Neural network model encryption method and decryption method, device, equipment and medium

Abstract

The application relates to the technical field of deep learning, in particular to a neural network model encryption method and decryption method, a device, equipment and medium, which are used for providing a scheme for improving the resistance to various attacks while not affecting the model calculation accuracy. Embodiments of the application train a neural network to be trained by using business data to obtain a target neural network meeting business requirements; in response to a model acquisition request of a target object, a plurality of layers of the target neural network model are divided into at least one group; the weight matrices of the plurality of layers in any group are combined to obtain a weight sequence; based on an encryption operation rule, at least one nonlinear iteration operation is performed on the original position coordinates of each parameter in the weight sequence to obtain an encrypted position corresponding to each parameter; each parameter is distributed to the corresponding encrypted position to obtain an encrypted target neural network model, and the encrypted target neural network is sent to the target object.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and in particular to methods, devices, equipment and media for encrypting and decrypting neural network models. Background Technology

[0002] Neural network models based on deep learning technology are currently a hot research topic. However, in practical applications, neural network models are easily attacked or tampered with, resulting in damage to the rights and interests of the initial developers.

[0003] In related technologies, neural network models are typically protected by adding backdoors or digital watermarks to their structure or parameters. However, these methods are primarily used for post-hoc ownership verification or for making rights claims during use; they cannot prevent infringers from illegally using the model and lack reliability in protecting against various model attack methods. Furthermore, because these methods often require modifications to the training process or structure of the neural network model, in addition to increasing costs, they can also affect the subsequent inference accuracy of the neural network model. Summary of the Invention

[0004] This invention provides a method, decryption method, apparatus, device, and medium for encrypting and decrypting neural network models, which improves the resistance to various attacks without affecting the inference accuracy of the neural network model.

[0005] In a first aspect, embodiments of this application provide a method for encrypting a neural network model, the method comprising:

[0006] Acquire business data, use the aforementioned business data to train the neural network to obtain the target neural network that meets the business requirements;

[0007] In response to the model acquisition request of the target object, the multiple layers of the target neural network model are divided into at least one group;

[0008] For any group, the weight matrices of multiple layers within the group are merged to obtain a weight sequence;

[0009] For each parameter in the above weight sequence, based on the encryption operation rules, at least one nonlinear iterative operation is performed on the original position coordinates of the above parameter to obtain the encrypted position corresponding to each parameter;

[0010] Distribute the parameters in the above weight sequence to the corresponding encryption positions to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0011] In one possible implementation, the weight matrices of multiple layers within the aforementioned group are merged to obtain a weight sequence, including:

[0012] For any layer within the above group, the weight matrix of any layer is reduced in dimensionality based on preset rules to obtain the corresponding processing result;

[0013] The processing results of each layer within the above group are merged to obtain the above weight sequence.

[0014] In one possible implementation, the above-mentioned operation, based on encryption rules, performs at least one nonlinear iterative calculation on the original position coordinates of the parameters, including:

[0015] Determine the target cube corresponding to the above weight matrix, wherein the target cube is the smallest cube that can accommodate all the parameters in the above weight matrix;

[0016] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates within the target cube.

[0017] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameters are mapped.

[0018] In one possible implementation, the following operation is performed in each nonlinear iteration:

[0019] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding first operation value is determined based on the nonlinear function corresponding to the above encryption operation rules;

[0020] Using the weighting matrix corresponding to the above encryption operation rules, the position coordinates obtained after the previous nonlinear iteration operation are weighted to obtain the corresponding second operation value; wherein, the determinant of the above weighting matrix is ​​coprime with the preset parameter;

[0021] The sum of the first and second calculated values ​​is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration.

[0022] In one possible implementation, the preset parameter is the side length of the target cube.

[0023] In one possible implementation, before sending the encrypted target neural network to the target object, the method further includes:

[0024] Obtain the set of parameters to be encrypted for the target neural network model mentioned above, which includes multiple parameters to be encrypted;

[0025] Based on the encryption factor, each of the above parameters to be encrypted is encrypted;

[0026] The encryption factor mentioned above is determined based on the following method:

[0027] Based on the target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding encryption factor.

[0028] The second method, according to embodiments of this application, provides a method for decrypting a neural network model, the method comprising:

[0029] In response to the processing request of the target business, obtain the encrypted target neural network model;

[0030] Determine the weight sequence in the encrypted target network model, and determine the encryption position corresponding to each parameter in each weight sequence;

[0031] For each parameter in the above weight sequence, based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameter to obtain the original position of each parameter;

[0032] For each weight sequence, the parameters in the weight sequence are distributed to the corresponding original position coordinates, and the weight sequence is restored to a weight matrix of multiple layers;

[0033] Based on the weight matrix corresponding to each layer, the decrypted target network model is determined, and the decrypted target network model is used to process the above target services.

[0034] In one possible implementation, based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameters to obtain the original positions of each parameter, including:

[0035] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameters to obtain the candidate positions of each parameter;

[0036] Based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined.

[0037] In one possible implementation, the following operation is performed in each nonlinear iteration:

[0038] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding third operation value is determined based on the nonlinear function corresponding to the above decryption operation rules.

[0039] The third operation value is weighted using a weighting matrix corresponding to the above decryption operation rules; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter.

[0040] The weighted result of the third operation value is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration operation.

[0041] In one possible implementation, the candidate position is the position of the parameter within the target cube, the target cube is the smallest cube that can accommodate all the parameters in the weight matrix, and the preset parameter is the side length of the target cube.

[0042] In one possible implementation, before processing the target service using the decrypted target network model, the method further includes:

[0043] Obtain the preset initial value, target chaotic mapping parameters, and encryption factor;

[0044] Based on the above target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding factor to be verified.

[0045] If the difference between the aforementioned verification factor and the aforementioned encryption factor is less than a preset threshold, then the parameters in the aforementioned target network model are decrypted using the aforementioned encryption factor.

[0046] Thirdly, embodiments of this application provide a neural network model encryption device, the device comprising:

[0047] The first acquisition module is used to acquire business data, and use the business data to train the neural network to obtain the target neural network that meets the business requirements.

[0048] The grouping module is used to divide multiple layers of the target neural network model into at least one group in response to a model retrieval request from the target object.

[0049] The merging module is used to merge the weight matrices of multiple layers within any given group to obtain a weight sequence.

[0050] The first calculation module is used to perform at least one nonlinear iterative calculation on the original position coordinates of each parameter in the above weight sequence based on the encryption calculation rules, so as to obtain the encrypted position corresponding to each parameter.

