Secure reasoning method based on secure multi-party computation

Abstract

The present invention discloses a secure reasoning method based on secure multi-party computation, comprising the following steps: Step 1, in an offline phase, determining the participants involved in model reasoning; a service provider sharing the inference model secret with each participant; Step 2, in an online phase, the linear layer, each computing party performs local calculations, and sends and reconstructs the calculation results; a predetermined set is provided to other participants, and finally each participant is able to calculate; Step 3, checking the linear layer, and each participant executes a checking protocol; Step 4, in an online phase, the nonlinear layer, using the obfuscated circuits of multiple obfuscators and multiple evaluators to calculate the nonlinear layer function; Step 5, repeating Steps 3 and 4 to complete the calculations of all linear and nonlinear layers, and the participants send the calculation results to a designated client according to the protocol to reconstruct the calculation results. The method of the present invention ensures the data privacy of each participant without compromising accuracy.

Description

Technical Field

[0001] The present invention belongs to the field of data security and cryptographic application technology, and relates to a secure reasoning method based on secure multi-party computing. Background Art

[0002] The widespread application of machine learning has led to increased attention on privacy protection in the machine learning process. Machine learning inference capabilities are typically run as a service on cloud platforms, leveraging machine learning to provide inference services to clients without having to build their own models for inference. However, this presents a challenge: to perform predictions, cloud platforms require access to user data, which may contain sensitive private information. Consequently, users are reluctant to share their data with cloud platforms, even with the prediction results. Furthermore, service providers are concerned that competitors may steal this model data. Existing secure inference methods allow servers with machine learning models to perform inferences with users with private data without leaking either party's private information, and ultimately, only the user can obtain the prediction results. However, existing secure inference methods still incur high computational and communication overheads. Furthermore, malicious adversaries can potentially send erroneous messages during the inference process, potentially disrupting the protocol. While existing approaches for secure inference exist, these technologies still face challenges in their application.

[0003] Koti et al. proposed a secure inference method in the paper "Tetrad: Actively Secure 4PC for Secure Training and Inference" (Network and Distributed System Security Symposium (NDSS), 2022). This method achieves both fairness and robustness in malicious models based on four participating parties. The method first uses a multiplication protocol within the four parties to implement linear layer computations, reducing communication overhead. It then uses an end-to-end conversion protocol based on obfuscated circuits to directly transform the output of the obfuscated world into the output of the other worlds, thereby reducing the required communication and the number of rounds. However, this method has the following drawbacks: the use of a linear layer multiplication protocol under 4PC limits the number of participating parties to four, preventing the flexible expansion to support any number of parties. Summary of the Invention

[0004] The purpose of the present invention is to provide a secure reasoning method based on secure multi-party computation, which solves the problems that the existing technology uses a linear layer multiplication protocol under 4PC, which is difficult to support any number of computing parties, difficult to maintain high efficiency, and insufficient security against malicious adversaries.

[0005] The technical solution adopted by the present invention is a secure reasoning method based on secure multi-party computing, which is implemented according to the following steps:

[0006] Step 1: Offline phase, determine the participants involved in model inference , the number of participants is , the maximum number of damaged parties that can be tolerated ; The service provider then uses the inferred model Secret sharing is To all parties involved;

[0007] Step 2, in the online linear layer, before the first linear layer starts to calculate, the input side will input the value Secret sharing is Sent to each computing party; linear layers, each computation is performed locally ,in For the The input of the nonlinear layer, each participant holds and Secret Sharing and , using the generated in step 1 The secret share of , in the collection Participants in local computing And send the calculation results to , Reconstructed ; through a predetermined set , the size is ,and , send Give Other participants in the final calculation ;

[0008] Step 3, check the linear layer,

[0009] After the linear layer calculation is completed, each participant executes the inspection protocol;

[0010] Step 4: In the online nonlinear layer, the nonlinear layer function is calculated using the confusion circuit of multiple confusion parties and multiple evaluation parties. , It is a nonlinear function, and the input confusion circuit of each participant is the calculation result of the linear layer in the previous step. and another pair of random values ;

[0011] Step 5: Repeat steps 3 and 4 until all linear and nonlinear layer calculations are completed. The participants send the calculation results to the designated client to reconstruct the calculation results according to the protocol.

[0012] The beneficial effects of the present invention include two aspects:

[0013] 1) Since the method of the present invention is improved on the basis of 4PC, the number of participating calculation parties is expanded to any number greater than or equal to 4, which improves the flexibility of the scheme. At the same time, the communication volume of the linear layer adopted by the present invention is further reduced, reducing communication costs.

[0014] 2) Because the present invention uses a linear layer inspection protocol and obfuscation circuits of multiple obfuscating parties and evaluators, it can achieve security against malicious models and ensure fairness in multi-party computation under a two-thirds honest majority. DETAILED DESCRIPTION

[0015] The present invention is described in detail below with reference to specific embodiments.

