A multi-party model training method, system and apparatus

Abstract

The embodiment of the specification provides a multi-party participated model training method, system and device, the method comprises: a first party inputs a plurality of first features into a first feature extraction network, homomorphically encrypts an output result to obtain a plurality of first encrypted vectors and sends the plurality of first encrypted vectors to a second party; the second party inputs a plurality of second features into a second feature extraction network, homomorphically encrypts an output result to obtain a plurality of second encrypted vectors; the second party homomorphically calculates the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors and sends the plurality of fusion encrypted vectors to the first party after being disordered, and records a first correspondence before and after disordering; the first party decrypts the plurality of fusion encrypted vectors and inputs the plurality of fusion encrypted vectors into a first part of a classification network to obtain a plurality of latent vectors; the first party uses the plurality of latent vectors and a classification label, and the second party uses network parameters of a second part of the classification network and the first correspondence to perform multi-party secure calculation and determine a first loss; the first party and the second party update the classification network according to the first loss.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of machine learning and privacy protection, and in particular, to a multi-party participated model training method, system and device. BACKGROUND

[0002] At present, with the development of artificial intelligence technology, machine learning neural networks have been gradually applied to many fields. For example, risk assessment, speech recognition, image recognition and natural language processing. In different application scenarios, more training data is often needed to achieve better model performance. In different fields, different enterprises or institutions have different data samples. If these data are jointly trained, the model performance will be greatly improved and significant economic benefits will be brought. However, the original training data of each party contains a large amount of user privacy and data value, and the leakage of these data will lead to the leakage of user privacy or data value. Therefore, in model training, the user privacy and data value of the training data of each party also need to be protected. Some enterprises or institutions use a split learning scheme to protect the user privacy and data value of the training data of different training parties.

[0003] The split learning scheme is a vertical data partitioning joint training scheme. In the split learning scheme, for example, different training members can each have a feature extraction network, and a label training member (a training member with a training sample classification label) can also have a classification network. In the training process, each training member can extract a feature vector of local private data using a local feature extraction network, and transmit the feature vector to the label training member. The label training member fuses the feature vectors sent by each training member, determines a classification loss using the obtained fused vector, the sample classification label and the classification network. Then, the local network of each training member is updated according to the determined classification loss. However, in some scenarios, this split learning scheme still has the problem of data value loss of the original user privacy data.

[0004] Therefore, in order to better protect the data value of the user privacy data of the training data, a new model training method is needed. SUMMARY

[0005] The embodiments in the present specification aim to provide a multi-party participated model training method, system and device. Through the method, the data value of the feature data of each training party cannot be used by the other party outside the agreed training task, i.e. to prevent the value loss of the data of each training party participating in the training.

[0006] According to a first aspect, a multi-party participated model training method is provided, comprising:

[0007] The first party inputs a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and homomorphically encrypts an output result by a first public key to obtain a plurality of first encrypted vectors, which are sent to a second party;

[0008] The second party inputs a plurality of second features corresponding to the plurality of business objects into a second feature extraction network, and homomorphically encrypts an output result according to the first public key to obtain a plurality of second encrypted vectors;

[0009] The second party homomorphically calculates the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, sends the plurality of fusion encrypted vectors to the first party after reordering, and records a first correspondence relationship before and after reordering;

[0010] The first party decrypts the plurality of fusion encrypted vectors after reordering according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, inputs the plurality of fusion vectors into a first part of a classification network to obtain a plurality of latent vectors;

[0011] The first party determines a first loss by using the plurality of latent vectors, classification labels of the plurality of business objects, and the second party determines the first loss by using network parameters of a second part of the classification network and the first correspondence relationship, and the two parties perform multi-party secure computation (MPC) to determine the first loss.

[0012] The first party and the second party update the first part and the second part of the classification network according to the first loss.

[0013] In a possible implementation, the method further includes:

[0014] After updating the first part of the classification network, the first party determines a first gradient matrix for the plurality of fusion vectors, and sends the first gradient matrix to the second party.

[0015] The second party determines a second gradient matrix according to the first gradient matrix and the first correspondence relationship, and updates the second feature extraction network according to the second gradient matrix.

[0016] In a possible implementation, the method further includes:

[0017] The first party determines a second loss according to the plurality of first features, the first feature network, the updated first part of the classification network, and a third part of the classification network corresponding to the second part, and updates the first feature network according to the second loss.

[0018] In a possible implementation, the method further includes:

[0019] The first party and the second party pre-determine that the first party and the second party both have the plurality of business objects.

[0020] In a possible implementation, the output result is homomorphically encrypted by the first public key, including:

[0021] After normalizing the output result, the high-order decimal part of a predetermined number of bits is intercepted, and the intercepted part is homomorphically encrypted by the first public key.

[0022] In a possible implementation, the second part of the classification network is an output layer of the classification network, and the first part of the classification network is other layers of the classification network except the output layer.

[0023] According to a second aspect, a multi-party participated model training method is provided, the method is performed by a first party in the multi-party, and the method includes:

[0024] The plurality of first features corresponding to the plurality of business objects are input into a first feature extraction network, and the output result is homomorphically encrypted by a first public key to obtain a plurality of first encrypted vectors, which are sent to a second party.