[0051] The sending module is used to distribute each parameter in the above weight sequence to the corresponding encryption position to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0052] Fourthly, embodiments of this application provide a neural network model decryption device, the device comprising:

[0053] The second acquisition module is used to acquire the encrypted target neural network model in response to the processing request of the target business.

[0054] The determination module is used to determine the weight sequence in the encrypted target network model and to determine the encryption position corresponding to each parameter in each weight sequence;

[0055] The second calculation module is used to perform at least one nonlinear iterative calculation on the encrypted position coordinates corresponding to each parameter in the above weight sequence based on the decryption operation rules, so as to obtain the original position of each parameter.

[0056] The restoration module is used to distribute the parameters in the weight sequence to the corresponding original position coordinates for each weight sequence, and restore the weight sequence to a weight matrix of multiple layers.

[0057] The processing module is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and to process the above-mentioned target business using the decrypted target network model.

[0058] Fifthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement any step of the method described in the first or second aspect above.

[0059] Sixthly, embodiments of this application provide a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement any of the steps described in the first or second aspect above.

[0060] In a seventh aspect, embodiments of this application provide a computer program product, including a computer program stored in a computer-readable storage medium; when a processor of a memory access device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the memory access device to perform any of the steps described in the first or second aspect above.

[0061] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0062] First, the neural network model is trained, and then encrypted after training. This separates the model training and encryption processes, so as not to affect the calculation accuracy of the model when it is used later. When encrypting the model, the layers are split and the matrices are merged first. Then, the positions of the parameters in the model are encrypted nonlinearly based on the preset encryption operation rules, which improves the model's ability to resist various attacks. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0064] Figure 1 A flowchart illustrating a neural network model encryption method provided in an embodiment of this application;

[0065] Figure 2 A flowchart illustrating a neural network model decryption method provided in an embodiment of this application;

[0066] Figure 3 A flowchart illustrating a possible neural network model encryption process provided in an embodiment of this application;

[0067] Figure 4 A flowchart illustrating a possible neural network model decryption process provided in an embodiment of this application;

[0068] Figure 5 A schematic diagram of a neural network model encryption device provided in an embodiment of this application;

[0069] Figure 6 A schematic diagram of a neural network model decryption device provided in an embodiment of this application;

[0070] Figure 7 A schematic diagram of an electronic device provided in an embodiment of this application;

[0071] Figure 8 This is a schematic diagram of another electronic device provided in an embodiment of this application. Detailed Implementation

[0072] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will now be described in further detail with reference to the accompanying drawings.

[0073] The application scenarios described in this application are for the purpose of more clearly illustrating the technical solutions of this application, and do not constitute a limitation on the technical solutions provided in this application. Those skilled in the art will understand that with the emergence of new application scenarios, the technical solutions provided in this application are also applicable to similar technical problems. In the description of this application, unless otherwise stated, "multiple" means two or more.

[0074] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0075] Neural network models based on deep learning technology are currently a hot research topic. However, in practical applications, neural network models are easily attacked or tampered with, resulting in damage to the rights and interests of the initial developers.

[0076] In related technologies, neural network models are typically protected by adding backdoors or digital watermarks to their structure or parameters. However, these methods are primarily used for post-hoc ownership verification or for making rights claims during use; they cannot prevent infringers from illegally using the model and lack reliability in protecting against various model attack methods. Furthermore, because these methods often require modifications to the training process or structure of the neural network model, in addition to increasing costs, they can also affect the subsequent inference accuracy of the neural network model.

[0077] To address the aforementioned issues, this application provides a method for encrypting and decrypting neural network models. The method trains a neural network model to be trained based on business data, groups and merges the trained target neural network model to obtain a weight sequence, and then encrypts the position of each parameter in the weight sequence, thereby encrypting the topology of the neural network model. This improves the resistance to various attacks without affecting the model's computational accuracy.

[0078] Figure 1 A flowchart illustrating a neural network model encryption method provided in this application embodiment; the following is combined with... Figure 1 The encryption process of the neural network model in the embodiments of this application is described in detail, such as... Figure 1 As shown in the embodiments of this application, the neural network model encryption method specifically includes the following steps:

[0079] Step S101: Obtain business data, use the business data to train the neural network to be trained, and obtain the target neural network that meets the business requirements.

[0080] In some embodiments, after training the neural network model to be trained based on business data to obtain a target neural network that meets business requirements, the target neural network model is then encrypted. This process separates the gradient update process (i.e., the model training process) of the neural network model from the model encryption process.

[0081] Step S102: In response to the model acquisition request of the target object, the multiple layers of the target neural network model are divided into at least one group;

[0082] In some embodiments, the above-mentioned division of multiple layers in the target neural network model into at least one group includes two cases: dividing multiple layers in the target neural network model into one group and dividing multiple layers in the target neural network model into multiple groups. The embodiments of this application do not limit the division rules of multiple layers in the target neural network. In actual implementation, the settings can be made based on specific model and environmental requirements. For example, neural networks deployed on the edge generally have a small number of parameters and can be set not to be segmented.

[0083] In some embodiments, different parameters are used for each of the above groups during the encryption process.

[0084] Step S103: For any group, merge the weight matrices of multiple layers within the group to obtain a weight sequence;

[0085] In some embodiments, merging the weight matrices of multiple layers within a group to obtain a weight sequence specifically includes the following steps:

[0086] For any layer within a group, the weight matrix of any layer is reduced in dimensionality based on preset rules to obtain the corresponding processing result; the processing results of each layer within the group are merged to obtain the weight sequence.

[0087] In practice, the weight matrix of each layer can be processed using the flatten function to obtain a one-dimensional matrix corresponding to each layer. The one-dimensional matrices corresponding to each layer are then concatenated to obtain a weight sequence. In practice, the position of each parameter in the weight matrix in the corresponding layer and in the weight matrix of the corresponding layer is recorded so that the position can be restored during subsequent model decryption.

[0088] Step S104: For each parameter in the weight sequence, based on the encryption operation rules, perform at least one nonlinear iterative operation on the original position coordinates of the parameter to obtain the encrypted position corresponding to each parameter.

[0089] In specific implementation, the number of times the above-mentioned nonlinear iterative calculation is performed can be determined based on the specific model and environment. This application embodiment does not impose any restrictions. In some embodiments, the following operations are performed in each nonlinear iterative calculation:

[0090] Using the position coordinates obtained after the previous nonlinear iteration as input, and based on the nonlinear function corresponding to the encryption operation rule, the corresponding first operation value is determined. It should be noted that if only one nonlinear iteration is performed, the position coordinates obtained after the previous nonlinear iteration are the initial position coordinates of the parameter. The nonlinear function described above is not limited in this embodiment.

