A secret sharing-based convolutional neural network privacy prediction system and method

Abstract

The application discloses a kind of secret sharing-based convolutional neural network privacy prediction system and method, system includes cloud server S and query unit C;Cloud server S is used to store the convolution kernel K and weight matrix W of convolutional neural network, and in generating secret share M;Query unit C is used to store the prediction data x uploaded to cloud server, and in pre-processing stage, random number r and secret share N are generated;The application first generates secret share;Then the original input data x is extracted using the convolution layer to obtain the convolution calculation result V;Then the data of convolution layer calculation unit is nonlinearly mapped using activation layer, to obtain the ReLU activation function calculation result R;Using average pooling layer, the data R after activation layer calculation is compressed, to obtain the average pooling layer calculation result P;Finally, using fully connected layer, the two-dimensional feature map after convolution, activation and average pooling is converted into one-dimensional vector, and is mapped to prediction result.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a convolutional neural network privacy prediction system and method, specifically a high-efficiency convolutional neural network privacy prediction system and method based on secret sharing. Background Technology

[0002] Cloud-based convolutional neural network (CNN) prediction services are now used in many fields, such as pattern recognition, medical diagnosis, and natural language processing. In this scenario, the client uses a pre-trained network model on the server to predict the data it uploads. However, this prediction service involves serious privacy issues: the client's input data and prediction results are leaked to the server; the server's network model parameters are leaked to the client. Due to the need for both parties to protect their privacy data and the restrictions of relevant laws and regulations, such as the Cybersecurity Law of the People's Republic of China and the General Data Protection Regulation (GDPR) of the European Union, designing a practical and feasible privacy-preserving CNN prediction scheme is crucial. In a privacy-preserving prediction service, the server cannot obtain the client's input data and prediction results, nor will it leak network model parameter information to the client. However, existing technical solutions have the following two shortcomings: linear layer protocols require multiple rounds of communication and involve many encryption and decryption operations when calculating matrix multiplication; nonlinear layer protocols require the use of obfuscation circuits to calculate the ReLU activation function, resulting in the system bearing huge communication and computational overhead. Summary of the Invention

[0003] This invention addresses the shortcomings of existing technologies by providing a high-efficiency convolutional neural network privacy prediction system and system based on secret sharing. It avoids the problems of multiple rounds of communication and complex encryption and decryption operations required when calculating matrix multiplication, and also avoids the need to use obfuscated circuits to complete the ReLU activation function calculation, thus enabling efficient completion of convolutional neural network privacy prediction tasks.

[0004] The technical solution adopted by the system of this invention is: a privacy prediction system based on secret sharing using a convolutional neural network, comprising:

[0005] Cloud server S: Used to store the convolutional kernel K and weight matrix W of the convolutional neural network, as well as the secret sharing share M and lightweight neural network LNN1 generated during the preprocessing stage;

[0006] Query unit C: used to store the predicted data x uploaded to the cloud server, as well as to generate random numbers r and secret sharing shares N and lightweight neural network LNN2 during the preprocessing stage;

[0007] The convolutional neural network includes sequentially connected convolutional layers, activation layers, average pooling layers, and fully connected layers.

[0008] Network deployment unit: The computational unit for each activation layer during the preprocessing stage is replaced by a lightweight neural network and a summing layer.

[0009] Preferably, the lightweight neural network first compresses the spatial information of the input vector x through average pooling, then activates it through two fully connected layers, scales the output parameter results through a normalization layer, and finally sums them through a summing layer before outputting the result.

[0010] The technical solution adopted by the method of the present invention is: a privacy prediction method based on secret sharing using convolutional neural networks, comprising the following steps:

[0011] Step 1: Deploy and retrain the network

[0012] The network deployment unit replaces the computation unit of each activation layer in the original convolutional neural network with a lightweight neural network and a summing layer; then, the cloud server S retrains the convolutional neural network using the training set to obtain a trained convolutional neural network; finally, the cloud server S sends each lightweight neural network to the query unit C.

[0013] Step 2: Generate secret sharing shares;

[0014] Cloud server S has data W, and query unit C has data r. Cloud server S and query unit C use matrix factorization calculation protocol to securely calculate W·r. Finally, cloud server S obtains secret sharing share1 = M, and query unit C obtains secret sharing share2 = N, where W·r = M + N.