[0025] The plurality of fusion encrypted vectors reordered by the second party are received, the plurality of fusion encrypted vectors are obtained by the second party through the following steps: the plurality of second features corresponding to the plurality of business objects are input into a second feature extraction network, and the output result is homomorphically encrypted according to the first public key to obtain a plurality of second encrypted vectors; the plurality of first encrypted vectors and the plurality of second encrypted vectors are homomorphically calculated to obtain a plurality of fusion encrypted vectors, the plurality of fusion encrypted vectors are reordered, and a first correspondence relationship before and after reordering is recorded;

[0026] The plurality of fusion encrypted vectors reordered are decrypted according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and the plurality of fusion vectors are input into a first part of a classification network to obtain a plurality of hidden vectors.

[0027] The first loss is determined by performing multi-party secure computation (MPC) with the second party using the plurality of hidden vectors, classification labels of the plurality of business objects, and the first correspondence relationship in the multi-party secure computation, wherein the second party uses network parameters of a second part of the classification network.

[0028] The first part and the second part of the classification network are updated according to the first loss by the first party and the second party.

[0029] In a possible implementation, the method further includes:

[0030] After updating the first part of the classification network, a first gradient matrix for the plurality of fusion vectors is determined, and the first gradient matrix is sent to the second party for the second party to update the second feature extraction network according to the first gradient matrix.

[0031] In a possible implementation, the method further includes:

[0032] According to the plurality of first features, a second loss is determined based on the first feature network, the updated first part of the classification network, and a third part of the classification network corresponding to the second part, and the first feature network is updated according to the second loss.

[0033] According to a third aspect, a multi-party participated model training method is provided, the method is performed by a first party in the multi-party, and the method includes:

[0034] Receiving a plurality of first encrypted vectors sent by the first party, the plurality of first encrypted vectors are obtained by the first party by inputting a plurality of first features corresponding to a plurality of business objects into a first feature extraction network and homomorphically encrypting an output result by using a first public key to obtain the plurality of first encrypted vectors;

[0035] Inputting a plurality of second features corresponding to the plurality of business objects into a second feature extraction network and homomorphically encrypting an output result by using the first public key to obtain a plurality of second encrypted vectors;

[0036] Homomorphically calculating the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, sending the plurality of fusion encrypted vectors to the first party after shuffling, and recording a first correspondence relationship before and after shuffling;

[0037] Using network parameters of a second part of the classification network and the first correspondence relationship, performing multi-party secure computation (MPC) with the first party to determine a first loss, in the multi-party secure computation, the first party uses a plurality of hidden vectors and classification labels of the plurality of business objects, wherein the plurality of hidden vectors are obtained by the first party by decrypting the plurality of fusion encrypted vectors after shuffling by using a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and inputting the plurality of fusion vectors into a first part of the classification network to obtain the plurality of hidden vectors;

[0038] With the first party, updating the first part and the second part of the classification network according to the first loss.

[0039] In a possible implementation, the method further includes:

[0040] receive a first gradient matrix for the plurality of fusion vectors determined by the first party after updating the first part of the classification network;

[0041] determine a second gradient matrix according to the first gradient matrix and the first correspondence relationship; and update the second feature extraction network according to the second gradient matrix.

[0042] According to a fourth aspect, a multi-party participated model training system is provided, comprising a first party and a second party, wherein:

[0043] The first party is configured to input a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and perform homomorphic encryption on an output result through a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to the second party.

[0044] The second party is configured to input a plurality of second features corresponding to the plurality of business objects into a second feature extraction network, and perform homomorphic encryption on an output result according to the first public key to obtain a plurality of second encrypted vectors.

[0045] The second party is further configured to perform homomorphic calculation on the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, send the plurality of fusion encrypted vectors to the first party after reordering, and record a first correspondence relationship before and after reordering.

[0046] The first party is further configured to decrypt the plurality of fusion encrypted vectors after reordering according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and input the plurality of fusion vectors into a first part of a classification network to obtain a plurality of latent vectors.

[0047] The first party and the second party are further configured to perform multi-party secure computation (MPC) by the first party using the plurality of latent vectors, classification labels of the plurality of business objects, the second party using network parameters of a second part of the classification network, and the first correspondence relationship to determine a first loss.

[0048] The first party and the second party are further configured to update the first part and the second part of the classification network according to the first loss.

[0049] According to a fifth aspect, a multi-party participated model training apparatus is provided, deployed in a first party of a plurality of parties, and the apparatus comprises:

[0050] The sending unit is configured to input a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and perform homomorphic encryption on an output result through a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to a second party.

[0051] The receiving unit is configured to receive the multiple fusion encryption vectors sent by the second party in disorder, wherein the multiple fusion encryption vectors are obtained by the second party through the following steps: inputting multiple second features corresponding to the multiple service objects into a second feature extraction network, and homomorphically encrypting an output result according to the first public key to obtain multiple second encryption vectors; performing homomorphic calculation on the multiple first encryption vectors and the multiple second encryption vectors to obtain multiple fusion encryption vectors; and performing disordering on the multiple fusion encryption vectors, and recording a first correspondence relationship before and after disordering;

[0052] The first processing unit is configured to decrypt the multiple fusion encryption vectors in disorder according to a first private key corresponding to the first public key, to obtain multiple fusion vectors, and input the multiple fusion vectors into a first part of a classification network to obtain multiple latent vectors.

[0053] The second processing unit is configured to perform multi-party secure computation (MPC) with the second party by using the multiple latent vectors, classification labels of the multiple service objects, and the first correspondence relationship, to determine a first loss.