[0091] Using a weighting matrix corresponding to the encryption operation rules, the position coordinates obtained after the previous nonlinear iteration operation are weighted to obtain the corresponding second operation value; wherein, the determinant of the weighting matrix is ​​coprime with the preset parameter;

[0092] The sum of the first and second calculated values ​​is moduloed by a preset parameter to obtain the position coordinates corresponding to the current nonlinear iteration.

[0093] In one possible implementation, the above encryption operation rule can be an Arnold mapping, which is a chaotic mapping from a torus to itself, possessing multiple properties such as invertibility, area preservation, and topological portability. In this embodiment, a nonlinear component is introduced into the original Arnold mapping to increase the mathematical difficulty and enhance resistance to various attacks. Specifically, the recursive formula for the above nonlinear Arnold mapping can be:

[0094]

[0095] Where k is 0, the above The position coordinates are the result of parameter mapping. When k is not 0, the above... The position coordinates are the output of the k-th recursion. Let N be the position coordinates of the (k+1)th output, and N be a preset parameter. The above recursive formula satisfies the following requirements: 1) Matrix When gcd(detC,N) = 1, the gcd() function is used to find the greatest common divisor, gcd(detC,N) = 1 indicates that detC and N are coprime, and detC represents the determinant of matrix C; 2) a, b, c…j, s are all integers, and their values ​​are not restricted; 3) The nonlinear parts G1 and G2 are nonlinear functions, such as polynomial functions, exponential functions, and other nonlinear function forms. It can be proven that the nonlinear part makes the Arnold mapping, when used for tensor scrambling encryption, lack the characteristics of traditional linear cryptography, has a certain ability to resist differential attacks, and after introducing the nonlinear part, this Arnold mapping transformation process is still a reversible one-to-one mapping, that is, it can be decrypted subsequently.

[0096] In other embodiments, the above-mentioned nonlinear iterative operation on the original position coordinates of the parameters based on the encryption operation rules specifically includes the following steps:

[0097] Determine the target cube corresponding to the weight matrix; this target cube is the smallest cube capable of accommodating all parameters within the weight matrix; specifically, assuming the weight matrix includes Q parameters, the side length (size) of the target cube can be determined based on the following formula:

[0098]

[0099] According to the preset mapping rules, the original position coordinates of the parameters are mapped to the corresponding position coordinates inside the target cube. Specifically, the specific content of the preset mapping rules is not limited in this embodiment. For example, the mapping rules can be to map the parameters to the positions inside the target cube that correspond to the order of the parameters in the weight matrix. For example, the parameter that is first in the weight matrix is ​​mapped to the first position inside the target cube.

[0100] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after parameter mapping; specifically, if the number of parameters that the target cube can accommodate is greater than the number of parameters in the weight matrix, i.e., size... 3 If Q >, then perform empty element padding on the redundant positions of the target cube, filling the redundant positions with useless values. Simultaneously, record the position of each parameter in the weight matrix and its position within the target cube for use in subsequent model decryption. The process of the above nonlinear iterative calculation can be found in the description above, and will not be repeated here.

[0101] In some embodiments, the preset parameter used in the above nonlinear iterative operation is the side length of the target cube.

[0102] Step S105: Distribute each parameter in the weight sequence to the corresponding encryption position to obtain the encrypted target neural network model, and send the encrypted target neural network to the target object.

[0103] The above method first trains the neural network model, and then encrypts the neural network model after training. This separates the model training and encryption processes, so as not to affect the calculation accuracy of the model when it is used later. When encrypting the model, the layers are first split and the matrices are merged. Then, the positions of the parameters in the model are nonlinearly iteratively encrypted based on the preset encryption operation rules, which improves the model's ability to resist various attacks.

[0104] As an optional implementation, during the encryption of the aforementioned neural network model, the parameters of the target neural network are also encrypted. These parameters can be any type of parameter in the neural network model, such as weight parameters. This process can occur at any point after responding to a model acquisition request from the target object and before sending the encrypted target neural network to the target object. Specifically, encrypting the parameters includes the following steps:

[0105] Obtain the set of parameters to be encrypted for the target neural network model; wherein, the set of parameters to be encrypted includes multiple parameters to be encrypted; in specific implementation, the selection of parameters to be encrypted can be determined according to the specific model and environment. For example, neural network models deployed on the edge generally have a small number of parameters, and all parameters can be determined as parameters to be encrypted; in models with a large number of parameters, parameters with a high degree of activation (such as greater than a preset threshold) in the target neural network model can be selected as parameters to be encrypted.

[0106] Based on the encryption factor, each parameter to be encrypted in the parameters to be encrypted is encrypted; wherein, the encryption factor is determined as follows: based on the target chaotic mapping parameter, a preset initial value is subjected to chaotic mapping at least once to obtain the corresponding encryption factor. It should be noted that the encryption factor used when encrypting each parameter to be encrypted in the above-mentioned parameters to be encrypted can be the same or different. The number of times the chaotic mapping is performed can be determined based on the specific model and environment, and this application embodiment does not impose any restrictions.

[0107] In specific implementation, the process of encrypting each parameter to be encrypted based on the encryption factor includes, but is not limited to, performing operations such as addition, subtraction, multiplication, and division on the parameter to be encrypted and the corresponding encryption factor to obtain the corresponding encrypted parameter. In some embodiments, the above-mentioned target chaotic mapping can be any continuous chaotic mapping, such as the Logistic chaotic mapping.

[0108] The Logistic chaotic mapping is a quadratic polynomial mapping (recurrence relation), a classic example of chaotic phenomena arising from simple nonlinear equations. Its properties include: 1) nonlinearity; 2) sensitive dependence on initial conditions; 3) overall stability with local instability; and 4) long-term unpredictability. Its recurrence relation is as follows:

[0109] x j+1 =r(1-x) j ),x0∈[0,1],

[0110]

[0111] In the above formula, x0 is a preset initial value, r is a parameter whose value can be set according to requirements, and x j Let x be the result of the j-th recursion. j+1This is the result of the (j+1)th recursion.

[0112] The following uses the Logistic chaotic mapping as an example to illustrate the process of determining the encryption factor:

[0113] First, set a preset initial value x0, the number of iterations q, and the parameter r; then, perform k calculations based on the above recursive formula to obtain the encryption factor x. k In practice, expansion operations may be added as appropriate.

[0114] Meanwhile, to facilitate subsequent decryption, the initial value x0, the number of iterations q, and the parameter r are used as the decryption key. The key and encryption factor are stored, for example, in the decryption storage medium.

[0115] Compared to related technologies that encrypt parameters through the training process, this method encrypts parameters as a superimposed obfuscated value. Normal parameter inference calculations can usually only be performed with the correct key, making it more difficult to crack. At the same time, the encrypted model can almost completely resist attacks related to the data process.

