present disclosure. As shown, the process 300 begins at step 302, where the client device 110 can select an input matrix X. In certain embodiments, the client device 110 can be configured to select the input matrix X such that the input matrix X can be associated with sensitive information. In one embodiment, the sensitive information can be stored in a memory associated with the client device 110. In another embodiment, the sensitive information can be stored on a cloud and the client device 110 can access the cloud to extract the input matrix X. In certain embodiments, the matrix X can be an (N x 1) dimensional input matrix. In another embodiment, the matrix X can be an (M x N) dimensional input matrix.

[0128] The process 300 proceeds to step 304, where the client device 110 selects a negotiation parameter k c . In certain embodiments, the negotiation parameter k c may be an integer value. It is noted that a higher value of the negotiation parameter k c will make it more difficult for an unauthorized external service provider to reason the original matrix X. In addition, it is more difficult for an authorized external service provider to compute an expected value associated with the original matrix X. To this end, the value of the negotiation parameter k c may be selected as a trade-off between privacy and efficiency. The value of the negotiation parameter k c cannot be too high or too low.

[0129] In certain embodiments, the value of the negotiation parameter k c may be in the order of a few hundreds, e.g., 200, 300, 400, etc. In certain embodiments, the value of the negotiation parameter k c may be set in unison with the PPI server 114 such that the client device 110 can use the negotiation parameter kc agreed value. For example, if the agreed value of k c is 200, then at step 304, the client device 110 can use the agreed value of 200.

[0130] The process 300 proceeds to step 306, where the client device 110 generates a matrix S c containing k c random values. In certain embodiments, the k c random values can be real numbers. In certain embodiments, the last coefficient c of the matrix S may not be a random value and can have a value equal to 1. The matrix S c may be represented as equation (1):

[0131]

[0132] The process 300 proceeds to step 308, where the client device 110 generates k c -1 random matrices of the same dimension as the input matrix X. If the input matrix X is a one-dimensional matrix with dimension N x 1, then the k c -1 random matrices have dimension N x 1. If the input matrix X is a two-dimensional matrix with dimension M x N, then the k c -1 random matrices have dimension M x N.

[0133] Finally, the process 300 proceeds to step 310, where the client device 110 generates the k i th matrix by multiplying each random matrix X ci generated at step 308 by its corresponding random coefficient s c and adding them all together, and then subtracting them from the original matrix X. As long as the random coefficient matrix S c is not leaked, the resulting matrix can be used for inference without leaking the value of the original matrix X. The resulting matrix may be represented as equation (2):

[0134]

[0135] Equation (2) can be rewritten as equation (3) in terms of the input matrix X:

[0136]

[0137] In certain embodiments, the value of s may be equal to 1.

[0138] Once the set of k c matrices is generated In certain embodiments, the set of k c matrices can be transmitted to the PPI server 114 for inference. It is contemplated that the set of k c matrices can include k c -1 randomly generated matrices and the resulting matrix

[0139] It is noted that in certain embodiments, each entry in the random matrix X i (where 1 < i < k c-1 ) can have a length of B bits. If the random matrix X i is a one-dimensional matrix of dimension N x 1, the total number of random bits associated with the random matrix X i is N x B. Further, if the random matrix X i is a two-dimensional matrix of dimension M x N, the total number of random bits associated with the random matrix X i is M x N x B. It is contemplated that the matrix is not a random matrix, but can be generated using a set of k c -1 random matrices. However, in certain embodiments, each element of the matrix may still have a length of b bits and can have a total of N x B bits or M x N x B bits, depending on whether the matrix is a one-dimensional matrix or a two-dimensional matrix.

[0140] Notwithstanding, in certain embodiments, sending the set of k c matrices to the PPI server 114 can put a burden on the operational network resources in terms of required bandwidth. For example, if there are approximately 10 c elements in each of the set of k 6 matrices, where each element is 32 bits, then sending the set of k c matrices, it requires 32 x 10 6 x k c bits. To address such a scenario where bandwidth is an issue, in certain embodiments, the client device 110 can rely on a pseudorandom number generator, such as a cryptographically secure pseudorandom generator (CSPRNG) to generate k c -1 random matrices of the same dimension as the input matrix X.