[0016] The method of the present invention is specifically implemented according to the following steps:

[0017] Step 1, offline phase,

[0018] Identify the parties involved in model inference , the number of participants is , and the maximum number of destroyed parties that this step can tolerate ; The service provider then uses the model for inference Secret sharing is To all participants,

[0019] The specific process of secret sharing is: enter a secret value and threshold , The participants can be divided into sets, each of which is of size ,but , these sets are represented as , generated by the sharing party Random values ,and , then Assigned to , so that each calculation square Have a vector ,vector express The share of secret sharing.

[0020] Each participant performs preprocessing operations to generate the random values ​​required for the online phase Secret Sharing Pair ,in Indicates the threshold value is Replication secret sharing, is the threshold of the corrupt party, Representing a collection Additive secret sharing in , , .

[0021] Step 2, online phase linear layer,

[0022] Multiplication Protocol The specific implementation process is: each participant holds and Secret Sharing and , using the generated in step 1 Secret Sharing Pair , in the collection Participants in local computing And send the calculation results to , Reconstructed ; There is a predetermined set , the size is ,and , send Give Other participants in the final calculation , and store As output,

[0023] Using the above calculation principle, before the first linear layer starts to calculate, the input side will input the value Secret sharing is Sent to each computing party; linear layers, each computation is performed locally ,in For the The input of the nonlinear layer, each participant holds and Secret Sharing and , using the generated in step 1 The secret share of , in the collection Participants in local computing And send the calculation results to , Reconstructed ; through a predetermined set , the size is ,and , send Give Other participants in the final calculation .

[0024] The The specific implementation process is: Each calculation in initialization , for each pair and Every secret shared and , assuming the set Is simultaneously possessed and The set of participants, yes The participant with the smallest index in calculate , while each ( ),calculate , each participant storage As The output of , the final calculation .

[0025] Step 3, check the linear layer,

[0026] After the linear layer calculation is completed, each participant executes the checking protocol to determine the consistency and correctness of the messages exchanged between the participants during the linear layer protocol execution. The specific process is:

[0027] 3.1) Verify the consistency of the messages in the computation,

[0028] Each participant generates Random values , is the number of times multiplication is performed, and then each party broadcasts a random linear combination of the messages it sends and a random linear combination of the messages it receives, the set All parties involved Need to broadcast to A linear combination of messages if in the set In the broadcast, A linear combination of the received messages; if Messages claimed to be sent / received and Claiming that If there is an inconsistency between received / sent messages, then and If there is a destructive party, the agreement will be terminated.

[0029] 3.2) Verify the correctness of the messages from each participant and collect Each side Calculate the following formula:

[0030]

[0031] in, is a known coefficient, , is a replicated secret sharing of size 0. Each collection of The computing parties in the Give If any If a contradictory message is received, the protocol is terminated; if there is no contradictory message, each party can reconstruct , at this time, the message in the first step For comparison, if , the agreement is terminated.

[0032] Step 4, online nonlinear layer,

[0033] Calculate nonlinear layer functions using confusable circuits with multiple confusable and evaluable nodes , It is a nonlinear function (such as ReLU, Sigmoid, etc.), and the input confusion circuit of each participant is the calculation result of the previous linear layer. and another pair of random values , the circuit is first reconstructed ,calculate and by Get the circuit result through a predetermined set , the size is ,and , send Give Other parties in the As the output of the nonlinear layer, the aliasing circuit outputs As the first The input of the linear layer;

[0034] To ensure the security of the garbled circuit, set parameters, including the total number of participants , the number of damaged parties that can be tolerated , the number of confusing parties is The number of evaluators is ,

[0035] In order to ensure the security of the 2 / 3 honest majority model, the specific implementation process of the garbled circuit is as follows: each gate input in the garbled circuit is owned by multiple garbled parties, and each input value It is sent jointly by two obfuscating parties to the evaluation party, one of which sends , another obfuscator sends , For collision-resistant hash functions, the evaluator receives messages from both parties and determines , if they are not equal, the protocol is terminated; the evaluator evaluates the circuit and obtains the output Key , and send and To the obfuscator, if the obfuscator receives consistent , then use calculate , and send To other obfuscators, if any obfuscator receives inconsistent or receive inconsistent , the agreement is terminated.

[0036] Step 5: Repeat steps 3 and 4 until all linear and nonlinear layer calculations are completed. The participants send the calculation results to the designated client to reconstruct the calculation results according to the protocol.

[0037] The working principle of the method of the present invention is as follows: in the offline stage, the number of participants participating in model inference is determined, the service provider secretly shares the model used for inference with each participant, and each participant performs a preprocessing operation to generate the random value required in the online stage; in the linear layer of the online stage, each participant performs a multi-party multiplication protocol to calculate the linear layer, and then performs a linear layer inspection protocol to check the correctness of the linear layer calculation; in the nonlinear layer of the current stage, each participant uses a confusion circuit to implement various nonlinear functions; the latter two steps are repeated, and the calculation of the linear layer and the nonlinear layer are iterated until the inference calculation of the model is completed to obtain the final inference result.