[0015] Step 3: Use convolutional layers to extract features from the original input data x to obtain the convolution calculation result V;

[0016] The query unit C divides the data x into data x1 and data x2, satisfying x = x1 + x2; the cloud server S converts the convolution operation into a matrix-vector multiplication operation, and performs matrix-vector multiplication using data x1 and the convolutional layer weight matrix W to obtain a partial calculation result V1; the query unit C uses data x2 to calculate and obtain a partial calculation result V2; the output data of the convolutional layer calculation unit satisfies V = V1 + V2.

[0017] Step 4: Use the activation layer to perform a nonlinear mapping on the data of the convolutional layer computation units to obtain the ReLU activation function calculation result R;

[0018] The cloud server S and the query unit C use the absolute value inequality approximation calculation scheme, and use V1, V2 and the lightweight neural network obtained in the preprocessing stage to complete the approximation calculation locally, and obtain the activated calculation results R1 and R2 respectively; the output data of the activation layer calculation unit satisfies R≤R1+R2;

[0019] Step 5: Use the average pooling layer to perform feature compression on the data R calculated by the activation layer to obtain the average pooling layer calculation result P;

[0020] Cloud server S performs average pooling operation on data R1 to obtain the average pooling layer partial calculation result P1. Query unit C performs average pooling operation on data R2 to obtain the average pooling layer partial calculation result P2. The output data of the average pooling layer calculation unit satisfies P = P1 + P2.

[0021] Step 6: Using a fully connected layer, the two-dimensional feature map after convolution, activation and average pooling is transformed into a one-dimensional vector and mapped to the prediction result.

[0022] Preferably, in step 1, the network deployment unit replaces the computation unit of each activation layer with a lightweight neural network and a summing layer; first, the spatial information of the input vector x is compressed by average pooling, then it is activated by two fully connected layers, and the output parameter result is scaled by a normalization layer to obtain a. i ,b i In the summation layer, the input vector x and the output parameter result a are used. i ,b i Calculate the result of the corresponding expression

[0023] As a preferred embodiment, step 2 includes the following sub-steps:

[0024] Step 2.1: Cloud server S generates a random matrix W′, and divides W′ into two submatrices W′ by columns. f and W′ s Cloud server S calculates W1 = W′ - W and W2 = W′ f +W′ s And send it to query unit C;

[0025] Step 2.2: Query unit C generates a random matrix r′, and divides r′ into two submatrices r′ by rows. f and r′ s ; Query unit C calculates r1 = r′ + r and r2 = r′ s -r′ f And send it to the cloud server S;

[0026] Step 2.3: Cloud server S calculates M = W·r1 + W′ f ·2;

[0027] Step 2.4: Calculate N = W1·r′ - W2·r′ for query cell C. s .

[0028] As a preferred embodiment, step 3 includes the following sub-steps:

[0029] Step 3.1: For input data x, query unit C uses r generated by the secret share generation unit in the preprocessing stage to hide input data x: query unit C calculates x1 = xr and sends it to cloud server S, query unit C owns x2 = r;

[0030] Step 3.2: Cloud server S converts the convolution calculation operation into matrix-vector multiplication calculation to obtain matrix W. Cloud server S calculates V1 = W·x1 + M, and query unit C has V2 = N.

[0031] As a preferred embodiment, step 4 includes the following sub-steps:

[0032] Step 4.1: Cloud server S and query unit C each possess data V1 and V2. The actual activation calculation result is R = 1 / 2 × (V1 + V2 + |V1 + V2|).

[0033] Step 4.2: Using the property of absolute value inequality, the data a and b satisfy the inequality |a+b|≤|a|+|b|, then R≤1 / 2×(V1+|V1|+V2+|V2|);

[0034] Step 4.3: Input V1 into the cloud server S and compute locally using a lightweight neural network LNN1. The query unit C input V2 is computed locally using a lightweight neural network LNN2. Where a1, b1 and a2, b2 are the output parameter results after V1 is input into LNN1, and the output parameter results after V2 is input into LNN2, respectively.