[0054] The updating unit is configured to update the first part and the second part of the classification network according to the first loss, with the second party.

[0055] According to a sixth aspect, a multi-party participated model training apparatus is provided, which is deployed at a second party in multiple parties, and includes:

[0056] The receiving unit is configured to receive the multiple first encryption vectors sent by the first party, wherein the multiple first encryption vectors are obtained by the first party through the following steps: inputting multiple first features corresponding to multiple service objects into a first feature extraction network, and homomorphically encrypting an output result according to a first public key to obtain multiple first encryption vectors.

[0057] The first processing unit is configured to input multiple second features corresponding to the multiple service objects into a second feature extraction network, and homomorphically encrypt an output result according to the first public key to obtain multiple second encryption vectors.

[0058] The sending unit is configured to perform homomorphic calculation on the multiple first encryption vectors and the multiple second encryption vectors to obtain multiple fusion encryption vectors, send the multiple fusion encryption vectors to the first party after disordering, and record a first correspondence relationship before and after disordering.

[0059] The second processing unit is configured to perform multi-party secure computation (MPC) with the first party to determine a first loss by using network parameters of the second part of the classification network and the first correspondence, wherein the first party uses a plurality of hidden vectors and classification labels of the plurality of business objects in the multi-party secure computation, and the plurality of hidden vectors are obtained by the first party by the following steps: decrypting a plurality of fusion vectors in random order by using a first private key corresponding to a first public key to obtain a plurality of fusion vectors, inputting the plurality of fusion vectors into the first part of the classification network to obtain the plurality of hidden vectors.

[0060] The updating unit is configured to update the first part and the second part of the classification network according to the first loss with the first party.

[0061] According to a seventh aspect, a computer readable storage medium is provided, which stores a computer program, and when the computer program is executed in a computer, the computer program causes the computer to perform the method according to the first aspect, the second aspect, and the third aspect.

[0062] According to an eighth aspect, a computing device is provided, which includes a memory and a processor, the memory stores executable code, and when the processor executes the executable code, the method according to the first aspect, the second aspect, and the third aspect is implemented.

[0063] By using one or more of the methods, devices, computing devices, and storage media in the above aspects, the data value of the feature data of each training party can not be used by the other party outside the agreed training task, that is, the value of the data of each training party participating in training is prevented from being lost. BRIEF DESCRIPTION OF DRAWINGS

[0064] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative effort based on these drawings.

[0065] Figure 1 A network structure diagram of a multi-party participated model training method according to an embodiment of the present specification is shown;

[0066] Figure 2 A schematic diagram of a multi-party participated model training method according to an embodiment of the present specification is shown;

[0067] Figure 3 A flowchart of a multi-party participated model training method according to an embodiment of the present specification is shown;

[0068] Figure 4A flow chart of a multi-party participated model training method according to another embodiment of the present specification is shown.

[0069] Figure 5 A structural diagram of a multi-party participated model training system according to an embodiment of the present specification is shown.

[0070] Figure 6 A structural diagram of a multi-party participated model training device according to an embodiment of the present specification is shown.

[0071] Figure 7 A structural diagram of a multi-party participated model training device according to another embodiment of the present specification is shown. DETAILED DESCRIPTION

[0072] The scheme provided in the present specification will be described below with reference to the accompanying drawings.

[0073] As described above, in order to protect the user privacy and data value of the training data of different training parties, some enterprises or institutions use a split learning scheme to train a neural network model. In the split learning scheme, for example, different training members can each have a feature extraction network, and a label training member (a training member that has a sample classification label) can also have a classification network. In the training process, each training member can extract a feature vector of local private data using the local feature extraction network, and transmit the feature vector to the label training member. The label training member fuses the feature vectors sent by each training member, determines a classification loss using the obtained fused vector, the sample classification label and the classification network. Then, the local network of each training member is updated according to the determined classification loss. However, in some scenarios, the split learning scheme still has the problem that the user privacy or data value of the original training data is leaked. For example, in split learning training for a specific task, the label training member that has the sample classification label can store the feature vector of the private data extracted by the ordinary training member locally, for training of other tasks, thereby causing loss of the data value of the private data of the ordinary training member.

[0074] In order to solve the above technical problem, the present specification provides a multi-party participated model training method. The core idea is that a plurality of training parties participating in the training include a label training party and a confusion training party. Among them, for example, Figure 1As shown, the label training party (e.g., the first party) and the obfuscation training party (e.g., the first party) can each have their own feature extraction networks. They can also have different parts of the same classification network (e.g., the first part and the second part). First, the label training party and the obfuscation training party can each extract feature vectors from their local privacy data using their local feature extraction networks and homomorphically encrypt them. The obfuscation training party then fuses the encrypted feature vectors from each party and scrambles them to obtain a fused encrypted vector set, recording the correspondence between the fused encrypted vectors before and after scrambling. Next, the obfuscation training party can send the fused encrypted vector set to the label training party. The label training party decrypts the received fused encrypted vectors to obtain the fused vector set and, based on the first part of the classification network and the fused vector set, obtains a latent vector set. Subsequently, the label training party can perform multi-party secure computation based on the latent vector set and classification labels, while the obfuscation training party can perform multi-party secure computation based on the parameters of the second part of the classification network and the correspondence between the fused encrypted vectors before and after scrambling, to obtain the classification loss. The different parts of the classification network are then updated based on the classification loss. The above method prevents the label training team from unilaterally aligning the scrambled fusion vector obtained during the training of the classification model with its original feature data or classification labels. In other words, the label training team cannot use its scrambled fusion vector for retraining in other training tasks. Similarly, the obfuscation training team, obtaining encrypted feature vectors from the label training team in a closed state, also cannot unilaterally use them for retraining in other training tasks. In other words, this method ensures that the data value of the original feature data from both the label and obfuscation training teams is not used by the other team outside of the current training task, thus preventing data loss outside of the current training task.