[0116] The aforementioned method proposes an encryption approach for neural network models based on multiple chaotic mappings, encrypting the neural network model at two levels: the computational topology and parameter values. This method separates model data computation, gradient update processes, and the encryption process, protecting and verifying model ownership while preventing unauthorized use by attackers and protecting parameters from leakage. Its cracking difficulty is extremely high without affecting inference accuracy, and it does not incur additional training costs or the need to redesign the network. In terms of reliability, this method effectively resists various types of neural network attacks. Cracking this method is extremely difficult and computationally complex, and it does not affect inference accuracy, demonstrating a significant advantage over related technologies.

[0117] Figure 2 This application provides a flowchart illustrating a neural network model decryption method; the following is a combination of... Figure 2 The decryption process of the neural network model in the embodiments of this application is described in detail, such as... Figure 2 As shown in the embodiments of this application, the neural network model decryption method specifically includes the following steps:

[0118] Step S201: In response to the processing request of the target business, obtain the encrypted target neural network model;

[0119] In some embodiments, the decryption operation rules and decryption-related parameters are obtained simultaneously, such as the position of each parameter in the weight matrix in the corresponding layer and the position in the weight matrix of the corresponding layer when merging the weight matrices of multiple layers into a weight sequence during the above steps S101-S105.

[0120] Step S202: Determine the weight sequence in the encrypted target network model, and determine the encryption position corresponding to each parameter in each weight sequence;

[0121] Step S203: For each parameter in the weight sequence, based on the decryption operation rules, perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameter to obtain the original position of each parameter;

[0122] In practice, the number of times the nonlinear iterative operation is performed is the same as the number of times the nonlinear iterative operation is performed when the target neural network model is encrypted, and the decryption operation rule is the inverse process of the encryption operation when the target neural network model is encrypted.

[0123] In some embodiments, the following operation is performed in each nonlinear iteration:

[0124] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding third operation value is determined based on the nonlinear function corresponding to the decryption operation rule. It should be noted that if only one nonlinear iteration operation is performed, the position coordinates obtained after the previous nonlinear iteration operation are the coordinates of the encrypted position of the parameter.

[0125] The third operation value is weighted using a weighting matrix corresponding to the decryption operation rules; wherein the determinant of the inverse of the weighting matrix is ​​coprime with the preset parameter.

[0126] The weighted result of the third operation value is moduloed with the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration operation.

[0127] In one possible implementation, if the above encryption operation rule is an Arnold mapping, then the above decryption operation rule can be the inverse operation of the Arnold mapping. Specifically, its corresponding recursive formula can be:

[0128]

[0129] Among them, the above The position coordinates are the output of the k-th recursion. Let N be the position coordinates of the (k+1)th output, and N be a preset parameter. The above recursive formula satisfies the following requirements: 1) Matrix When gcd(detC,N) = 1, the gcd() function is used to find the greatest common divisor. gcd(detC,N) = 1 indicates that detC and N are coprime, and detC represents the determinant of matrix C; 2) a, b, c…j, s are all integers; 3) The nonlinear parts G1 and G2 are nonlinear functions. The values ​​of each parameter are the same as the values ​​of the parameters when performing Arnold mapping during encryption.

[0130] In some embodiments, the above-mentioned method of performing at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameters based on the decryption operation rules to obtain the original positions of each parameter specifically includes:

[0131] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the parameters to obtain the candidate positions of each parameter. In some embodiments, the candidate position of each parameter is the position of the parameter within the target cube. The target cube is the smallest cube that can accommodate all parameters in the weight matrix. The process of the nonlinear iterative operation can be referred to the above description, and its preset parameter is the side length of the target cube.

[0132] Based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined. In some embodiments, the candidate positions of each parameter and the correspondence between the candidate positions and the original positions are the positions of each parameter in the weight matrix recorded in step S104 and their positions within the target cube; based on this correspondence, the initial positions of each parameter can be determined, and the parameter positions can be restored.

[0133] Step S204: For each weight sequence, distribute each parameter in the weight sequence to the corresponding original position coordinates, and restore the weight sequence to a weight matrix of multiple layers;

[0134] In some embodiments, when merging the weight matrices of multiple layers into a weight sequence in step S103 above, information such as the position of each parameter in the weight matrix in the corresponding layer and the position in the weight matrix of the corresponding layer is recorded. Based on this information, the weight sequence can be restored into a weight matrix of multiple layers.

[0135] Step S205: Based on the weight matrix corresponding to each layer, determine the decrypted target network model, and use the decrypted target network model to process the target service.

[0136] In some embodiments, if the parameters in the target neural network model are encrypted during the encryption process, then the parameters also need to be decrypted based on the following steps:

[0137] Obtain the preset initial value, target chaotic mapping parameters, and encryption factor; these preset initial value, target chaotic mapping parameters, and encryption factor are stored during the parameter encryption process.

[0138] Based on the target chaotic mapping parameters, at least one chaotic mapping is performed on the preset initial value to obtain the corresponding verification factor; if the difference between the verification factor and the encryption factor is less than a preset threshold, the parameters in the target network model are decrypted using the encryption factor. The preset threshold can be set based on specific model and environmental requirements, and this application embodiment does not impose any restrictions.

[0139] It should be noted that the decryption order when decrypting the target neural network model corresponds to the encryption order of the model. For example, if the model parameters are encrypted first and then the parameter positions are encrypted during the model encryption process (i.e., steps S102-S104), then during decryption, the parameter positions are decrypted first and then the model parameters are decrypted.

[0140] Figure 3 A schematic flowchart illustrating a possible neural network encryption process provided in this application embodiment; the following is combined with... Figure 3 The neural network encryption process described above is illustrated in one possible implementation. It should be noted that this process assumes that the parameters are first encrypted using a Logistic mapping, and then the positions of the parameters in the model are encrypted using an Arnold mapping. Furthermore, the process of training the model based on business data is omitted. Figure 3 As shown, the specific implementation process is as follows:

[0141] Step S301: Obtain the target neural network model;

[0142] Step S302: Obtain the set of parameters M to be encrypted for the target neural network model;

[0143] Step S303: Perform Logistic mapping on each parameter in the set of parameters to be encrypted M;

[0144] In some embodiments, m sets of parameters are set, each set of parameters including: a preset initial value x0, the number of iterations q, and a parameter r. It should be noted that the number of parameter sets m can be set based on the model requirements, with a minimum value of 1 and a maximum value of the number of parameters M in the set of parameters to be encrypted, i.e., m∈M.

[0145] It should be noted that the above-mentioned preset initial value x0 and parameter r satisfy the following conditions:

[0146]

[0147] At the same time, the values ​​of each set of parameters and the parameters to be encrypted are combined and stored, for example, as Key1 for decryption: in, Represents m x0, q m Represents m q, rm It represents m r.