[0038] The method of the present invention utilizes replicated secret sharing and obfuscation circuits to respectively implement the linear layer and nonlinear layer of multi-party computation. Most linear layer computations only need to be performed locally, thereby reducing computational and communication overheads. The method of the present invention utilizes a linear layer inspection protocol and obfuscation circuits to achieve security in the case of a two-thirds honest majority.

Claims

1. A secure reasoning method based on secure multi-party computation, characterized in that: Follow these steps to implement: Step 1: Offline phase, determine the participants involved in model inference , the number of participants is , the maximum number of damaged parties that can be tolerated ; The service provider then uses the inferred model Secret sharing is To all parties involved; Step 2, in the online linear layer, before the first linear layer starts to calculate, the input side will input the value Secret sharing is Sent to each computing party; linear layers, each computation is performed locally ,in For the The input of the nonlinear layer, each participant holds and Secret Sharing and , using the generated The secret share of , in the collection Local computing by participants in And send the calculation results to , Reconstructed ; through a predetermined set , the size is ,and , send Give Other participants in the final calculation ; Step 3, check the linear layer, After the linear layer calculation is completed, each participant executes the inspection protocol; Step 4: In the online nonlinear layer, the nonlinear layer function is calculated using the confusion circuit of multiple confusion parties and multiple evaluation parties. , It is a nonlinear function, and the input confusion circuit of each participant is the calculation result of the linear layer in the previous step. and another pair of random values ; Step 5: Repeat steps 3 and 4 until all linear and nonlinear layer calculations are completed. The participants send the calculation results to the designated client to reconstruct the calculation results according to the protocol.

2. The secure reasoning method based on secure multi-party computing according to claim 1, characterized in that: In step 1, the specific process is, The specific process of secret sharing is: enter a secret value and threshold , The participants can be divided into sets, each of which is of size ,but , these sets are represented as , generated by the sharing party Random values ,and , then Assigned to , so that each calculation square Have a vector ,vector express The share of secret sharing; Each participant performs preprocessing operations to generate the random values ​​required for the online phase Secret Sharing Pair ,in Indicates the threshold value is Replication secret sharing, is the threshold of the corrupt party, Representing a collection Additive secret sharing in , , .

3. The secure reasoning method based on secure multi-party computing according to claim 1, characterized in that: In step 2, the specific process is, Multiplication Protocol The specific implementation process is: each participant holds and Secret Sharing and , using the generated in step 1 Secret Sharing Pair , in the collection Participants in local computing And send the calculation results to , Reconstructed ; There is a predetermined set , the size is ,and , send Give Other participants in the final calculation , and store As output; The The specific implementation process is: Each calculation in initialization , for each pair and Every secret shared and , assuming the set Is simultaneously possessed and The set of participants, yes The participant with the smallest index in calculate , while each ( ),calculate , each participant storage As The output of , the final calculation .

4. The secure reasoning method based on secure multi-party computing according to claim 1, characterized in that: In step 3, the specific process is, 3.1) Verify the consistency of the messages in the computation, Each participant generates Random values , is the number of times multiplication is performed, and then each party broadcasts a random linear combination of the messages it sends and a random linear combination of the messages it receives, the set All parties involved Need to broadcast to A linear combination of messages if in the set In the broadcast, A linear combination of the received messages; if Messages claimed to be sent / received and Claiming that There is an inconsistency between received / sent messages, then and If there is a destructive party, the agreement will be terminated; 3.2) Verify the correctness of the messages from each participant, gather Each side Calculate the following formula: in, is a known coefficient, , is a replicated secret sharing of size 0. Each collection of The computing parties in the Give If any If a contradictory message is received, the protocol is terminated; if there is no contradictory message, each party can reconstruct , at this time, the message in the first step For comparison, if , the agreement is terminated.

5. The secure reasoning method based on secure multi-party computing according to claim 1, characterized in that: In step 4, the specific process is, First reconstruct ,calculate and by Get the circuit result through a predetermined set , the size is ,and , send Give Other parties in the As the output of the nonlinear layer, Garbled circuit output As the first The input of the linear layer, To ensure the security of the garbled circuit, set parameters, including the total number of participants , the number of damaged parties that can be tolerated , the number of confusing parties is The number of evaluators is , In order to ensure the security of the 2 / 3 honest majority model, the specific implementation process of the garbled circuit is as follows: each gate input in the garbled circuit is owned by multiple garbled parties, and each input value It is sent jointly by two obfuscating parties to the evaluation party, one of which sends , another obfuscator sends , For collision-resistant hash functions, the evaluator receives messages from both parties and determines , if they are not equal, the protocol is terminated; the evaluator evaluates the circuit and obtains the output Key , and send and To the obfuscator, if the obfuscator receives consistent , then use calculate , and send To other obfuscators, if any obfuscator receives inconsistent or receive inconsistent , the agreement is terminated.

Images