[0075] Figure 2 This diagram illustrates a multi-party model training method according to an embodiment of this specification. Figure 2 As shown, the multiple participating parties may include a first party and a second party. First, the first party can input multiple first features corresponding to multiple business objects into its own first feature extraction network, and use its own first public key to homomorphically encrypt the output of the first feature extraction network to obtain multiple first encryption vectors, and then send them to the second party.

[0076] In different embodiments, the plurality of business objects can be business objects for different specific business purposes, and the specification does not limit the same. In one embodiment, the first party and the second party can determine in advance a plurality of business objects that both the first party and the second party have. In different specific embodiments, the specific manner in which the first party and the second party determine in advance the plurality of business objects that both the first party and the second party have can be different. In one specific embodiment, the first party and the second party can determine the plurality of business objects that both the first party and the second party have, for example, through a private set intersection (PSI) algorithm. In different specific embodiments, the private set intersection algorithm used can be different.

[0077] The plurality of first features can be feature data of the plurality of business objects owned by the first party. In different embodiments, the first feature can be different specific types of feature data, and the specification does not limit the same.

[0078] In different embodiments, the output result can also be processed before homomorphic encryption. Specifically, in one embodiment, the output result can be normalized and the high-order decimal part of a predetermined number of bits can be truncated, and the truncated part can be homomorphically encrypted by the first public key.

[0079] As shown in the example of Figure 2 The first party can input, for example, the first features corresponding to the plurality of business objects, such as features a1, a2, and a3, into the feature extraction network 1 of the first party, homomorphically encrypt the output result to obtain a plurality of first encrypted vectors, such as encrypted vectors c1, c2, and c3, and send them to the second party.

[0080] The second party can input, for example, the plurality of second features corresponding to the plurality of business objects into the second feature extraction network, homomorphically encrypt the output result of the second feature extraction network according to the first public key to obtain a plurality of second encrypted vectors. Then, the plurality of first encrypted vectors received and the plurality of second encrypted vectors are homomorphically calculated to obtain a plurality of fusion encrypted vectors, the plurality of fusion encrypted vectors are reordered and sent to the first party, and the first correspondence relationship before and after the reordering is recorded.

[0081] In different embodiments, the second party can obtain the first public key of the first party in different ways. In one embodiment, the first party can send the first public key to the second party in advance. In another embodiment, the first party can send the first public key and the plurality of first encrypted vectors to the second party.

[0082] The plurality of second features can be feature data of the plurality of business objects owned by the second party. Similar to the first feature, in different embodiments, the second feature can be different specific types of feature data, and the specification does not limit the same.

[0083] In different embodiments, the first correspondence F before and after the shuffling can be different specific relationships. For example, in an embodiment, it can be the correspondence between the identifiers of each fused encryption vector in the plurality of fused encryption vectors before the shuffling and the sequence numbers of each fused encryption vector in the plurality of fused encryption vectors after the shuffling.

[0084] As shown in the example, Figure 1 The second party can input, for example, the second features corresponding to the plurality of service objects, such as features b1, b2, and b3, into the feature extraction network 2 of the first party, and obtain a plurality of second encrypted vectors, such as encrypted vectors d1, d2, and d3, by homomorphic encryption of the output results by the public key of the first party, and send them to the second party. Then, homomorphic calculation is performed on the received encrypted vectors c1, c2, c3 and the encrypted vectors d1, d2, and d3 to obtain a plurality of fused encryption vectors, such as fused encryption vectors e1, e2, and e3, which are sent to the first party after being shuffled (for example, shuffled to e3, e1, and e2) and the first correspondence F.

[0085] Next, the first party can decrypt the plurality of fused encryption vectors after the shuffling according to the first private key (corresponding to the first public key) of the first party to obtain a plurality of fused vectors, which are input into the first part of the classification network to obtain a plurality of latent vectors.

[0086] In different embodiments, the specific structure of the classification network can be different, and the specific division method of the first part and the second part of the classification network can also be different. In an embodiment, the classification network can include a plurality of neural network layers, the second part of the classification network can be an output layer in the plurality of neural network layers, and the first part of the classification network can be other layers in the plurality of neural network layers except the output layer.

[0087] As shown in the example, Figure 2 The first party can receive, for example, the plurality of fused encryption vectors after the shuffling (such as e3, e1, and e2) and decrypt them to obtain a plurality of fused vectors, such as fused vectors h3, h1, and h2. And input h3, h1, and h2 into the first part of the classification network to obtain a plurality of latent vectors, such as i3, i1, and i2.

[0088] Thereafter, the first party can use the plurality of latent vectors, the classification labels Y (such as y1, y2, and y3) of the plurality of service objects, the network parameters of the second part of the classification network (located at the second party), and the first correspondence to perform multi-party secure computation MPC with the second party to determine the first loss. Furthermore, the first party and the second party can update the first part and the second part of the classification network according to the first loss.