[0148] Then, based on the following formula, q iterations are performed to obtain the encryption factor x. q :

[0149] x j+1 =r(1-x) j )

[0150] At the same time, Key1 and x j (m) are saved to the decryption storage medium to avoid calculation errors during subsequent decryption.

[0151] Step S304: Obtain the encrypted parameters;

[0152] In some embodiments, if parameter w select The corresponding encryption factor is x. j Then w can be select +x j The encrypted parameters are saved into the model.

[0153] Step S305: Segment the target neural network model and merge the weight matrices;

[0154] In some embodiments, all layers in the target neural network model are divided into L groups, and each group is encrypted using the same or different parameters. This application does not limit the specific division method.

[0155] In some embodiments, l sets of parameters are set, each set of parameters including: matrix C, iteration number K, and functions G1 and G2. It should be noted that the number of parameter sets l can be set based on model requirements, with a minimum value of 1 and a maximum value of the number of groups L, l∈L.

[0156] Step S306: Map the positions of each parameter;

[0157] The process involves constructing a cube: flattening and serializing the weight matrices of multiple layers within each group to obtain a weight sequence, and then calculating the target cube corresponding to that weight sequence.

[0158] Assuming the final weight sequence has N parameters, then the side length of this cube is:

[0159]

[0160] According to the preset mapping rules, the original position coordinates of the parameters (i.e., their position coordinates in the weight matrix) are mapped to the corresponding position coordinates within the target cube; if size 3>N, perform padding operations on the extra positions of the target cube, and record the position coordinates of each parameter (including the empty elements); at the same time, record the position of each parameter in the weight matrix and its position in the target cube, so as to be used in subsequent model decryption.

[0161] Step S307: Perform Arnold mapping (non-linear) on each parameter;

[0162] Based on the following formula, the encrypted position coordinates are obtained by performing K recursive iterations on the position coordinates mapped to each parameter (i.e., the corresponding position coordinates within the target cube):

[0163]

[0164] Where k is 0, the above The position coordinates are the result of parameter mapping. When k is not 0, the above... The position coordinates are the output of the k-th recursion. Let N be the position coordinates of the (k+1)th output, and N be a preset parameter. The above recursive formula satisfies the following requirements: 1) Matrix When gcd(det C, N) = 1, the gcd() function is used to find the greatest common divisor. gcd(det C, N) = 1 indicates that det C and N are coprime, and det C represents the determinant of matrix C; 2) a, b, c...j, s are all integers, and their values ​​are not restricted; 3) The nonlinear parts G1 and G2 are nonlinear functions, such as polynomial functions, exponential functions, and other nonlinear function forms. For example, G t (x)=ax a +bx b +…+x 1 +1, t=1,2.

[0165] At the same time, record the corresponding Key2: L is the set of groups from the partition.

[0166] Step S308: Obtain the encrypted target neural network model;

[0167] In some embodiments, the position coordinates of each parameter obtained after recursion are recorded, and the storage location of each parameter in the computation topology is moved to the coordinate position after recursion to complete the computation topology encryption.

[0168] Figure 4 A flowchart illustrating a possible neural network decryption process provided in this application embodiment; the following is combined with... Figure 4 The neural network decryption process described above is illustrated in one possible implementation; it should be noted that this process is related to... Figure 3The encryption process corresponds to the decryption process, that is, during decryption, the parameter position is decrypted first, and then the parameter is decrypted; for example... Figure 4 As shown, the specific implementation process is as follows:

[0169] Step S401: Obtain the encrypted target neural network model;

[0170] Simultaneously, obtain the keys Key1, Key2, encryption factor, and the position of each parameter in the weight matrix within the weight matrix, as well as its position within the target cube.

[0171] Step S402: Perform Arnold mapping inverse transformation on each parameter in the target neural network model;

[0172] Specifically, based on Key2: The candidate positions (i.e., their coordinates within the target cube) for calculating the parameters are derived using the following recursive formula:

[0173]

[0174] For details on the values ​​and meanings of each parameter, please refer to step S307 above.

[0175] Step S403: Based on the pre-stored candidate positions of each parameter and the correspondence between the candidate positions and the original positions, determine the original positions of each parameter.

[0176] Based on the pre-stored candidate positions of each parameter and the correspondence between the candidate positions and the original positions, that is, the position of each parameter in the weight matrix and its position in the target cube, the original position of each parameter is determined.

[0177] Step S404: Perform Logistic mapping verification based on Key1, and decrypt each parameter corresponding to the set of parameters to be encrypted M;

[0178] Based on Key1: Then, based on the following formula, q iterations are performed to obtain the factor to be verified.

[0179] x j+1 =r(1-x) j )

[0180] like If ε is an arbitrarily small real number, the verification result is correct; based on the obtained encryption factor x q Decrypt its corresponding parameters. Use the pre-stored x q To avoid calculation errors and prevent affecting model accuracy.

[0181] Step S405: Process the target business based on the decrypted target neural network model;

[0182] In some embodiments, the process is F out =(w encrypt F in -x q F in ), where F in For the target business data input, F out For the target business data to be output, w encrypt w is the encryption parameter in the target neural network. encrypt =w select +x q w select These are the initial parameters in the target neural network before encryption.

[0183] The effectiveness of the above methods is analyzed below:

[0184] 1. The Logistic mapping has the following properties: 1) nonlinearity; 2) sensitive dependence on initial values; 3) overall stability but local instability; 4) long-term unpredictability. Therefore, for continuous weighted data, long-term prediction is almost impossible while protecting the initial values ​​and recursive parameters.

[0185] 2. Non-linear Arnold mapping: Brute-force solution has extremely high complexity. To solve this mapping brute-force, Key2 needs to be obtained. It is extremely difficult to guess the above parameters without any reference data.

[0186] Assume that the transformation matrix C used satisfies the following conditions: Parameters a, b, and c can only take two values. The nonlinear part is a polynomial function with the highest order being N1 and N2, and the coefficients are all 1. Given that there is no sampling selection process in the grouping process, the brute-force solution has a complexity of O(K). L )*O(2 4L The complexity expression is 1.1259 × 10^(N1) * O(N2), where O() is the growth rate of the function in Big O notation, also known as the order of the function, i.e., the letter O represents Order. Assuming K is at most 10, N1 = 5, N2 = 5, and the target neural network model is VGG-16 (13 layers) with L = 13, then the complexity expression is 1.1259 × 10^(N2) * O(N1), where O() is the growth rate of the function in Big O notation, also known as the order of the function. 30 This means that cracking it is extremely complex.

