A gpu-based multi-party machine learning secure inference pipeline method and system

Abstract

The application discloses a kind of multi-party machine learning security inference pipeline method and system based on GPU, including the task of machine learning model inference is divided into two pipeline stages, calculation stage and communication stage, calculation stage is completed on GPU:MPC protocol uses Beaver triplet to realize multiplication and AND operation;For general Beaver triplet protocol, in order to perform multiplication or AND operation, MPC server needs to distribute the metadata related to the two operands to other MPC servers before calculation;The application uses secure multi-party computation protocol secret sharing technology to protect client data and model parameters to ensure the safety of the inference process, overlaps communication and calculation to form a pipeline operation to reduce the time of the inference process, and the whole process is completed on GPU to further improve the efficiency of model inference.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of machine learning inference, in particular to a multi-party machine learning secure inference pipeline method based on GPU. BACKGROUND

[0002] Multi-party computation (MPC) as a secure computation model, especially machine learning (ML) inference model, has been more and more widely used in the past few years. Compared with competitors, the overhead of MPC is less than homomorphic encryption (HE), and has a stronger threat model than hardware-based trusted execution environment (TEE) (such as Intel SGX). Although MPC protocols have obvious advantages, compared with plaintext, MPC protocols still pay a huge performance cost when applied to machine learning algorithms. The overhead is due to the increased computing and communication costs. For the multiplication operation that exists universally in machine learning algorithms, MPC protocols increase the computing cost by several tens of times and a round of broadcast between MPC servers. In addition, due to the increase in communication, machine learning calculations like Softmax, ReLU and other nonlinear operations that have very small overhead in plaintext become very expensive. These additional overheads make the deployment of MPC in real-time machine learning inference frameworks (such as speech translation) less satisfactory.

[0003] Most of the current MPC protocols perform communication and computation in a sequential manner. This serialization is a necessary condition for the correct operation of MPC. Without data communication, the two parties cannot proceed to the next computing step, so in the MPC setting, the GPU servers of the two parties are in an idle state while waiting for the data transmission to be completed, so the GPU utilization is low during the communication phase. For this reason, we propose a multi-party machine learning secure inference pipeline method based on GPU to solve the above problems. SUMMARY

[0004] The application divides the task of machine learning model inference into two pipeline stages, a calculation stage and a communication stage, and the calculation stage is completed on a GPU: the MPC protocol uses Beaver triples to implement multiplication and AND operations; for the general Beaver triple protocol, in order to perform multiplication or AND operation, the MPC server needs to distribute the metadata related to the two operation numbers to other MPC servers before calculation; for linear layers such as convolution layers and dense layers, one of the metadata related to the operation number (weight) is independent of the input, because the layer weight is static during inference, therefore, sending the metadata independent of the input can be overlapped with calculation to reduce the total inference runtime, the above is the MPC pipeline technology designed by the application for linear layers; for nonlinear layers such as Softmax and ReLU layers, there is no metadata independent of the input, and the inter-layer pipelining cannot benefit the nonlinear layers, in order to realize the overlap of communication and calculation, the input is divided into n small blocks. At the time of calculation block i, the MPC server can send the metadata related to block i+1 to reduce the inference delay.

[0005] To achieve the above object, the application provides the following technical scheme: a GPU-based multi-party machine learning secure inference pipeline method, comprising an MPC client, an MPC server, a completed machine learning model and a GPU processor, the machine learning model comprising linear layers and nonlinear layers, the linear layers and the nonlinear layers both adopting a pipeline design, and the method comprises the following specific steps:

[0006] Step S1, obtaining the dimension information of the machine learning model weight and input;

[0007] Step S2, measuring the threshold value of the machine learning model internal level pipeline stop producing acceleration;

[0008] Step S3, the MPC client distributes the operation number and the total machine learning model weight parameter in the form of secret sharing to each MPC server;

[0009] Step S4, each MPC server uses the MPC pipeline to perform linear task inference and nonlinear task inference of the machine learning model, and uses the GPU server to complete the calculation task, in the linear task inference process, triples are generated through the weight parameter and the dimension information of the input, and in the nonlinear task inference process, it is judged whether the input data meets the internal pipeline operation through the threshold value measured in step S2;

[0010] Step S5, each MPC server sends the result of the machine learning model inference to the MPC client for data merging to obtain the final inference result.