[0035] Preferably, in step 5, for the outputs R1 and R2 of the activation layer calculation unit, the cloud server S calculates the average value of the corresponding data for each pooling window in data R1 to obtain the average pooling layer partial calculation result P1; the query unit calculates the average value of the corresponding data for each pooling window in data R2 to obtain the average pooling layer partial calculation result P2.

[0036] Preferably, step 6 includes the following sub-steps:

[0037] Step 6.1: For data P2, query unit C uses r generated by the secret share generation unit in the preprocessing stage to hide data P2: query unit C calculates P2-r and sends it to cloud server S; cloud server S updates and calculates P1 = P1 + P2-r;

[0038] Step 6.2: Cloud server S obtains partial calculation result F1 = w·P1 + M, and query unit C has partial calculation result F2 = N; satisfying F1 + F2 = W·P.

[0039] As a preferred option, after step 7, the cloud server S returns the partial result F1 calculated by the last fully connected layer to the query unit C; the query unit C combines the two data F1 and F2 through an addition operation, i.e., F = F1 + F2, and finally obtains the true prediction result F.

[0040] The advantages of this invention are as follows: In the preprocessing stage, the matrix factorization calculation protocol of this invention is used to generate the secret share, avoiding complex encryption and decryption operations. When calculating matrix multiplication in the linear layer protocol, only one round of communication is required between the two parties. When calculating the ReLU activation function in the nonlinear layer protocol, the use of obfuscated circuits is avoided, and an absolute value inequality approximation scheme is used. Both linear and nonlinear layer calculations are completed in a secret sharing manner, improving the efficiency of privacy prediction. Compared with previous schemes, this invention achieves privacy prediction of convolutional neural networks more efficiently. Attached Figure Description

[0041] The technical solutions described herein are further illustrated below using examples and specific implementation methods. Additionally, accompanying drawings are used in the description of the technical solutions. Those skilled in the art can, without any creative effort, obtain other drawings and the intent of the present invention based on these drawings.

[0042] Figure 1 This is an overall architecture diagram of a high-efficiency convolutional neural network privacy prediction system based on secret sharing, according to an embodiment of the present invention.

[0043] Figure 2 This is a schematic diagram of different layers of computation in the preprocessing stage and the online stage of this invention.

[0044] Figure 3 This is a diagram of the convolutional neural network structure according to an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of the nonlinear layer replacement activation function in the model deployment stage of this invention.

[0046] Figure 5 This is a schematic diagram illustrating the generation of secret sharing shares during the preprocessing stage of an embodiment of the present invention. Detailed Implementation

[0047] To facilitate understanding and implementation of the present invention by those skilled in the art, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0048] In recent years, neural network prediction has been widely used as a service, such as in image recognition and natural language processing. However, plaintext prediction services raise privacy concerns regarding sensitive data. Among numerous neural network models, convolutional neural networks (CNNs) stand out due to their superior performance. Therefore, how to achieve privacy-preserving prediction services using CNNs has become an important research direction. This system has two entities: a cloud server S and a query unit C. This system utilizes secret-sharing technology to efficiently complete privacy-preserving CNN predictions while protecting the privacy of both parties.

[0049] Secret sharing is a cryptographic primitive that splits a secret value into different secret shares, each managed by a different participant. A single participant cannot recover the secret value; it can only be recovered through the collaborative computation of several participants. Furthermore, if a certain number of participants fail, the secret value can still be recovered through the cooperation of the remaining participants.

[0050] The high-efficiency convolutional neural network privacy prediction system based on secret sharing provided by this invention has the following main overall structure: Figure 1 The preprocessing and online phases are illustrated using a convolutional neural network for image classification as an example to specifically describe the framework and computational flow of the present invention. Two entities in the system are designated as cloud server S and query unit C. The operational procedures that cloud server S and query unit C need to perform in the preprocessing and online phases are detailed below. Figure 2 .

[0051] In this embodiment, the cloud server S is used to store the convolution kernel K and weight matrix W of the convolutional neural network, as well as to generate the secret sharing share M and the lightweight neural network LNN1 during the preprocessing stage.