[0089] Secure Multi-Party Computation (MPC) is a cryptographic-based computing method, which is used for multiple mutually distrustful participants to perform collaborative computation while protecting data privacy. In different embodiments, the first party and the second party can determine the first loss based on different specific types of multi-party secure computation algorithms, which are not limited in the present specification. Through multi-party secure computation, the first party and the second party cannot obtain the data of the other party participating in the computation during the computation process. For example, the first party cannot obtain the network parameters of the second part of the classification network (located in the second party) and the original value of the first correspondence relationship, and the first party cannot obtain the plurality of latent vectors and the original value of the classification label Y of the plurality of business objects. In this way, the classification loss can be calculated only through the collaborative computation of the two parties, which is used for training the classification network, and in the collaborative computation, the data of the two parties participating in the computation will not be leaked to the other party. Further, based on the data obtained during the computation process, neither party can calculate the original data (such as the classification label) of the other party and the correct ordering feature set (such as the correct ordering fusion feature set) containing the value of the data of the other party.

[0090] As shown in the example of Figure 2 , the first party can use the plurality of latent vectors i3, i1, i2, the classification label Y of the plurality of business objects (for example, including y1, y2, y3), and the second party can use the network parameters of the second part of the classification network and the first correspondence relationship F to perform multi-party secure computation MPC to determine the first loss. In different specific embodiments, the first loss can also be determined according to different specific types of loss functions, which are not limited in the present specification. In one embodiment, the cross-entropy loss function can be used for determination, for example.

[0091] In different specific embodiments, the first party and the second party can update the specific manners of the first part and the second part according to the first loss. In one embodiment, the first party can update the first part according to the first loss, and determine the gradient for the second part to be sent to the second party for updating the second part.

[0092] In addition to updating the classification network, the local feature extraction network of each participant can also be updated. Specifically, in one embodiment, after updating the first part of the classification network, the first party can determine a first gradient matrix for the plurality of fusion vectors and send the first gradient matrix to the second party. The second party can determine a second gradient matrix according to the first gradient matrix and the first correspondence, and then update the second feature extraction network according to the second gradient matrix. In this embodiment, the second party can determine the second gradient matrix of the plaintext of the correctly ordered fusion vectors according to the first gradient matrix of the plaintext of the substantially corresponding disordered fusion vectors and the first correspondence. Therefore, the second party can update the second feature extraction network according to the second gradient matrix.

[0093] Unlike updating the second feature extraction network, if the second party sends the second gradient matrix to the first party for updating the first feature extraction network, the first party can determine the correctly ordered fusion vector set by using the disordered fusion vector set of the first party and the first gradient matrix. If the first party retains the correctly ordered fusion vector set, it can be used for subsequent classification tasks, for example, in a case where the first party is not known, and since the fusion vector essentially contains the value of the second party's feature data, this will cause the loss of the value of the second party's data. To solve this problem, in one embodiment, after updating the first part of the classification network, the first party can also determine a second loss based on the first feature network, the updated first part of the classification network, and the third part of the classification network corresponding to the second part according to the plurality of first features, and update the first feature network according to the second loss. In a specific embodiment, in order to improve computational efficiency, the plurality of first features can not be input into the first feature network, but the input result obtained by inputting the plurality of first features into the first feature network in the past, and the updated first part of the classification network and the third part of the classification network corresponding to the second part can be used to determine the second loss, and the first feature network can be updated according to the second loss. Through the above method, the first party only uses the updated first part of the classification network, the third part (corresponding to the second part) of the classification network independently constructed by the first party, and the data features of the first party to independently update the feature extraction network of the first party, which will not cause the loss of the value of the second party's data.

[0094] Figure 3 A flowchart of a multi-party participated model training method according to an embodiment of the present specification is shown. The method is performed by a first party in the multiple parties, as shown in Figure 3 The method at least includes the following steps:

[0095] Step S301, input a plurality of first features corresponding to a plurality of service objects into a first feature extraction network, and homomorphically encrypt an output result by a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to a second party.

[0096] Step S303, receive a plurality of fusion encrypted vectors sent by the second party in a disordered manner, wherein the plurality of fusion encrypted vectors are obtained by the second party through the following steps: input a plurality of second features corresponding to the plurality of service objects into a second feature extraction network, and homomorphically encrypt an output result by the first public key to obtain a plurality of second encrypted vectors; homomorphically calculate the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, disorder the plurality of fusion encrypted vectors, and record a first correspondence relationship before and after disordering.

[0097] Step S305, decrypt the plurality of fusion encrypted vectors in a disordered manner according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and input the plurality of fusion vectors into a first part of a classification network to obtain a plurality of latent vectors.

[0098] Step S307, perform multi-party secure computation (MPC) with the second party using the plurality of latent vectors, classification labels of the plurality of service objects, and the first correspondence relationship to determine a first loss, wherein in the multi-party secure computation, the second party uses network parameters of a second part of the classification network.

[0099] Step S309, update the first part and the second part of the classification network according to the first loss with the second party.