[0011] Preferably, the step S1 is specifically operated as follows: the running data is input into the machine learning model, the running data is calculated by forward propagation of the linear layer to obtain a prediction value, a loss function of the machine learning model is calculated, a gradient is calculated by back propagation, and the machine learning model is updated.

[0012] Preferably, the step S2 is specifically operated as follows: the running is performed using different input dimensions in the nonlinear layer level in the machine learning model, the maximum input dimension and the minimum input dimension are taken as threshold values, and whether the input data meets the condition for internal pipeline operation is judged by the threshold values.

[0013] Preferably, the step S3 is specifically operated as follows: the MPC client divides the data to be calculated and the total machine learning model weight parameter into several shares, and each share is sent to the MPC server in the form of a secret share.

[0014] Preferably, the step S4 is specifically operated as follows: the machine learning model inference is divided into linear task inference and nonlinear task inference, the linear task inference broadcasts the next layer and other MPC servers while calculating the result of each layer, and the nonlinear task inference uses an optimized linear calculation method in a secure multi-party computation protocol to replace the original nonlinear calculation, and the nonlinear task inference process takes the final result of the linear task inference as input data.

[0015] Preferably, the linear task inference is specifically operated as follows:

[0016] Step S411, each MPC server takes the data secret shared in step S3 as input data of a linear layer;

[0017] Step S412, each MPC server randomly generates a triple in each layer of the linear layer;

[0018] Step S413, steps S4121, S4122, S4123 and S4124 are performed simultaneously;

[0019] Step S4131, an operand in the input data of the linear layer is subtracted by one of the triples in the layer, and the difference is broadcast to other MPC servers;

[0020] Step S4132, the linear layer receives the difference broadcast by other MPC servers in the same layer;

[0021] Step S4133, the product of the input data and the weight of the linear layer is calculated by the triple of the linear layer;

[0022] Step S4134, the weight of the next layer is subtracted by one of the triples of the next layer, and the difference is broadcast to the next layer.

[0023] Step S414, if the linear layer is the last layer, output the final result; otherwise, repeat steps S412 and S413 until the last layer of the linear layer.

[0024] Preferably, the non-linear task reasoning specific process is as follows:

[0025] Step S421, the result of the linear layer is mapped by the activation function.

[0026] Step S422, the non-linear calculation formula is replaced by linear calculation.

[0027] Step S423, judge whether the input data meets the condition of internal pipeline operation, if the result is yes, execute step S424; otherwise, execute step S425.

[0028] Step S424, the final result of the linear layer is converted into binary, and the converted result is divided into several batches of data, each batch of data is shared to other MPC servers using the password sharing technology, while calculating each batch of data, the next batch of data starts to transmit, and the result of each non-linear layer calculation is transmitted to the next layer for repeated operation until the last layer outputs the final result.

[0029] Step S425, each layer performs matrix multiplication operation according to the respective weight and input data, until the last layer outputs the result.

[0030] A GPU-based multi-party machine learning secure inference pipeline system, comprising a memory and one or more processors, the memory stores executable code, and the one or more processors execute the executable code to implement a GPU-based multi-party machine learning secure inference pipeline method.

[0031] A computer readable storage medium having a program stored thereon, which, when executed by a processor, implements a GPU-based multi-party machine learning secure inference pipeline method.

[0032] Compared with the prior art, the beneficial effects of the present application are:

[0033] First, improve the calculation efficiency: GPU (Graphics Processing Unit) has parallel computing capability, which can handle multiple tasks at the same time; by combining the secure inference pipeline method with GPU, the parallel computing capability of GPU can be fully utilized to speed up the secure inference process. The advantage of this parallel computing can reduce the calculation time and improve the overall calculation efficiency.

[0034] Second, reducing communication overhead: In multi-party secure computation, communication is needed between participants to share necessary information and computation results; the secure inference pipeline method optimizes the communication process by overlapping communication with computation, reducing unnecessary communication overhead, which can greatly reduce the overall communication time and improve the efficiency of computation.

[0035] Third, improving privacy protection performance: One of the goals of multi-party secure computation is to protect the privacy of participants and ensure that their input data is not obtained by other participants; the secure inference pipeline method can effectively reduce the number of intermediate result transmissions, thereby reducing the risk of information leakage, and through reducing communication, the privacy of participants is better protected.