[0141] In certain embodiments, a CSPRNG takes an input as a fixed bit length value seed that is sufficiently random and generates a variable length sequence (length depends on how many random bits are needed to be extracted from the CSPRNG), which looks random in a way that the variable length sequence cannot be distinguished from a truly random sequence. When the same seed is input, the CSPRNG will generate the same random sequence. In certain embodiments, the seed can be generated based on some source of randomness, for example, in the client device 110, the seed can be generated based on mouse movement, keystrokes, etc.

[0142] Those skilled in the art will readily appreciate that using a block cipher in counter mode can be used as a CSPRNG. In certain embodiments, a block cipher can be used in counter mode. To do so, the client device 110 can select a random key and can encrypt the increasing value of a counter associated with the block cipher (in certain embodiments, the counter can start from 0) using the random key. By doing so, the block cipher can produce a bit stream that is difficult to distinguish from a truly random bit. The random key can be used as a seed.

[0143] For example, a block cipher (e.g., AES-128) takes a 128-bit input, a 128-bit length random key, a 128-bit length initialization “vector” and outputs a 128-bit length cipher block. To generate a pseudo-random sequence using the block cipher in counter mode, a random key of length 128 bits is selected, 0 is encrypted to obtain the first 128-bit pseudo-random block, then 1 is encrypted to obtain the next 128-bit pseudo-random block, and so on. It should be noted that if two instances of the CSPRNG are started with the same values, including the same random key seed, the same bit sequence can be generated.

[0144] Nevertheless, in certain embodiments using a CSPRNG, the client device 110 can use k c -1 seeds to generate k c -1 random matrices. In certain embodiments, the client device 110 can send the first matrix information set including k c -1 seeds along with the k c th matrix to the PPI server 114 instead of sending the set of k c -1 matrices. It should be noted that in certain embodiments, the size of the seed can be fixed and smaller than the size of the random matrix X i , i.e., the total number of bits in the seed is less compared to the total number of bits in the random matrix X i . For example, if the random matrix X i has about 10 6 elements, each of which is 32 bits, the random matrix X iwith approximately 32 x 10 6 random bits. Furthermore, the seed length is made 128 bits. Then, in certain embodiments, the client device 110 can send 128 bits for each random matrix, instead of 32 x 10 6 bits for each random matrix. By doing this, the burden on the running network resources can be reduced by a factor of 25 x 10 4 in terms of required bandwidth.

[0145] Thus, in certain embodiments, the number of bits sent by the client device 110 for the set of k c matrices can be equal to length seed x (k c - 1) + N x B bits for a one-dimensional input matrix X of dimension N x 1, instead of k c x N x B bits. Similarly, for a two-dimensional input matrix X of dimension M x N, the number of bits sent by the client device 110 for the set of k c matrices can be equal to length seed x (k c - 1) + M x N x B bits, instead of k c x M x N x B bits.

[0146] Figure 4 A flowchart representing a process 400 implemented on the PPI server 114 is shown, in accordance with various embodiments of the present disclosure. As shown, the process 400 begins at step 402, where the PPI server 114 receives a first set of matrix information from the client device 110. The first set of matrix information can be sent by the client device 110 using wired or wireless technology. In certain embodiments, the first set of matrix information can include a set of k c matrices sent by the client device 110. In certain embodiments, as described above, the client device 110 can send (k c - 1) seeds and the k c th matrix instead of sending the set of k c matrices. To this end, in certain embodiments, the PPI server 114 can rely on a similar CSPRNG as used by the client device 110, i.e., the PPI server 114 can employ a CSPRNG. The PPI server 114 can generate the (k c - 1) matrices by operating the associated CSPRNG using the (k c - 1) seeds. It is noted that the (k c - 1) matrices generated by the PPI server 114 are the same as the (k c - 1) matrices generated by the client device 110 using the (k c-1) matrices are the same. (k c -1) matrices and the k c th matrix can be represented as a set of k c matrices.