[0100] Figure 4 A flowchart of a multi-party participated model training method according to another embodiment of the present specification is shown. The method is performed by a second party in a plurality of parties, as shown in Figure 4 The method includes at least the following steps:

[0101] Step S401, receive a plurality of first encrypted vectors sent by a first party, wherein the plurality of first encrypted vectors are obtained by the first party through the following steps: input a plurality of first features corresponding to a plurality of service objects into a first feature extraction network, and homomorphically encrypt an output result by a first public key to obtain a plurality of first encrypted vectors.

[0102] Step S403, input a plurality of second features corresponding to the plurality of service objects into a second feature extraction network, and homomorphically encrypt an output result by the first public key to obtain a plurality of second encrypted vectors.

[0103] Step S405, homomorphic calculation is performed on the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, the plurality of fusion encrypted vectors are sent to the first party after being reordered, and a first correspondence relationship before and after reordering is recorded.

[0104] Step S407, a first loss is determined by performing multi-party secure calculation (MPC) with the first party using network parameters of the second part of the classification network and the first correspondence relationship, in which the first party uses a plurality of hidden vectors and classification labels of the plurality of business objects, wherein the plurality of hidden vectors are obtained by the first party by the following steps: the plurality of fusion encrypted vectors after reordering are decrypted using a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and the plurality of fusion vectors are input into the first part of the classification network to obtain the plurality of hidden vectors.

[0105] Step S409, the first part and the second part of the classification network are updated according to the first loss with the first party.

[0106] According to another aspect, an embodiment of a multi-party participated model training system is also provided. Figure 5 A structural diagram of a multi-party participated model training system according to an embodiment of the present specification is shown as follows: Figure 5 As shown, the system includes a first party 510 and a second party 520, wherein:

[0107] The first party 510 is configured to input a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and perform homomorphic encryption on an output result through a first public key to obtain a plurality of first encrypted vectors, which are sent to the second party;

[0108] The second party 520 is configured to input a plurality of second features corresponding to the plurality of business objects into a second feature extraction network, and perform homomorphic encryption on an output result according to the first public key to obtain a plurality of second encrypted vectors;

[0109] The second party 520 is further configured to perform homomorphic calculation on the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, and send the plurality of fusion encrypted vectors to the first party after reordering, and record a first correspondence relationship before and after reordering;

[0110] The first party 510 is further configured to decrypt the plurality of fusion encrypted vectors after reordering using a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and input the plurality of fusion vectors into the first part of the classification network to obtain a plurality of hidden vectors;

[0111] The first party 510 is further configured to perform multi-party secure computation (MPC) with the second party by using the plurality of hidden vectors, the classification labels of the plurality of service objects, the network parameters of the second part of the classification network, and the first correspondence relationship, to determine a first loss.

[0112] The first party 510 and the second party 520 are further configured to update the first part and the second part of the classification network according to the first loss.

[0113] According to another aspect, an embodiment of a multi-party participated model training apparatus is also provided. Figure 6 A structural diagram of a multi-party participated model training apparatus according to an embodiment of the present specification is shown in FIG. 1. Figure 6 As shown in FIG. 1, the apparatus is deployed at a first party among multiple parties, and the apparatus comprises:

[0114] The sending unit 511 is configured to input a plurality of first features corresponding to a plurality of service objects into a first feature extraction network, and perform homomorphic encryption on an output result by using a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to a second party.

[0115] The receiving unit 512 is configured to receive a plurality of fusion encrypted vectors sent by the second party after being reordered, wherein the plurality of fusion encrypted vectors are obtained by the second party by inputting a plurality of second features corresponding to the plurality of service objects into a second feature extraction network, and performing homomorphic encryption on an output result by using the first public key to obtain a plurality of second encrypted vectors; performing homomorphic calculation on the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain the plurality of fusion encrypted vectors; reordering the plurality of fusion encrypted vectors, and recording a first correspondence relationship before and after reordering.

[0116] The first processing unit 513 is configured to decrypt the plurality of fusion encrypted vectors after being reordered by using a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and input the plurality of fusion vectors into a first part of a classification network to obtain a plurality of hidden vectors.

[0117] The second processing unit 514 is configured to perform multi-party secure computation (MPC) with the second party to determine a first loss, wherein the first party uses the plurality of hidden vectors, classification labels of the plurality of service objects, the second party uses network parameters of a second part of the classification network, and the first correspondence relationship.

[0118] The updating unit 515 is configured to update, with the first party, the first part and the second part of the classification network according to the first loss.

[0119] Figure 6A structural diagram of a multi-party participated model training apparatus is shown according to an embodiment of the present specification, as shown in Figure 6 The apparatus is deployed in a second party among the multi parties, and the apparatus comprises:

[0120] The receiving unit 521 is configured to receive a plurality of first encryption vectors sent by the first party, wherein the plurality of first encryption vectors are obtained by the first party through the following steps: inputting a plurality of first features corresponding to a plurality of service objects into a first feature extraction network, and homomorphically encrypting an output result by using a first public key to obtain the plurality of first encryption vectors;

[0121] The first processing unit 522 is configured to input a plurality of second features corresponding to the plurality of service objects into a second feature extraction network, and homomorphically encrypt an output result according to the first public key to obtain a plurality of second encryption vectors;

[0122] The sending unit 523 is configured to perform homomorphic calculation on the plurality of first encryption vectors and the plurality of second encryption vectors to obtain a plurality of fusion encryption vectors, send the plurality of fusion encryption vectors to the first party after reordering, and record a first correspondence relationship before and after reordering;

[0123] The second processing unit 524 is configured to perform multi-party secure computation (MPC) with the second party to determine a first loss, wherein the first party uses a plurality of hidden vectors, classification labels of the plurality of service objects, the second party uses network parameters of a second part of the classification network, and the first correspondence relationship; wherein the plurality of hidden vectors are obtained by the first party through the following steps: decrypting the plurality of reordered fusion encryption vectors by using a first private key corresponding to the first public key to obtain a plurality of fusion vectors, inputting the plurality of fusion vectors into a first part of the classification network to obtain the plurality of hidden vectors;

[0124] The updating unit 525 is configured to update the first part and the second part of the classification network according to the first loss with the second party.