[0036] Fourth, supporting large-scale machine learning tasks: GPUs have significant advantages in processing large-scale machine learning tasks; the secure inference pipeline method combines the high-performance computing capabilities of GPUs to handle larger-scale machine learning tasks, providing higher scalability and scalability. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a flowchart of the MPC pipeline technology of the present application;

[0038] Figure 2 is a neural network model linear layer inference task pipeline diagram of the present application;

[0039] Figure 3 is a neural network non-linear layer inference task pipeline diagram of the present application;

[0040] Figure 4 is a hardware structure diagram of a GPU-based multi-party machine learning secure inference pipeline system on any device with data processing capability. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0042] REFERENCE Figures 1-3 A GPU-based multi-party machine learning secure inference pipeline method includes an MPC client, an MPC server, a completed machine learning model, and a GPU processor. The machine learning model includes linear layers and nonlinear layers, and both linear layers and nonlinear layers use pipeline design. The specific steps of the method are as follows:

[0043] Step S1, obtain the machine learning model weight and the dimension information of the input;

[0044] Step S2, measure the threshold value of the machine learning model internal level pipeline stop producing acceleration;

[0045] Step S3, the MPC client distributes the operation number and the total machine learning model weight parameter to each MPC server in the form of secret sharing;

[0046] Step S4, each MPC server uses the MPC pipeline to perform linear task inference and nonlinear task inference on the machine learning model, and uses the GPU server to complete the calculation task. In the linear task inference process, a triple is generated by the weight parameter and the dimension information of the input. In the nonlinear task inference process, it is judged whether the input data meets the internal pipeline operation by measuring the threshold value in step S2;

[0047] Step S5, each MPC server sends the result of the machine learning model inference to the MPC client for data merging to obtain the final inference result.

[0048] MPC server refers to a GPU server for MPC calculation;

[0049] MPC client refers to a user.

[0050] Pipeline design refers to the execution program pipeline design in linear layer and nonlinear layer. The machine learning model includes convolutional neural network CNN, multilayer perception MLP, attention mechanism, etc.

[0051] The above steps complete the inference of the machine learning neural network model. The secure multi-party computation protocol secret sharing technology is used to protect the client data and model parameters to ensure the safety of the inference process. The communication and calculation are overlapped to form a pipeline operation to reduce the time of the inference process. The whole process is completed on the GPU to further improve the efficiency of the model inference.

[0052] The step S1 specifically operates as follows: input running data to the machine learning model. The running data is calculated by forward propagation of the linear layer to obtain the predicted value, the loss function of the machine learning model is calculated, and the gradient is calculated by back propagation to update the machine learning model. The MPC pipeline captures the dimension of the input data and the weight of each linear layer.

[0053] Run the model once under the non-pipelining scheme, so that the MPC pipeline can obtain the dimension information of the operation number of the linear operation. The purpose is to let the MPC pipeline capture the dimension of the model weight and the input, so as to generate appropriate Beaver triple and pre-transmission metadata subsequently.

[0054] Specifically, the step S2 is specifically operated as follows: using different input dimensions in the nonlinear level in the machine learning model to run, taking the maximum input dimension and the minimum input dimension as the threshold, and judging whether the input data meets the condition of internal pipeline operation through the threshold.

[0055] The MPC pipeline technology accelerates the computing process through internal level pipelines, but this acceleration is not unlimited. In order to determine the threshold at which the internal level pipeline of a specific system stops accelerating, measurement is needed: running in the nonlinear level in the model using different input dimensions to determine the threshold of the system, which determines the point at which the internal level pipeline stops producing acceleration. Without threshold measurement, the MPC pipeline may adversely affect the performance of the model.

[0056] Specifically, the step S3 is specifically operated as follows: the MPC client divides the data to be calculated and the total machine learning model weight parameters into several shares, and each share is sent to the MPC server in the form of a secret share.

[0057] Each layer of the total machine learning model weight is obtained through step S1, and the weight of each layer is randomly divided into several shares, and each share of weight is secretly divided to the corresponding layer of different MPC servers, that is, the weight of the same layer of different MPC servers is equal to the weight of the same layer of the total machine learning model.

[0058] The MPC client randomly divides the data to be calculated into the same share, and each share is secretly divided to different MPC servers as the input of the server.