[0052] The query unit C in this embodiment is used to store the prediction data x uploaded to the cloud server, and to generate random numbers r, secret sharing shares N, and lightweight neural networks LNN2 during the preprocessing stage.

[0053] Please see Figure 3 The convolutional neural network in this embodiment includes sequentially connected convolutional layers, activation layers, average pooling layers, and fully connected layers.

[0054] In one implementation, a Convolutional Neural Network (CNN) is a deep learning model primarily used for tasks involving data with a grid structure, such as image and speech recognition. It consists of multiple layers, with common layers including convolutional layers, activation layers, average pooling layers, and fully connected layers.

[0055] In one implementation, convolutional layers are the core component of CNNs. They perform convolution operations by sliding one or more convolutional kernels (filters) across the input data to extract features from an image. Convolutional computations can also be converted into matrix-vector multiplication. Convolutional layers play a crucial role in image processing by extracting features; each convolutional kernel generates a feature map that captures local features of the input data.

[0056] In one implementation, the activation layer activates the output of the convolutional layer by applying a nonlinear function (such as ReLU, Sigmoid, Tanh, etc.) to introduce nonlinear factors, enhance the network's expressive power, and enable it to better adapt to complex data patterns and relationships. In this system, the activation layer uses the ReLU activation function.

[0057] In one implementation, an average pooling layer is used to reduce the size of the feature map while preserving important feature information. It reduces the dimensionality of the data by performing an average pooling operation on the feature values ​​of specific regions. This helps reduce the number of parameters, improve computational efficiency, and enhance the translation invariance of the network.

[0058] In one implementation, a fully connected layer is a common layer in neural networks that connects the outputs of previous layers to subsequent layers. In CNNs, fully connected layers are typically used to map high-level abstract features to output nodes for different categories. The outputs of fully connected layers can be used to compute the probabilities of each category using the softmax activation function.

[0059] The combination of these layers forms the structure of a convolutional neural network. Through layer-by-layer feature extraction and combination, CNNs can learn abstract representations of input data, thereby achieving efficient classification and recognition of data such as images and speech.

[0060] The network deployment unit in this embodiment is used to replace the computational unit of each activation layer with a lightweight neural network and a summing layer during the preprocessing stage. The network deployment unit first replaces each activation layer computational unit with a lightweight neural network and a summing layer, such as... Figure 4 As shown. Then, the cloud server S retrains the modified model using the training set (similar to the training process of the original convolutional neural network model). Finally, the cloud server S sends each lightweight neural network to the query unit C. All parameters of the lightweight neural network model come from the training set, and this solution can generalize well to the same task as the training set. In the practical application of the online phase of the privacy prediction model, the cloud server S and the query unit C respectively input their data into the local lightweight neural network LNN1 or LNN2 to complete the approximate calculation of the ReLU expression.

[0061] In one implementation, the lightweight neural network deployment uses the Squeeze-and-Excitation (SE) module. The lightweight neural network first compresses the spatial information of the input vector x using average pooling, then activates it through two fully connected layers, scales the output parameters using a normalization layer, and finally sums the results using a summing layer before outputting the final values. This technique is used to calculate the feature weights for each channel because it highlights important features and suppresses unimportant ones, thereby improving the predictive ability of the neural network model. Specifically, for the input vector, the lightweight neural network compresses the spatial information through an average pooling layer, then performs dimensionality transformation through two fully connected layers, and then uses a normalization layer to constrain the output to the range (-1, 1). Finally, the output parameters and the input vector are calculated in the summing layer.

[0062] This invention provides a privacy prediction method based on secret sharing using convolutional neural networks, comprising the following steps:

[0063] Step 1: Deploy and retrain the network;

[0064] The network deployment unit replaces the computation unit of each activation layer in the original convolutional neural network with a lightweight neural network and a summing layer; then, the cloud server S retrains the convolutional neural network using the training set to obtain a trained convolutional neural network; finally, the cloud server S sends each lightweight neural network to the query unit C.