[0125] In yet another aspect, the present specification provides a computer readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer program causes the computer to execute any of the above methods.

[0126] In still another aspect, the present specification provides a computing device comprising a memory and a processor, the memory having executable code stored therein, and the processor implementing any of the above methods when executing the executable code.

[0127] It should be understood that the terms "first", "second", and the like used herein are merely for the purpose of distinguishing similar concepts for the sake of simplicity of description, and do not have other limiting effects.

[0128] Those skilled in the art should understand that, in one or more examples described above, the functions described in the present application can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0129] The above detailed description sets forth the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above detailed description is only a specific implementation of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A multi-party participated model training method, comprising: a first party inputs a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and homomorphically encrypts an output result by a first public key to obtain a plurality of first encrypted vectors, and sends the plurality of first encrypted vectors to a second party; the second party inputs a plurality of second features corresponding to the plurality of business objects into a second feature extraction network, and homomorphically encrypts an output result according to the first public key to obtain a plurality of second encrypted vectors; the second party homomorphically calculates the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, sends the plurality of fusion encrypted vectors to the first party after shuffling, and records a first correspondence relationship before and after shuffling; the first party decrypts the plurality of fusion encrypted vectors after shuffling according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, inputs the plurality of fusion vectors into a first part of a classification network to obtain a plurality of latent vectors; the first party determines a first loss by using the plurality of latent vectors, classification labels of the plurality of business objects, network parameters of a second part of the classification network, and the first correspondence relationship through multi-party secure computation (MPC) with the second party; the first party and the second party update the first part and the second part of the classification network according to the first loss.

2. The method of claim 1, further comprising: after updating the first part of the classification network, the first party determines a first gradient matrix for the plurality of fusion vectors, and sends the first gradient matrix to the second party; the second party determines a second gradient matrix according to the first gradient matrix and the first correspondence relationship, and updates the second feature extraction network according to the second gradient matrix.

3. The method of claim 1, further comprising: the first party determines a second loss according to the plurality of first features, the first feature network, the updated first part of the classification network, and a third part of the classification network corresponding to the second part, and updates the first feature network according to the second loss.

4. The method of claim 1, further comprising: the first party and the second party pre-determine the plurality of business objects that both the first party and the second party have.

5. The method of claim 1, wherein, homomorphically encrypting the output result by the first public key comprises: normalizing the output result, and then taking a predetermined number of high-order decimals, and homomorphically encrypting the taken part by the first public key.

6. The method of claim 1, wherein, The classification network comprises a plurality of neural network layers, the second part of the classification network is an output layer in the plurality of neural network layers, and the first part of the classification network is other layers than the output layer in the plurality of neural network layers.

7. A multi-party participated model training method, the method being performed by a first party in a plurality of parties, and the method comprising: inputting a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, and homomorphically encrypting an output result by a first public key to obtain a plurality of first encrypted vectors, and sending the plurality of first encrypted vectors to a second party; receive a plurality of fusion encrypted vectors sent by the second party, the plurality of fusion encrypted vectors being obtained by the second party by inputting a plurality of second features corresponding to the plurality of business objects into a second feature extraction network and homomorphically encrypting an output result according to the first public key to obtain a plurality of second encrypted vectors; and homomorphically computing the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, and performing reordering on the plurality of fusion encrypted vectors and recording a first correspondence relationship before and after reordering; decrypt the plurality of fusion encrypted vectors according to a first private key corresponding to the first public key to obtain a plurality of fusion vectors, and input the plurality of fusion vectors into a first part of a classification network to obtain a plurality of latent vectors; perform multi-party secure computation (MPC) with the second party using the plurality of latent vectors, classification labels of the plurality of business objects, and the first correspondence relationship to determine a first loss, wherein in the multi-party secure computation, the second party uses network parameters of a second part of the classification network and the first correspondence relationship; update the first part and the second part of the classification network with the second party according to the first loss.

8. The method of claim 7, further comprising: after updating the first part of the classification network, determining a first gradient matrix for the plurality of fusion vectors, and sending the first gradient matrix to the second party for updating the second feature extraction network according to the first gradient matrix.

9. The method of claim 7, further comprising: determining a second loss according to the plurality of first features based on the first feature network, the updated first part of the classification network, and a third part of the classification network corresponding to the second part, and updating the first feature network according to the second loss.