[0059] Specifically, the step S4 of machine learning model inference is divided into linear task inference and nonlinear task inference. The linear task inference broadcasts the next layer and other MPC servers while calculating the result of each layer. The nonlinear task inference uses the optimized linear calculation method in the secure multi-party computation protocol to replace the original nonlinear calculation.

[0060] As shown in Figure 2 and as shown in Figure 3 The GPU-based multi-party machine learning secure inference pipeline structure includes a calculation phase and a communication phase. The dark gray in the figure is the communication phase, and the light gray is the calculation phase.

[0061] Calculation phase: for linear interlayer calculation, the task is to perform matrix multiplication calculation, and each layer calculates the local share obtained by secret sharing and the model weight by means of a randomly generated triple; for nonlinear interlayer calculation, the task is to perform AND operation to realize comparison operation, and each layer still needs to perform bitwise AND operation on the input data after binary conversion by means of a generated triple.

[0062] Communication phase: some data need to be broadcast among the servers participating in the calculation in the process of calculation to proceed to the next step of calculation.

[0063] Linear task inference includes machine learning workloads as linear computing tasks such as dense operations or convolution operations; nonlinear task inference includes machine learning workloads as nonlinear computing tasks such as Softmax, ReLU, and Maxpool.

[0064] Specifically, the specific process of the linear task inference is as follows:

[0065] Step S411, each MPC server takes the secret shared data obtained in step S3 as the input data of the linear layer;

[0066] Step S412, each MPC server randomly generates a triple in each layer of the linear layer;

[0067] Step S413, steps S4121, S4122, S4123 and S4124 are performed simultaneously;

[0068] Step S4131, calculate the difference between the operand in the input data of the linear layer and one of the triples in the layer, and broadcast the difference to other MPC servers;

[0069] Step S4132, the linear layer receives the difference broadcast by other MPC servers in the same layer;

[0070] Step S4133, calculate the product of the input data and the weight of the linear layer through the triple of the linear layer;

[0071] Step S4134, subtract one of the triples of the next layer from the weight of the next layer, and broadcast the difference to the next layer;

[0072] Step S414, if the linear layer is the last layer, output the final result; otherwise, repeat steps S412 and S413 until the last layer of the linear layer.

[0073] As shown in Figure 1 and Figure 2 The MPC pipeline obtains the dimension information of the total model weight and input, and each linear layer of each MPC server randomly generates a triple (a, b, c) required for calculation to start inference calculation. Assuming that there are N servers in total, each server has L linear layers, and the i-th server performs the following calculation in the l-th linear layer:

[0074]

[0075] Wherein, i represents the number of each server, I represents the number of each linear layer, X represents the input data of each layer, Y represents the weight of each layer, (X l -A l ) represents the sum of X-a calculated by each server after communication, (Y l -B l ) represents the sum of Y-b calculated by each server after communication.

[0076] The server needs to broadcast the results of each X-a and Y-b after each layer calculation, and each server receives the results of other servers to get (X-A) and (Y-B). Since this cannot be calculated, only the calculation results of (X-A) and (Y-B) are obtained, which does not expose the specific data and protects the data form.

[0077] Since the GPU in the MPC server is completely idle during broadcasting, and the metadata Y-b is completely independent of the input, the calculation and broadcasting of Y-b do not need to be performed after the completion of the calculation results of the previous layer. Before the final [z il ] of each linear layer is calculated, each linear layer can start transmitting the Y-b of the next linear layer to other servers, thereby shortening the delay of the entire inference process.

[0078] Specifically, the nonlinear task inference process is as follows:

[0079] Step S421, the results of the linear layer are nonlinearly mapped by the activation function;

[0080] Step S422, the nonlinear calculation formula is approximately replaced by linear calculation;

[0081] Step S423, determine whether the input data meets the condition for internal pipeline operation, if the result is yes, execute step S424; otherwise, execute step S425;

[0082] Step S424, the final result of the linear layer is converted into binary, and the converted result is divided into several batches of data. Each batch of data is shared to other MPC servers using the password sharing technology. While calculating each batch of data, the next batch of data starts to be transmitted. When the calculation of each nonlinear layer is completed, the result is transmitted to the next layer for repeated operation until the final result is outputted by the last layer.