[0187] The following example describes the forward and inverse transformation processes of the nonlinear Arnold map in the above method:

[0188] Assuming the target cube is a cube with a side length of 2, the corresponding weight sequence includes 8 parameters, and the positive transformation matrix is:

[0189]

[0190] The inverse transformation matrix is:

[0191]

[0192] in, a = b = c = d = 1; the nonlinear part is set to G1(x) = 4x 4 +2x 2 +1, G2(x) = 5x 5 +3x 3 +1, with coefficients set to j=2 and s=1.

[0193] The candidate coordinates corresponding to the 8 parameters in the weight sequence are as follows: (0, 0, 0), (0, 1, 0), (1, 0, 0), (1, 1, 0), (0, 0, 1), (0, 1, 1), (1, 0, 1), (1, 1, 1);

[0194] After recursively applying the positive transformation matrix 10 times, the coordinates are as follows: (1, 1, 1), (1, 1, 0), (0, 1, 1), (0, 1, 0), (1, 0, 1), (1, 0, 0), (0, 0, 1), (0, 0, 0);

[0195] After recursively applying the inverse transformation matrix 10 times, the coordinates are as follows: (0, 0, 0), (0, 1, 0), (1, 0, 0), (1, 1, 0), (0, 0, 1), (0, 1, 1), (1, 0, 1), (1, 1, 1).

[0196] Where (u, v, w) represents the position coordinates of the (u+1)th layer, (v+1)th row, and (w+1)th column within the target cube.

[0197] Figure 5 Please refer to the schematic diagram of a neural network model encryption device provided in this application embodiment. Figure 5 This application provides a neural network model encryption device, which includes:

[0198] The first acquisition module 501 is used to acquire business data and use the business data to train the neural network to obtain a target neural network that meets the business requirements.

[0199] Grouping module 502 is used to divide multiple layers of the target neural network model into at least one group in response to a model acquisition request from the target object;

[0200] The merging module 503 is used to merge the weight matrices of multiple layers within any given group to obtain a weight sequence.

[0201] The first calculation module 504 is used to perform at least one nonlinear iterative calculation on the original position coordinates of each parameter in the above weight sequence based on the encryption calculation rules, so as to obtain the encrypted position corresponding to each parameter.

[0202] The sending module 505 is used to distribute each parameter in the above weight sequence to the corresponding encryption position to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0203] In some possible implementations, the merging module 503 is used to merge the weight matrices of multiple layers within the group to obtain a weight sequence, including:

[0204] For any layer within the above group, the weight matrix of any layer is reduced in dimensionality based on preset rules to obtain the corresponding processing result;

[0205] The processing results of each layer within the above group are merged to obtain the above weight sequence.

[0206] In some possible implementations, the first calculation module 504 is used to perform at least one nonlinear iterative calculation on the original position coordinates of the parameters based on encryption calculation rules, including:

[0207] Determine the target cube corresponding to the above weight matrix, wherein the target cube is the smallest cube that can accommodate all the parameters in the above weight matrix;

[0208] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates within the target cube.

[0209] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameters are mapped.

[0210] In some possible implementations, the first calculation module 504 performs the following operations in each nonlinear iteration calculation:

[0211] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding first operation value is determined based on the nonlinear function corresponding to the above encryption operation rules;

[0212] Using the weighting matrix corresponding to the above encryption operation rules, the position coordinates obtained after the previous nonlinear iteration operation are weighted to obtain the corresponding second operation value; wherein, the determinant of the above weighting matrix is ​​coprime with the preset parameter;

[0213] The sum of the first and second calculated values ​​is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration.

[0214] In some possible implementations, the aforementioned preset parameter is the side length of the target cube.

[0215] In some possible implementations, the sending module 505 is used, before sending the encrypted target neural network to the target object, to further:

[0216] Obtain the set of parameters to be encrypted for the target neural network model mentioned above, which includes multiple parameters to be encrypted;

[0217] Based on the encryption factor, each of the above parameters to be encrypted is encrypted;

[0218] The encryption factor mentioned above is determined based on the following method:

[0219] Based on the target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding encryption factor.

[0220] Figure 6 A schematic diagram of a neural network model decryption device provided in an embodiment of this application is shown below. Figure 6 This application provides a neural network model decryption device, which includes:

[0221] The second acquisition module 601 is used to acquire the encrypted target neural network model in response to the processing request of the target business.

[0222] The determination module 602 is used to determine the weight sequence in the encrypted target network model and determine the encryption position corresponding to each parameter in each weight sequence;

[0223] The second operation module 603 is used to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to each parameter in the above weight sequence based on the decryption operation rules, so as to obtain the original position of each parameter.

[0224] The restoration module 604 is used to distribute each parameter in the weight sequence to the corresponding original position coordinates for each weight sequence, and restore the weight sequence to a weight matrix of multiple layers.

[0225] The processing module 605 is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and to process the above-mentioned target service using the decrypted target network model.

[0226] In some possible implementations, the second operation module 603 is used to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the above parameters based on the decryption operation rules, to obtain the original positions of each parameter, including:

[0227] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameters to obtain the candidate positions of each parameter;

[0228] Based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined.

[0229] In some possible implementations, the second operation module 603 described above performs the following operations in each nonlinear iteration operation:

[0230] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding third operation value is determined based on the nonlinear function corresponding to the above decryption operation rules.

[0231] The third operation value is weighted using a weighting matrix corresponding to the above decryption operation rules; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter.

[0232] The weighted result of the third operation value is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration operation.

[0233] In some possible implementations, the candidate position is the position of the parameter within the target cube, the target cube is the smallest cube that can accommodate all the parameters in the weight matrix, and the preset parameter is the side length of the target cube.

[0234] In some possible implementations, before the processing module 605 processes the target service using the decrypted target network model, it is further configured to:

[0235] Obtain the preset initial value, target chaotic mapping parameters, and encryption factor;

[0236] Based on the above target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding factor to be verified.

[0237] If the difference between the aforementioned verification factor and the aforementioned encryption factor is less than a preset threshold, then the parameters in the aforementioned target network model are decrypted using the aforementioned encryption factor.

[0238] Based on the same disclosed concept, this application also provides a test data construction device. Since this device is the same as the device in the method of this application, and the principle of the device in solving the problem is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0239] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0240] In some possible implementations, the device according to this application may include at least one processor and at least one memory. The memory stores program code that, when executed by the processor, causes the processor to perform the steps in the test data construction methods according to various exemplary embodiments of this application described above.