[0065] In one implementation, the network deployment unit replaces the computational unit of each activation layer with a lightweight neural network and a summing layer; first, the spatial information of the input vector x is compressed by average pooling, then it is activated by two fully connected layers, and the output parameter result is scaled by a normalization layer to obtain a. i ,b i In the summation layer, the input vector x and the output parameter result a are used. i ,b i Calculate the result of the corresponding expression

[0066] Step 2: Generate secret sharing shares;

[0067] To facilitate online computation, some data is preprocessed and generated. Let the system consist of two entities: cloud server S and query unit C. Cloud server S possesses data W, and query unit C possesses data r. Cloud server S and query unit C securely compute W·r using a matrix factorization computation protocol. Finally, cloud server S obtains a secret sharing share share1 = M, and query unit C obtains a secret sharing share share2 = N. During the preprocessing stage, the secret sharing share generation unit outputs data satisfying W·r = M + N.

[0068] In one implementation, such as Figure 5 As shown, the specific implementation of step 2 includes the following sub-steps:

[0069] Step 2.1: Cloud server S generates a random matrix W′, and divides W′ into two submatrices W′ by columns. f and W′ s Cloud server S calculates W1 = W′ - W and W2 = W′ f +W′ s And send it to query unit C;

[0070] Step 2.2: Query unit C generates a random matrix r′, and divides r′ into two submatrices r′ by rows. f and r′ s ; Query unit C calculates r1 = r′ + r and r2 = r′ s -r′ f And send it to the cloud server S;

[0071] Step 2.3: Cloud server S calculates M = W·r1 + W′ f ·2;

[0072] Step 2.4: Calculate N = W1·r′ - W2·r′ for query cell C. s .

[0073] Step 3: Use convolutional layers to extract features from the original input data x to obtain the convolution calculation result V;

[0074] In this embodiment, feature extraction is performed on the original input data x. Specifically, for each region of the original input data x, a convolution operation K(•) is performed with the convolution kernel K to obtain the convolution calculation result V. The query unit C divides the data x into data x1 and data x2, and sends x1 to the cloud server S, where x = x1 + x2. Using the secret sharing share generation unit in the preprocessing stage, the cloud server S converts the convolution operation into a matrix-vector multiplication operation. A matrix-vector multiplication operation is performed using data x1 and the convolution layer weight matrix W to obtain a partial calculation result V1. The query unit C uses data x2 to calculate and obtain a partial calculation result V2. The output data of the convolution layer calculation unit satisfies V = V1 + V2.

[0075] In one implementation, step 3 specifically includes the following sub-steps:

[0076] Step 3.1: For input data x, query unit C uses r generated by the secret share generation unit in the preprocessing stage to hide input data x: query unit C calculates x1 = xr and sends it to cloud server S, query unit C owns x2 = r;

[0077] Step 3.2: Cloud server S converts the convolution calculation operation into matrix-vector multiplication calculation to obtain matrix W. Cloud server S calculates V1 = W·x1 + M, and query unit C has V2 = N.

[0078] Step 4: Use the activation layer to perform a nonlinear mapping on the data of the convolutional layer computation units to obtain the ReLU activation function calculation result R;

[0079] This embodiment employs the ReLU activation function, meaning that for data x, the activation function needs to be calculated as f(x) = max(x, 0), which is equivalent to 1 / 2 × (x + |x|). The cloud server S and the query unit C utilize an approximation scheme based on the absolute value inequality, using their respective data V1 and V2, along with the lightweight neural network obtained during the network model deployment phase, to perform approximate calculations locally, obtaining the activated data R1 and R2 respectively. This completes the activation layer operation, where R1 + R2 ≥ R, and R is the activation layer calculation result.

[0080] In one implementation, step 4 specifically includes the following sub-steps:

[0081] Step 4.1: Cloud server S and query unit C each possess data V1 and V2. The actual activation calculation result is R = 1 / 2 × (V1 + V2 + |V1 + V2|).

[0082] Step 4.2: Using the property of absolute value inequality, the data a and b satisfy the inequality |a+b|≤|a|+|b|, then R≤1 / 2×(V1+|V1|+V2+|V2|);

[0083] Step 4.3: Input V1 into the cloud server S and compute locally using a lightweight neural network LNN1. The query unit C input V1 is computed locally using a lightweight neural network LNN2. Where a1, b1 and a2, b2 are the output parameter results after W1 is input into LNN1, and V2 is the output parameter result after V2 is input into LNN2.