[0083] Step S425, each layer performs matrix multiplication operation according to its own weight and input data, until the last layer outputs the result.

[0084] For example, Figure 1 and Figure 3As shown, the nonlinear task reasoning process takes the final result of linear task reasoning as input data, approximates the nonlinear calculation formula with linear calculation, uses the optimized linear calculation method in the secure multi-party computation protocol to replace the nonlinear calculation, thereby improving the calculation efficiency, wherein the exponential operation can be approximated as Where n is the total number of approximate iterations, and by gradually approaching this limit, the calculation of the exponential function can be converted into a combination of multiple linear calculations; the reciprocal operation is approximated as Where y0(x) = 3e0.5-x+0.003, and by multiple iterations, the calculation of the reciprocal function can be gradually approximated.

[0085] The data input into the nonlinear layer needs to be judged whether it meets the condition for internal pipeline operation: the nonlinear layer in the model uses different input dimensions to run to determine the threshold of the system; this threshold represents the point at which the internal pipeline stops producing speed improvement; if the threshold measurement is not performed, MPC-Pipe can adversely affect the performance of the model.

[0086] According to the judgment result, the input is converted into binary and secret shared, and each server divides it into smaller batches, and the communication and calculation of the batches are overlapped, thereby improving the calculation efficiency and reducing the time of waiting for irrelevant metadata, and the specific operation is that before performing the calculation for batch m, each server starts the transmission process of batch m+1, the internal layer pipeline is realized by the communication overlap of batch m and batch m+1, and the server can perform calculation on part of the large input without wasting time waiting for irrelevant metadata, and after each layer is executed, the result is transmitted to the next layer for repeated operation until the last layer outputs the final result.

[0087] According to the judgment result, the calculation is performed on the GPU according to the calculation condition of each layer, that is, the weight and input data required for calculation of each layer are subjected to matrix multiplication calculation, and the result is output by the last layer.

[0088] Finally, the client sums up the final data transmitted by each server to obtain the final result.

[0089] The embodiment of the GPU-based multi-party machine learning secure reasoning pipeline system can be applied to any device with data processing capability, which can be a device or apparatus such as a computer. The apparatus embodiment can be realized by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a logical device, it is formed by reading the corresponding computer program instructions in the non-volatile memory into the memory and running by the processor of the device with data processing capability. From the hardware level, such as Figure 4As shown, it is a hardware structure diagram of any data processing capable device where the GPU-based multi-party machine learning secure inference pipeline system of the application is located, in addition to Figure 4 In addition to the processor, the memory, the network interface, and the non-volatile memory shown, any data processing capable device where the apparatus in the embodiment is located can also include other hardware according to the actual functions of the any data processing capable device, and no further description is given. The implementation process of the functions and roles of each unit in the apparatus is specifically described in the implementation process of the corresponding steps in the above method, and no further description is given.

[0090] For the apparatus embodiment, since it basically corresponds to the method embodiment, the relevant part is described in the part of the method embodiment. The apparatus embodiment described above is only schematic, and the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e. they can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the application scheme according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0091] The embodiment of the application also provides a computer readable storage medium, which stores a program, and the program is executed by a processor to realize the GPU-based multi-party machine learning secure inference pipeline system in the above embodiment.

[0092] The computer readable storage medium can be an internal storage unit of any data processing capable device, such as a hard disk or a memory. The computer readable storage medium can also be an external storage device of any data processing capable device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can include both the internal storage unit and the external storage device of any data processing capable device. The computer readable storage medium is used to store the computer program and other programs and data required by the any data processing capable device, and can also be used to temporarily store data that has been output or will be output.

[0093] Although the embodiments of the application have been shown and described, those skilled in the art can understand that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the application, and the scope of the application is defined by the appended claims and their equivalents.