[0147] The process 400 continues with step 404, in which the PPI server 114 computes an inference for each matrix in the set of k c matrices. In certain embodiments, the PPI server 114 can rely on a quasi-linear class of MLAs. A typical MLA belonging to the quasi-linear class can be represented as equation (5):

[0148] y = W T . X + b (5)

[0149] where X is an input matrix, W is a weight matrix, b is a bias, and y is an inference output. “.” denotes a dot product. Figure 5 Various examples of quasi-linear class MLAs are shown that illustrate various embodiments of the present disclosure. Examples of quasi-linear class MLAs include, among others, linear regression models, logistic regression models, support vector machine (SVM) models, and the like. In certain embodiments, the PPI server 114 can rely on any suitable quasi-linear or fully linear class of MLAs.

[0150] Returning to Figure 4 As described above, to maintain privacy of the input matrix X, the client device 110 can generate a set of k c matrices and send at least one component (e.g., (k c -1) seeds along with the k c th matrix) to the PPI server 114 to access or generate the set of k c matrices. The PPI server 114 can be configured to compute an inference for each matrix in the set of k c matrices. As an example, if the set of k c matrices includes 200 matrices, the PPI server 114 can compute 200 inferences and place all of the inferences in an inference matrix Y. The inference matrix Y can be represented as equation (5):

[0151]

[0152] where, are the k c inferences computed by the PPI server 114.

[0153] Once the PPI server 114 computes the inference matrix Y, in order to protect the operating parameters (e.g., weights, biases, etc.) at the PPI server 114, in certain embodiments, the PPI server 114 can apply the RMS algorithm on the inference matrix Y in a similar manner as the client device 110 applies the RMS algorithm on the input matrix X.

[0154] The process 400 proceeds to step 406, in which the PPI server 114 selects a negotiation parameter k s . In certain embodiments, the negotiation parameter k s may be an integer value. It is noted that the value of the negotiation parameter k s associated with the PPI server 114 can be less than the value of the negotiation parameter k c associated with the client device 110.

[0155] In certain embodiments, the value of the negotiation parameter k s may be in the order of tens, e.g., 10, 15, 20, etc. In certain embodiments, the value of the negotiation parameter k s may be set to be consistent with the client device 110, such that the PPI server 114 can use the agreed value of the negotiation parameter k s . For example, if the agreed value of the negotiation parameter k s is 10, then at step 404, the PPI server 114 can use the agreed value 10.

[0156] The process 400 proceeds to step 408, in which the PPI server 114 generates a matrix S s containing k s random coefficients. In certain embodiments, the k s random coefficients can be real numbers and randomly generated. In certain embodiments, the last coefficient s of the matrix S may not be a random coefficient and can have a value equal to 1. The matrix S s may be represented as equation (6):

[0157]

[0158] The process 400 proceeds to step 410, in which the PPI server 114 generates k s - 1 random matrices of the same dimension as the inference matrix Y. Each of the k s - 1 random matrices can contain random coefficients. In certain embodiments, the random coefficients can be real numbers and randomly generated. Furthermore, if the inference matrix Y is a one-dimensional matrix of dimension N x 1, then k s- Each of the k s - Each of the k

[0159] Finally, the process 400 proceeds to step 412, in which the PPI server 114 computes the k s - Each of the k i random matrices Y si is multiplied by a corresponding random coefficient s s and all of them are added together, and then subtracted from the inference matrix Y, to obtain the k s -1th matrix The resulting matrix can be represented as equation (7):

[0160]

[0161] Equation (5) can be rewritten as equation (8) according to the inference matrix Y:

[0162]

[0163] In certain embodiments, the value of s

[0164] Once the set of k s -1th matrices is generated, In certain embodiments, the set of k s -1th matrices can be sent to the client device 110 for further processing. It is contemplated that the set of k s -1th matrices can include the k s -1 randomly generated matrices and the resulting matrix The client device 110 can be prevented from finding the inference computed by the PPI server 114, thereby preserving the operational parameters (e.g., weights, biases, etc.) associated with the MLA only at the PPI server 114.