[0084] Step 5: Use the average pooling layer to perform feature compression on the data R calculated by the activation layer to obtain the average pooling layer calculation result P;

[0085] In this embodiment, the average pooling layer is used to perform feature compression on the data R calculated by the activation layer. That is, the average pooling calculation operation is performed on a certain area of ​​data to obtain the average pooling layer calculation result P. The cloud server S performs the average pooling operation on the data R1 to obtain the average pooling layer partial calculation result P1. The query unit C performs the average pooling operation on the data R2 to obtain the average pooling layer partial calculation result P2. The output data of the average pooling layer calculation unit satisfies P = P1 + P2.

[0086] Step 6: Using a fully connected layer, the two-dimensional feature map after convolution, activation, and average pooling is transformed into a one-dimensional vector and mapped to the prediction result;

[0087] In this embodiment, the secret share generation unit in the preprocessing stage is used. The cloud server s uses data P1 and the weight matrix W of the fully connected layer to perform dot product calculation to obtain a partial calculation result F1. The query unit C uses data P2 to calculate and obtain a partial calculation result F2. The output data of the fully connected layer calculation unit satisfies F = W·P = F1 + F2, where F is the convolutional neural network prediction result required by the query unit C.

[0088] In one implementation, step 6 specifically includes the following sub-steps:

[0089] Step 6.1: For data P2, query unit C uses r generated by the secret share generation unit in the preprocessing stage to hide data P2: query unit C calculates P2-r and sends it to cloud server S; cloud server S updates and calculates P1 = P1 + P2-r;

[0090] Step 6.2: Cloud server S obtains partial calculation result F1 = W·P1 + M, and query unit C has partial calculation result F2 = N; satisfying F1 + F2 = W·P.

[0091] After step 6, the cloud server S returns the partial result F1 calculated by the last fully connected layer to the query unit C; the query unit C combines the two data F1 and F2 through an addition operation, that is, F = F1 + F2, and finally obtains the true prediction result F.

[0092] This invention presents a privacy-predicting scheme for convolutional neural networks. Through secret sharing technology, the output of each stage is securely shared between the cloud server and the query unit, ensuring the privacy of input data, intermediate computation results, and output prediction results. Furthermore, this scheme achieves privacy-predicting tasks more efficiently while maintaining privacy.

[0093] The specific examples described in this invention are merely illustrative of the spirit of the invention. Those skilled in the art can make various modifications or additions to the described specific examples or use similar methods to replace them, without departing from the spirit of the invention or exceeding the scope defined by the appended claims.

[0094] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A privacy prediction system based on secret sharing using convolutional neural networks, characterized in that, include: cloud server : Convolution kernels used to store convolutional neural networks and weight matrix And generating secret sharing shares during the preprocessing stage. and lightweight neural networks ; Query unit Used to store prediction data uploaded to the cloud server. And generating random numbers during the preprocessing stage. Secretly share and lightweight neural networks ; Network deployment unit: The computational unit for each activation layer during the preprocessing stage is replaced by a lightweight neural network and a summing layer; The convolutional neural network includes sequentially connected convolutional layers, activation layers, average pooling layers, and fully connected layers. The lightweight neural network first compresses the input vector using average pooling. The spatial information is then processed through two fully connected layers to excite it, and the output parameter results are scaled through a normalization layer. Finally, the summation is performed through a summation layer before output.