Claims

1. A GPU-based multi-party machine learning secure inference pipeline method, comprising an MPC client, an MPC server, and a completed machine learning model, wherein the machine learning model includes linear layers and nonlinear layers, both of which employ a pipeline design, and the MPC server is a GPU server performing MPC computations, characterized in that: The method comprises the following specific steps: Step S1, obtaining the dimension of the machine learning model input data and the weight of each linear layer, and preparing for generating triplets; Step S2, measuring the threshold value of the internal level pipeline stop producing acceleration of the machine learning model, and determining the internal level pipeline acceleration threshold value; Step S3, the MPC client distributes the operation number and the total machine learning model weight parameter obtained in step S1 to each MPC server in the form of secret sharing; Step S4, each MPC server uses the MPC pipeline to perform linear task reasoning and nonlinear task reasoning on the machine learning model, and uses the GPU server to complete the calculation task, and in the linear task reasoning process, the triplets are generated through the weight parameter and the dimension information of the input, and in the nonlinear task reasoning process, it is judged whether the input data meets the internal pipeline operation through the threshold value measured in step S2; Step S5, each MPC server sends the result of the machine learning model reasoning to the MPC client for data merging to obtain the final reasoning result.

2. The GPU-based multi-party machine learning secure inference pipeline method of claim 1, wherein: The specific operation of step S1 is as follows: input running data to the machine learning model, calculate the predicted value through forward propagation of the linear layer, calculate the loss function of the machine learning model, and calculate the gradient through back propagation to update the machine learning model, and the MPC pipeline captures the dimension of the input data and the weight of each linear layer.

3. The GPU-based multi-party machine learning secure inference pipeline method of claim 1, wherein: The specific operation of step S2 is as follows: using different input dimensions in the nonlinear level of the machine learning model, taking the maximum input dimension and the minimum input dimension as the threshold value, and judging whether the input data meets the condition of internal pipeline operation through the threshold value.

4. The GPU-based multi-party machine learning secure inference pipeline method of claim 1, wherein: The specific operation of step S3 is as follows: the MPC client divides the data to be calculated and the total machine learning model weight parameter into several shares, and each share is sent to the MPC server in the form of secret sharing.

5. The GPU-based multi-party machine learning secure inference pipeline method of claim 1, wherein: The machine learning model reasoning in step S4 is divided into linear task reasoning and nonlinear task reasoning, the linear task reasoning broadcasts the next layer and other MPC servers while calculating the result of each layer, and the nonlinear task reasoning uses the optimized linear calculation method in the secure multi-party computation protocol to replace the original nonlinear calculation, and the nonlinear task reasoning process takes the final result of the linear task reasoning as the input data.

6. The GPU-based multi-party machine learning secure inference pipeline method of claim 5, wherein: The specific process of the linear task reasoning is as follows: Step S411, each MPC server takes the secret shared data obtained in step S3 as the input data of the linear layer; Step S412, each MPC server randomly generates triplets in each layer of the linear layer; Steps S4121, S4122, S4123 and S4124 are performed simultaneously in step S412; Step S4131, calculating the difference between the operation number in the input data of the linear layer and one triplet in the triplet of the layer, and broadcasting the difference value to other MPC servers; Step S4132, the linear layer receives the difference value broadcasted by other MPC servers in the same layer; Step S4133, calculating the product of the input data and the weight of the linear layer through the triplets of the linear layer; Step S4134, subtract one tuple in the triplets of the next layer from the weight of the next layer, and broadcast the difference to the next layer; Step S414, if the linear layer is the last layer, output the final result; otherwise, repeat steps S412 and S413 until the linear layer is the last layer.

7. The GPU-based multi-party machine learning secure inference pipeline method of claim 5, wherein: The specific process of the non-linear task reasoning is as follows: Step S421, perform non-linear mapping on the result of the linear layer by using an activation function; Step S422, replace the non-linear calculation formula with a linear calculation; Step S423, determine whether the input data meets the condition for internal pipeline operation, if the result of the determination is that the condition is met, execute step S424; otherwise, execute step S425; Step S424, perform binary conversion on the final result of the linear layer, divide the converted result into several batches of data, share each batch of data to other MPC servers by using the password sharing technology, start transmitting the next batch of data while calculating each batch of data, and transmit the result of each non-linear layer to the next layer for repeated operation until the last layer outputs the final result; Step S425, perform matrix multiplication operation on each layer according to the respective weight and input data, and output the result of the last layer.

8. A GPU-based multi-party machine learning secure inference pipeline system, comprising: The memory stores executable code, and the one or more processors execute the executable code to implement the GPU-based multi-party machine learning secure inference pipeline method of any one of claims 1-7.

9. A computer-readable storage medium, characterized in that: A program is stored thereon, and the program is executed by a processor to implement the GPU-based multi-party machine learning secure inference pipeline method of any one of claims 1-7.

Images