A neural network output result property rights certification method, system and device

Abstract

The present invention discloses a method, system and device for proving the property rights of a neural network output result. The method comprises: S1, generating a proof π; S2, submitting a proof; S3, adding a record and presenting a proof π; S4, checking uniqueness; S5, verifying the proof π; the system comprises: a proof generation π module, a proof submission module, a record addition and presentation proof π module, a uniqueness checking module and a proof verification π module; by applying the zkCNN protocol originally used in a neural network verifiable computing scenario to a neural network output result property rights certification scenario, while ensuring that the neural network weight parameters are not leaked, a secure, reliable and durable proof π is generated, thereby proving that a certain value or vector is indeed calculated by the neural network.

Description

Technical Field

[0001] The present invention relates to a method for proving the property rights of a neural network output result, and in particular to a method, system and device for proving the property rights of a neural network output result based on zero-knowledge proof and blockchain, and belongs to the field of information security technology. Background Art

[0002] In recent years, since the use cost and time cost of neural networks are several orders of magnitude lower than the development cost, the profit temptation of illegal copying and illegal use is huge, which has led to infringers flocking to it, so it is urgent to protect the intellectual property rights of neural network models. For the owner of a neural network model, if he wants to prove his intellectual property rights to a certain product, the goal of proof is that a certain product (picture, audio, video, text) is indeed generated by the calculation of his unique neural network model. In order to achieve the above goals, there are currently two main types of technical means: one is the digital watermarking technology of neural networks; the other is the verifiable calculation scheme of neural networks based on zero-knowledge proof, which are specifically introduced as follows.

[0003] First of all, zero-knowledge proof is a two-party cryptographic protocol running between a prover (Prover, abbreviated as P) and a verifier (Verifier, abbreviated as V), which allows the prover to convince the verifier of the correctness of a proposition without revealing any information other than the correctness. Specifically, zero-knowledge proof is first an interactive proof, that is, the prover and the verifier need to be online at the same time and work together to complete the interactive process of the protocol, and then the verifier can decide whether to trust the proposition stated by the prover. Based on the interactive proof, the zero-knowledge proof can be modified into a non-interactive proof, allowing the prover to complete the entire proof process independently, and then send the generated proof to the verifier, and the verifier can independently check the validity of the proof at any time to decide whether to trust it or not.

[0004] Secondly, neural network verifiable computing is a general term for a class of cryptographic schemes used in outsourced computing scenarios, in which there are two parties, the prover and the verifier. The prover uses its private neural network model to calculate a certain input sample provided by the verifier and at the same time provides proof of the correctness of the calculation result. Specifically, Figure 1As shown in the figure, the verifier provides input sample X, and the prover uses the neural network model he holds to calculate and obtain the output result Y, and provides proof π for the correctness of the calculation process. The verifier verifies the correctness of the calculation process by checking the proof π. In addition, since the neural network model is the key asset used by the prover to provide outsourced computing services, the prover has the motivation to protect the privacy of its own neural network model. Therefore, current neural network verifiable computing solutions often use zero-knowledge proof technology to protect the privacy of neural network models. For example: zkCNN protocol and vCNN protocol are neural network verifiable computing solutions, which can provide proofs for the correctness of the neural network calculation process while ensuring that the weight parameters of the model are not leaked.

[0005] Among them, the vCNN protocol is based on the Zero-Knowledge Argument for Non-Interactive Simplified Chinese (ZK-SNARK), the core of which is to transform the proposition to be proved into a series of highly compressed equations, and finally compress the scale of the proof to three domain elements. However, it has the following technical defects: First, its scope of application is narrow, and it can only be used for the proof of small models (such as the LeNet model). It has no practical value when facing larger models; second, it requires trusted initialization, that is, before the proof and verification stages, a trusted third party or verifier needs to participate in the initialization setting of the protocol parameters, which is an inherent defect of the ZK-SNARK technical route.