[0241] The following reference Figure 7 The device 700 according to this embodiment of the present application is described. Figure 7 The device 700 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0242] like Figure 7 As shown, device 700 is presented as a general-purpose device for performing encryption of neural network models. Components of device 700 may include, but are not limited to: at least one processor 701, at least one memory 702, and a bus 703 connecting different system components (including memory 702 and processor 701). The memory stores program code that, when executed by the processor, causes the processor to perform the following steps:

[0243] Acquire business data, use the aforementioned business data to train the neural network to obtain the target neural network that meets the business requirements;

[0244] In response to the model acquisition request of the target object, the multiple layers of the target neural network model are divided into at least one group;

[0245] For any group, the weight matrices of multiple layers within the group are merged to obtain a weight sequence;

[0246] For each parameter in the above weight sequence, based on the encryption operation rules, at least one nonlinear iterative operation is performed on the original position coordinates of the above parameter to obtain the encrypted position corresponding to each parameter;

[0247] Distribute the parameters in the above weight sequence to the corresponding encryption positions to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0248] Bus 703 represents one or more of several bus architectures, including a memory bus or memory controller, peripheral bus, processor, or a local bus using any of the various bus architectures.

[0249] The memory 702 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 7021 and / or cache memory 7022, and may further include read-only memory (ROM) 7023.

[0250] The memory 702 may also include a program / utility 7025 having a set (at least one) of program modules 7024, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0251] Device 700 can also communicate with one or more external devices 704 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with device 700, and / or with any device that enables device 700 to communicate with one or more other devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 705. Furthermore, device 700 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 706. As shown, network adapter 706 communicates with other modules used with device 700 via bus 703. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with device 700, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0252] In one possible implementation, the processor described above is specifically used for:

[0253] For any layer within the above group, the weight matrix of any layer is reduced in dimensionality based on preset rules to obtain the corresponding processing result;

[0254] The processing results of each layer within the above group are merged to obtain the above weight sequence.

[0255] In one possible implementation, the processor described above is specifically used for:

[0256] Determine the target cube corresponding to the above weight matrix, wherein the target cube is the smallest cube that can accommodate all the parameters in the above weight matrix;

[0257] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates within the target cube.

[0258] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameters are mapped.

[0259] In one possible implementation, the processor performs the following operation in each nonlinear iteration:

[0260] Using the position coordinates obtained after the previous nonlinear iteration as input, the corresponding first operation value is determined based on the nonlinear function corresponding to the above encryption operation rules;

[0261] Using the weighting matrix corresponding to the above encryption operation rules, the position coordinates obtained after the previous nonlinear iteration operation are weighted to obtain the corresponding second operation value; wherein, the determinant of the above weighting matrix is ​​coprime with the preset parameter;

[0262] The sum of the first and second calculated values ​​is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration.

[0263] In one possible implementation, the preset parameter is the side length of the target cube.

[0264] In one possible implementation, before sending the encrypted target neural network to the target object, the processor is further configured to:

[0265] Obtain the set of parameters to be encrypted for the target neural network model mentioned above, which includes multiple parameters to be encrypted;

[0266] Based on the encryption factor, each of the above parameters to be encrypted is encrypted;

[0267] The encryption factor is determined as follows: based on the target chaotic mapping parameter, the preset initial value is subjected to chaotic mapping at least once to obtain the corresponding encryption factor.

[0268] This application embodiment also provides another device 800 for performing decryption of a neural network model, such as... Figure 8As shown, device 800 is presented in the form of a general-purpose device. Components of device 800 may include, but are not limited to: at least one processor 801, at least one memory 802, and a bus 803 connecting different system components (including memory 802 and processor 801). The memory stores program code, which, when executed by the processor, causes the processor to perform the following steps:

[0269] In response to the processing request of the target service, the encrypted target neural network model is obtained; the weight sequence in the encrypted target network model is determined, and the encryption position corresponding to each parameter in each weight sequence is determined; for each parameter in the above weight sequence, based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encryption position coordinates corresponding to the above parameter to obtain the original position of each parameter; for each weight sequence, each parameter in the above weight sequence is distributed to the corresponding original position coordinates, and the above weight sequence is restored to a weight matrix of multiple layers; based on the weight matrix corresponding to each layer, the decrypted target network model is determined, and the decrypted target network model is used to process the above target service.

[0270] Bus 803 represents one or more of several bus structures, including a memory bus or memory controller, peripheral bus, processor, or a local bus using any of the various bus structures.

[0271] The memory 802 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 8021 and / or cache memory 8022, and may further include read-only memory (ROM) 8023.

[0272] The memory 802 may also include a program / utility 8025 having a set (at least one) of program modules 8024, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0273] Device 800 can also communicate with one or more external devices 804 (e.g., keyboard, pointing device, etc.), and with one or more devices that enable a user to interact with device 800, and / or with any device that enables device 800 to communicate with one or more other devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 805. Furthermore, device 800 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 806. As shown, network adapter 806 communicates with other modules used with device 800 via bus 803. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with device 800, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0274] In some possible implementations, the processor described above is specifically used for:

[0275] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameters to obtain the candidate positions of each parameter; based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined.

[0276] In some possible implementations, the processor performs the following operation in each nonlinear iteration: taking the position coordinates obtained after the previous nonlinear iteration as input, and determining the corresponding third operation value based on the nonlinear function corresponding to the above decryption operation rule;

[0277] The third operation value is weighted using a weighting matrix corresponding to the above decryption operation rules; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter.

[0278] The weighted result of the third operation value is moduloed by the preset parameters to obtain the position coordinates corresponding to the current nonlinear iteration operation.

[0279] In some possible implementations, the candidate position is the position of the parameter within the target cube, the target cube is the smallest cube that can accommodate all the parameters in the weight matrix, and the preset parameter is the side length of the target cube.

[0280] In some possible implementations, before the processor processes the target service using the decrypted target network model, it is further configured to: obtain a preset initial value, a target chaotic mapping parameter, and an encryption factor; perform at least one chaotic mapping on the preset initial value based on the target chaotic mapping parameter to obtain a corresponding factor to be verified; if the difference between the factor to be verified and the encryption factor is less than a preset threshold, then decrypt the parameters in the target network model using the encryption factor.

[0281] In some possible implementations, various aspects of the neural network model encryption method and neural network model decryption method provided in this application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to cause the computer device to perform the steps in the neural network model encryption method and neural network model decryption method according to the various exemplary embodiments of this application described above.

[0282] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0283] The monitoring program product of the embodiments of this application can be a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a device. However, the program product of this application is not limited to this. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0284] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0285] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0286] Program code for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user device, partially on the user device, as a standalone software package, partially on the user device and partially on a remote device, or entirely on a remote device or server. In cases involving remote devices, the remote device can be connected to the user device via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external device (e.g., via the Internet using an Internet service provider).