2. A privacy prediction method based on secret sharing using convolutional neural networks, characterized in that, Includes the following steps: Step 1: Deploy and retrain the network; The network deployment unit replaces the computational units of each activation layer in the original convolutional neural network with a lightweight neural network and a summing layer; then, the cloud server... The convolutional neural network is retrained using the training set to obtain a trained convolutional neural network; finally, the cloud server... Send each lightweight neural network to the query unit. ; The network deployment unit replaces the computational units of each activation layer in the original convolutional neural network with a lightweight neural network and a summing layer, first compressing the input vector through average pooling. The spatial information is then used to stimulate it through two fully connected layers, and the output parameter results are scaled through a normalization layer to obtain... ; In the summation layer, the input vector is used and output parameter results Calculate the result of the corresponding expression ; Step 2: Generate secret sharing shares; cloud server Having data Query unit Having data cloud server and query unit Secure computation using matrix factorization protocol Finally, cloud servers Obtain a secret share Query unit Obtain a secret share ,in ; Step 3: Use convolutional layers to process the original input data. Feature extraction is performed to obtain the convolution calculation result. ; Query unit Data Data segmentation and data ,satisfy cloud server The convolution operation is converted into a matrix-vector multiplication operation, utilizing data. and convolutional layer weight matrix Perform matrix-vector multiplication to obtain partial calculation results. Query unit Using data Calculations were performed, and partial results were obtained. The output data of the convolutional layer computation unit satisfies ; Step 4: Use the activation layer to perform a nonlinear mapping on the data of the convolutional layer computation units to obtain the ReLU activation function calculation results. ; cloud server and query unit The approximate calculation scheme uses the absolute value inequality. and The lightweight neural network obtained in the preprocessing stage performs approximate calculations locally, yielding the activated calculation results. and The output data of the activation layer computing unit satisfies ; Step 5: Calculate the data of the activation layer using the average pooling layer. Feature compression is performed to obtain the average pooling layer calculation results. ; cloud server In data Perform average pooling operation on the top layer to obtain the calculation results of the average pooling layer. Query unit In data Perform average pooling operation on the top layer to obtain the calculation results of the average pooling layer. The output data of the average pooling layer calculation unit satisfies ; Step 6: Using a fully connected layer, the two-dimensional feature map after convolution, activation and average pooling is transformed into a one-dimensional vector and mapped to the prediction result.

3. The privacy prediction method for convolutional neural networks based on secret sharing according to claim 2, characterized in that, Step 2 includes the following sub-steps: Step 2.1: Cloud Server Generate random matrices ,Will Divide into two sub-matrices according to columns. and ; cloud server calculate and And send it to the query unit. ; Step 2.2: Query Unit Generate random matrices ,Will Divide the matrix into two sub-matrices by row. and Query unit calculate and And send it to the cloud server. ; Step 2.3: Cloud Server calculate ; Step 2.4: Query Unit calculate .

4. The privacy prediction method for convolutional neural networks based on secret sharing according to claim 2, characterized in that, Step 3 includes the following sub-steps: Step 3.1: For the input data Query unit Using the secret share generation unit generated during the preprocessing stage To hide input data Query unit calculate And send to the cloud server Query unit have ; Step 3.2: Cloud Server The convolution operation is converted into a matrix-vector multiplication operation to obtain a matrix. cloud server calculate Query unit have .

5. The privacy prediction method for convolutional neural networks based on secret sharing according to claim 2, characterized in that, Step 4 includes the following sub-steps: Step 4.1: Cloud Server and query unit Each has its own data and The actual activation calculation result is ; Step 4.2: Using the properties of absolute value inequalities, the data... and Satisfying inequalities ,but ; Step 4.3: Cloud Server enter Utilizing lightweight neural networks locally calculate Query unit enter Utilizing lightweight neural networks locally calculate ;in , and , They are enter The output parameter results after that, enter The output parameters are then displayed.

6. The privacy prediction method for convolutional neural networks based on secret sharing according to claim 2, characterized in that: In step 5, the output of the activation layer computation unit... and cloud server In data The average value of the corresponding data is calculated for each pooling window to obtain the calculation result of the average pooling layer. ; Query unit in data The average value of the corresponding data is calculated for each pooling window to obtain the calculation result of the average pooling layer. .

7. The privacy prediction method for convolutional neural networks based on secret sharing according to claim 2, characterized in that, Step 6 includes the following sub-steps: Step 6.1: Targeting the data Query unit Using the secret share generation unit generated during the preprocessing stage To hide data Query unit calculate And send to the cloud server ; cloud server Update calculation ; Step 6.2: Cloud Server Partial calculation results were obtained. Query unit Possessing partial calculation results ;satisfy .

8. The privacy prediction method for convolutional neural networks based on secret sharing according to any one of claims 2-7, characterized in that: After step 6, the cloud server Partial results from the calculation of the last fully connected layer Return to query unit Query unit Through addition operation and The two sets of data are combined, that is Ultimately, the true prediction result is obtained. .

Images