[0165] It is noted that, in certain embodiments, the PPI server 114 can rely on the associated CSPRNG to generate the k s -1 seeds and send the k s -1 seeds along with the resulting matrix to the client device 110, instead of sending the set of k s -1th matrices, thereby alleviating the burden on the operational network resources in terms of required bandwidth.

[0166] The client device 110 can receive a second set of matrix information. In certain embodiments, the second set of matrix information can include a set of k s blocking matrices sent by the PPI server 114. In certain embodiments, as described above, the PPI server 114 can send (k s - 1) seeds and the k s th matrix instead of sending the set of k s matrices. To do so, in certain embodiments, the client device 110 can rely on the associated CSPRNG to generate the matrices (k s - 1) using the (k s - 1) seeds. It is noted that the (k s - 1) matrices generated by the client device 110 are the same as the (k s - 1) matrices generated by the PPI server 114 using the (k s - 1) seeds.

[0167] In certain embodiments, the client device 110 can multiply the transpose of each matrix in the set of k s blocking matrices with the matrix S c such that u i = Y i T .S c where Y i T is the transpose of the i-th matrix in the set of k s blocking matrices. By doing so, the client device 110 can generate a matrix s of size k s

[0168] In certain embodiments, the client device 110 can send the matrix U to the PPI server 114. The PPI server 114 can compute the final inference of the original input matrix X by multiplying the matrix U with the matrix S s . The resulting matrix can be the inference value y, and can be represented as equation (9):

[0169]

[0170] Further, in certain embodiments, the PPI server 114 can derive certain features from the inference value y. Examples of such derived features can include, but are not limited to, approval of a loan, reduction of home insurance premium, reduction of car insurance premium, reduction of medical insurance premium, approval of a credit card linked with sensitive information, etc. In certain embodiments, the PPI server 114 can provide such derived features to the client device 110.

[0171] In this manner, the PPI server 114 can be able to enhance sensitive information in a relatively short period of time by performing various computations in an efficient manner using the disclosed techniques. Moreover, with the PPI environment 100, sensitive information associated with users, organizations, institutions, etc. can be kept on the client side while operational parameters associated with trained machine learning / neural network models can be kept on the server side.

[0172] It should be appreciated that the operation and functionality of the PPI environment 100, constituent components, and associated processes can be implemented through any one or more of hardware-based, software-based, and firmware-based elements. Such operational alternatives do not limit the scope of the present application in any way.

[0173] It should also be appreciated that although embodiments presented herein have been described with reference to particular features and structures, it is clear that various modifications and combinations can be made without departing from these disclosures. The specification and drawings are, accordingly, to be regarded as illustrative only, and the description is intended to cover any and all modifications, variations, combinations, or equivalents that fall within the scope of the present application.

Claims

1. A method for privacy-preserving inference (PPI), implemented on a server, the method comprising: receiving a first set of matrix information from a client device, the first set of matrix information including k c - 1 seeds and a matrix where k c is an integer value; By using k c –1 seed, operate the first cryptographically secure pseudo-random number generator (CSPRNG) associated with the server to generate k c –1 matrix, and the k c – 1 matrix and the matrix Represented as k c A set of matrices, wherein the matrices It is the k c The k-th matrix in the set of matrices c A matrix; According to the k c Each of the matrices in the set of matrices computes an inference and represents the inference as an inference matrix Y having a first dimension; A generating matrix S s , said matrix S s comprises k s random coefficients, where k s is an integer value; Generate k s - 1 random matrix, each random matrix having the same dimension as the dimension of the inference matrix Y; According to the inference matrix Y, the matrix S s and the k s -1 random matrix and k s -1 random matrix and the matrix is represented as a set of k s matrices; sending a second set of matrix information to the client device, the second set of matrix information including k s -1 random matrices corresponding to the k s -1 seeds and the matrix receiving a matrix U from the client device, elements of the matrix U being computed as: where: u i is the i-th element of the matrix U, is the i-th element of the k s th matrix in the set of k c is a matrix comprising k c random coefficients; and computing an inference value y from the matrix U.