[0287] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0288] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0289] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0290] This application is described with reference to flowchart illustrations and block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block and / or segment of the flowchart illustrations and block diagrams, as well as combinations of blocks and segments in the flowchart illustrations and block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations. Figure 1 One or more processes and boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0291] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and boxes Figure 1 The function specified in one or more boxes.

[0292] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and boxes Figure 1 The steps of the function specified in one or more boxes.

[0293] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0294] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for encrypting a neural network model, characterized in that, The method includes: Acquire business data, and use the business data to train the neural network to obtain a target neural network that meets business requirements; In response to a model acquisition request for a target object, the multiple layers of the target neural network model are divided into at least one group; For any group, the weight matrices of multiple layers within the group are merged to obtain a weight sequence; For each parameter in the weight sequence, a target cube corresponding to the weight matrix is ​​determined. The target cube is the smallest cube that can accommodate all parameters in the weight matrix. According to the preset mapping rules, the original position coordinates of the parameters are mapped to the corresponding position coordinates within the target cube; Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after parameter mapping to obtain the encrypted position corresponding to each parameter. In each nonlinear iterative operation, the following operations are performed: using the position coordinates obtained after the previous nonlinear iterative operation as input, a first operation value is determined based on the nonlinear function corresponding to the encryption operation rules; the position coordinates obtained after the previous nonlinear iterative operation are weighted using a weighting matrix corresponding to the encryption operation rules to obtain a second operation value; wherein the determinant of the weighting matrix is ​​coprime to a preset parameter; the sum of the first and second operation values ​​is moduloed by the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation. The parameters in the weight sequence are distributed to the corresponding encryption positions to obtain the encrypted target neural network model, and the encrypted target neural network is sent to the target object.

2. The method according to claim 1, characterized in that, The weight matrices of multiple layers within the group are merged to obtain a weight sequence, including: For any layer within the group, the weight matrix of any layer is reduced in dimensionality based on a preset rule to obtain the corresponding processing result; The processing results of each layer within the group are merged to obtain the weight sequence.

3. The method according to claim 1, characterized in that, The preset parameter is the side length of the target cube.

4. The method according to any one of claims 1 to 3, characterized in that, Before sending the encrypted target neural network to the target object, the method further includes: Obtain the set of parameters to be encrypted for the target neural network model, wherein the set of parameters to be encrypted includes multiple parameters to be encrypted; Based on the encryption factor, each parameter to be encrypted is encrypted; The encryption factor is determined in the following manner: Based on the target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding encryption factor.

5. A method for decrypting a neural network model, characterized in that, The method includes: In response to the processing request of the target business, obtain the encrypted target neural network model; Determine the weight sequence in the encrypted target network model, and determine the encryption position corresponding to each parameter in each weight sequence; For each parameter in the weight sequence, based on the decryption operation rule, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the parameter to obtain the candidate positions of each parameter. In each nonlinear iterative operation, the following operations are performed: using the position coordinates obtained after the previous nonlinear iterative operation as input, a corresponding third operation value is determined based on the nonlinear function corresponding to the decryption operation rule; the third operation value is weighted using a weighting matrix corresponding to the decryption operation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with a preset parameter; the result of the weighted third operation value is moduloed by the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation. Based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined. For each weight sequence, the parameters in the weight sequence are distributed to the corresponding original position coordinates, and the weight sequence is restored to a weight matrix of multiple layers; Based on the weight matrix corresponding to each layer, the decrypted target network model is determined, and the target service is processed using the decrypted target network model.

6. The method according to claim 5, characterized in that, The candidate position is the position of the parameter within the target cube, the target cube is the smallest cube that can accommodate all parameters in the weight matrix, and the preset parameter is the side length of the target cube.

7. The method according to claim 5 or 6, characterized in that, Before processing the target service using the decrypted target network model, the method further includes: Obtain the preset initial value, target chaotic mapping parameters, and encryption factor; Based on the target chaotic mapping parameters, perform at least one chaotic mapping on the preset initial value to obtain the corresponding factor to be verified. If the difference between the factor to be verified and the encryption factor is less than a preset threshold, then the encryption factor is used to decrypt the parameters in the target network model.

8. A neural network model encryption device, characterized in that, The device includes: The first acquisition module is used to acquire business data and use the business data to train the neural network to obtain a target neural network that meets the business requirements. A grouping module is used to divide multiple layers of the target neural network model into at least one group in response to a model acquisition request from the target object. The merging module is used to merge the weight matrices of multiple layers within any group to obtain a weight sequence. The first calculation module is used to determine a target cube corresponding to the weight matrix for each parameter in the weight sequence, wherein the target cube is the smallest cube capable of accommodating all parameters in the weight matrix; map the original position coordinates of the parameter to the corresponding position coordinates within the target cube according to a preset mapping rule; and perform at least one nonlinear iterative calculation on the mapped position coordinates of the parameter based on an encryption calculation rule to obtain an encrypted position corresponding to each parameter; wherein, in each nonlinear iterative calculation, the following operations are performed: using the position coordinates obtained after the previous nonlinear iterative calculation as input, a first calculation value is determined based on a nonlinear function corresponding to the encryption calculation rule; the position coordinates obtained after the previous nonlinear iterative calculation are weighted using a weighting matrix corresponding to the encryption calculation rule to obtain a second calculation value; wherein the determinant of the weighting matrix is ​​coprime with a preset parameter; and the sum of the first calculation value and the second calculation value is moduloed by the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative calculation. The sending module is used to distribute each parameter in the weight sequence to the corresponding encryption position to obtain the encrypted target neural network model, and send the encrypted target neural network to the target object.

9. A neural network model decryption device, characterized in that, The device includes: The second acquisition module is used to acquire the encrypted target neural network model in response to the processing request of the target business. The determination module is used to determine the weight sequence in the encrypted target network model and to determine the encryption position corresponding to each parameter in each weight sequence. The second calculation module is used to perform at least one nonlinear iterative calculation on the encrypted position coordinates corresponding to each parameter in the weight sequence, based on the decryption calculation rule, to obtain candidate positions for each parameter. In each nonlinear iterative calculation, the following operations are performed: using the position coordinates obtained after the previous nonlinear iterative calculation as input, a corresponding third calculation value is determined based on the nonlinear function corresponding to the decryption calculation rule; the third calculation value is weighted using a weighting matrix corresponding to the decryption calculation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with a preset parameter; the result of the weighted third calculation value is moduloed by the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative calculation; and the original position of each parameter is determined based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions. The restoration module is used to distribute each parameter in the weight sequence to the corresponding original position coordinates for each weight sequence, and restore the weight sequence to a weight matrix of multiple layers; The processing module is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and to process the target service using the decrypted target network model.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.

Images