10. A multi-party participated model training method, the method being performed by a second party in a plurality of parties, the method comprising: receiving a plurality of first encrypted vectors sent by a first party, the plurality of first encrypted vectors being obtained by the first party by inputting a plurality of first features corresponding to a plurality of business objects into a first feature extraction network and homomorphically encrypting an output result according to a first public key to obtain a plurality of first encrypted vectors; inputting a plurality of second features corresponding to the plurality of business objects into a second feature extraction network and homomorphically encrypting an output result according to the first public key to obtain a plurality of second encrypted vectors; homomorphically computing the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fusion encrypted vectors, and sending the plurality of fusion encrypted vectors to the first party after reordering and recording a first correspondence relationship before and after reordering; determine a first loss by performing multi-party computation (MPC) with the first party using network parameters of a second part of the classification network and the first correspondence, wherein the first party obtains a plurality of hidden vectors by decrypting the plurality of fused encrypted vectors according to a first private key corresponding to the first public key to obtain a plurality of fused vectors, inputs the plurality of fused vectors into a first part of the classification network to obtain the plurality of hidden vectors, and uses the plurality of hidden vectors and classification labels of the plurality of business objects; update the first part and the second part of the classification network according to the first loss with the first party.

11. The method of claim 10, further comprising: receiving a first gradient matrix determined by the first party for the plurality of fused vectors after updating the first part of the classification network; determining a second gradient matrix according to the first gradient matrix and the first correspondence; updating the second feature extraction network according to the second gradient matrix.

12. A multi-party model training system, comprising a first party and a second party, wherein: the first party is configured to input a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, homomorphically encrypt an output result by a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to the second party; the second party is configured to input a plurality of second features corresponding to the plurality of business objects into a second feature extraction network, and homomorphically encrypt an output result according to the first public key to obtain a plurality of second encrypted vectors; the second party is further configured to perform homomorphic computation on the plurality of first encrypted vectors and the plurality of second encrypted vectors to obtain a plurality of fused encrypted vectors, send the plurality of fused encrypted vectors after being reordered to the first party, and record a first correspondence before and after reordering; the first party is further configured to decrypt the plurality of fused encrypted vectors after being reordered according to a first private key corresponding to the first public key to obtain a plurality of fused vectors, input the plurality of fused vectors into a first part of a classification network to obtain a plurality of hidden vectors; the first party and the second party are further configured to determine a first loss by performing multi-party computation (MPC) with the first party using the plurality of hidden vectors, classification labels of the plurality of business objects, network parameters of a second part of the classification network, and the first correspondence; the first party and the second party are further configured to update the first part and the second part of the classification network according to the first loss.

13. A multi-party model training apparatus deployed in a first party of a plurality of parties, the apparatus comprising: a sending unit configured to input a plurality of first features corresponding to a plurality of business objects into a first feature extraction network, homomorphically encrypt an output result by a first public key to obtain a plurality of first encrypted vectors, and send the plurality of first encrypted vectors to a second party. The receiving unit is configured to receive the multiple fusion encryption vectors sent by the second party in disorder, wherein the multiple fusion encryption vectors are obtained by the second party through the following steps: inputting multiple second features corresponding to the multiple service objects into a second feature extraction network, and homomorphically encrypting an output result according to the first public key to obtain multiple second encryption vectors; performing homomorphic calculation on the multiple first encryption vectors and the multiple second encryption vectors to obtain multiple fusion encryption vectors; and performing disordering on the multiple fusion encryption vectors, and recording a first correspondence relationship before and after disordering; The first processing unit is configured to decrypt the multiple fusion encryption vectors in disorder according to a first private key corresponding to the first public key to obtain multiple fusion vectors, and input the multiple fusion vectors into a first part of a classification network to obtain multiple hidden vectors. The second processing unit is configured to determine a first loss by performing multi-party secure computation (MPC) with the second party by using the multiple hidden vectors, classification labels of the multiple service objects, and the first correspondence relationship. The updating unit is configured to update the first part and the second part of the classification network according to the first loss with the second party.

14. A multi-party participated model training apparatus deployed at a second party in multiple parties, the apparatus comprising: The receiving unit is configured to receive the multiple first encryption vectors sent by the first party, wherein the multiple first encryption vectors are obtained by the first party through the following steps: inputting multiple first features corresponding to multiple service objects into a first feature extraction network, and homomorphically encrypting an output result according to a first public key to obtain multiple first encryption vectors. The first processing unit is configured to input multiple second features corresponding to the multiple service objects into a second feature extraction network, and homomorphically encrypt an output result according to the first public key to obtain multiple second encryption vectors. The sending unit is configured to perform homomorphic calculation on the multiple first encryption vectors and the multiple second encryption vectors to obtain multiple fusion encryption vectors, send the multiple fusion encryption vectors to the first party in disorder, and record a first correspondence relationship before and after disordering. The second processing unit is configured to determine a first loss by performing multi-party secure computation (MPC) with the first party by using network parameters of a second part of the classification network and the first correspondence relationship, wherein the first party uses multiple hidden vectors and classification labels of the multiple service objects in the multi-party secure computation, and the multiple hidden vectors are obtained by the first party through the following steps: decrypting the multiple fusion encryption vectors in disorder according to a first private key corresponding to the first public key to obtain multiple fusion vectors, and inputting the multiple fusion vectors into a first part of a classification network to obtain the multiple hidden vectors. The updating unit is configured to update the first part and the second part of the classification network according to the first loss with the first party.

15. A computer readable storage medium having stored thereon a computer program, which, when executed in a computer, causes the computer to carry out the method of any one of claims 1-11.

16. A computing device comprising a memory having stored therein executable code and a processor, which, when executing the executable code, implements the method of any one of claims 1-11.

Images