2. The method of claim 1, wherein the matrix is computed by the client device as: where: X is an input matrix corresponding to sensitive information selected by the client device, X i is the i-th matrix in a set of k c matrices generated by the client device, the k c matrices in the set of k c -1 matrices are randomly generated, s ci is the ith coefficient in matrix S c , including k c random coefficients, the matrix S c is generated by the client device, and is the kth coefficient in the matrix S c c th coefficient in the matrix S​ 3. The method of claim 2, wherein the k c -1 random matrix is generated by operating a second CSPRNG associated with the client device using the k c -1 seed.

4. The method of claim 2, wherein the value of is equal to 1.

5. The method of any one of claims 1 to 4, wherein the matrix is computed as: where: Y i It is k s The i-th matrix in a set of matrices. s si is the i-th coefficient in the matrix S s and is the kth coefficient in the matrix S s is the kth coefficient in the matrix S s is the kth coefficient in the matrix S 6. The method of claim 5, wherein the value of is equal to 1.

7. The method of any one of claims 1 to 6, wherein the inference value y is computed as: where: u i are the i-th elements of the matrix U, and is the i-th coefficient in the matrix S s is the i-th coefficient in the matrix S 8. The method of any one of claims 1 to 7, wherein the k s -1 random matrix is generated by operating the first CSPRNG associated with the server using k s -1 seeds.

9. The method of any one of claims 1 to 8, wherein the server is further configured for deriving a feature from the inference value y.

10. The method of claim 9, wherein the server sends the derived feature to the client device.

11. A system for privacy-preserving inference (PPI), comprising: a server comprising: a processor for executing instructions; a non-transitory storage element for storing instructions that, when executed by the processor, configure the system to perform steps for: receiving a first set of matrix information from a client device, the first set of matrix information including k c - 1 seeds and a matrix where k c is an integer value; By using k c –1 seed, operate the first cryptographically secure pseudo-random number generator (CSPRNG) associated with the server to generate k c –1 matrix, and the k c – 1 matrix and the matrix Represented as k c A set of matrices, wherein the matrices It is the k c The k-th matrix in the set of matrices c A matrix; According to the k c Each of the matrices in the set of matrices computes an inference and represents the inference as an inference matrix Y having a first dimension; A generating matrix S s , the matrix S s comprises k s random coefficients, where k s is an integer value; Generate k s - 1 random matrix, each random matrix having the same dimension as the dimension of the inference matrix Y; Based on the inference matrix Y and the matrix S s and the k s – Calculate the matrix from 1 random matrix and k s – 1 random matrix and the matrix Represented as k s A set of matrices; sending a second set of matrix information to the client device, the second set of matrix information including k s -1 random matrices corresponding to the k s -1 seeds and the matrix receiving a matrix U from the client device, elements of the matrix U being computed as: where: u i is the i-th element of the matrix U, is the k s -th matrix in the set of matrices, S c is a matrix comprising k c random coefficients; and computing an inference value y from the matrix U.

12. The system of claim 11, wherein the matrix is computed by the client device as: where: X is an input matrix corresponding to sensitive information selected by the client device, X i is the i-th matrix in a set of k c matrices generated by the client device, the set of k c matrices is generated by the client device, and k c -1 matrices in the set of k matrices are randomly generated. s ci is the ith coefficient in matrix S c including k c random coefficients, the matrix S c is generated by the client device, and is the kth coefficient in the matrix S c c th coefficient in the matrix S​ 13. The system of claim 12, wherein the k c -1 random matrix is generated by operating a second CSPRNG associated with the client device using the k c -1 seed.

14. The system of claim 12, wherein the value of is equal to 1.

15. The system of any one of claims 11 to 14, wherein the matrix is computed as: where: Y i is the ith matrix in a set of k matrices, s is the ith matrix in a set of k matrices, s si is the i-th coefficient in the matrix S s and is the kth coefficient in the matrix S s s ​​ 16. The system of claim 15, wherein the value of is equal to 1.

17. The system of any one of claims 11 to 16, wherein the inference value y is computed as: where: u i are the i-th elements of the matrix U, and is the i-th coefficient in the matrix S s ​ 18. The system of any one of claims 11 to 17, wherein the k s -1 random matrix is generated by operating the first CSPRNG associated with the server using k s -1 seeds.

Images