[0006] The zkCNN protocol is based on a bidirectional and efficient zero-knowledge proof (ZK-DEIP). Its core is the zero-knowledge sum-check protocol (zk-sumcheck). The basic sum-check protocol (sumcheck) algorithm flow is as follows: Figure 2 As shown, it has the following technical defects: First, the applicable objects are limited. Currently, it only supports neural networks with numerical output results, but not neural networks with vector output results. This is because the algorithm design of the protocol determines that the starting point of the proof can only be a single numerical value, and the vector cannot be used as the starting point of the proof; second, it does not support non-interactive proof in practical applications, otherwise the generated proof can be stolen by anyone and used to deceive others. This is because the proof generated in a non-interactive way is always valid after it is generated, but the proof proposition of the zkCNN protocol does not actually contain the identity information of the prover. Therefore, the verifier can only confirm whether a proof is qualified or not, but cannot confirm whether the provider of the proof is the generator of the proof. Therefore, the zkCNN protocol can only support interactive proof in practical applications, which means that the prover must temporarily calculate new proofs for each different verifier, which not only wastes computing resources, but also reduces the response speed and concurrency of the service.

[0007] In summary, the existing methods for proving the ownership of neural network output results not only have poor versatility, but also have low cost-effectiveness. Therefore, it is urgent to provide a new way to prove the ownership of neural network output results. Summary of the invention

[0008] In response to the above technical problems, the present invention provides a method, system and device for proving the ownership of neural network output results. By applying the zkCNN protocol originally used in neural network verifiable computing scenarios to the ownership proof scenario of neural network output results, while ensuring that the neural network weight parameters are not leaked, a safe, reliable and durable proof π is generated to prove that a certain number or vector is indeed calculated by the neural network.

[0009] To achieve the above objectives, firstly, the present invention provides a method for proving the property rights of a neural network output result, comprising:

[0010] S1. For the process of calculating the output result Y from the neural network model, the prover uses the hash function to simulate the behavior of the verifier, independently executes the layer-by-layer proof algorithm, and finally generates the proof π;

[0011] S2. The prover generates record A 1 =(Hash(Y), Hash(π), ProverID, Time), then send record A1 to the blockchain and record the block number λ;

[0012] S3, add record A to the blockchain 1 , and record A 1 Send it to the verifier, and the prover sends the proof π to the verifier;

[0013] S4. The verifier targets record A 1 Execute the uniqueness verification algorithm to determine whether to believe that the prover corresponding to the ProverID is indeed the first person to generate proof π;

[0014] S5. The verifier executes the verification algorithm for the proof π to determine whether to believe the prover's proof π about the output result Y.

[0015] In the method of the present invention, in step S1, the neural network model calculates the output result Y, including:

[0016] S1-11, construct the arithmetic circuit C corresponding to the neural network model;

[0017] S1-12, converting all parameters of the input layer of the arithmetic circuit C into integers through a quantization formula or a fixed-point representation;

[0018] S1-13, respectively count the lengths of the three fields of the output value X, weight parameter W, and auxiliary parameter aux of a certain layer of neurons, and obtain that the length of the longest field is N, use 0 to fill the lengths of the other two fields to N, and use a string of 0s with a length of N as the fourth field, and then concatenate the four fields into a vector T = (X, W, aux, 0) with a length of 4N;

[0019] S1-14. The prover uses a hash function to select a random number r, and uses the zero-knowledge polynomial commitment zkPC and the random number r to commit to the vector T. After zkPC(T, r), the commitment polynomial com is obtained.

[0020] S1-15. Use vector T as input vector and use arithmetic circuit C to perform calculation to obtain output result Y.

[0021] The method of the present invention further comprises, in step S1-11, the arithmetic circuit C corresponding to the neural network model is constructed, comprising:

[0022] Assuming that the arithmetic circuit C has a total of d layers, the formula is as follows:

[0023]

[0024]

[0025]

[0026]

[0027]

[0028]

[0029] In the formula, Xadd represents an addition gate, Xmult represents a multiplication gate; i represents any layer, and 1≤i≤d, i=1 represents the input layer, i=d represents the output layer; i-1 represents that the input wire x or y of the operation gate comes from the adjacent layer; in represents that the input wire x or y of the operation gate comes from the input layer; V i (z) is the zth wire of the i-th layer; z indicates the wire number of the i-th layer from which the output wire of the operation gate is located; x and y respectively indicate the wire numbers of the first input wire and the second input wire of the operation gate in their source layers; s i is the total number of wires in the i-th layer, s in is the total number of wires in the input layer.

[0030] The method of the present invention further comprises, in step S1, the prover simulates the behavior of the verifier using a hash function and independently executes a layer-by-layer proof algorithm, including:

[0031] S1-21, according to the multivariable linear expansion MLE, subcircuit C j The only conductor X of the output layer d =y j Defined as

[0032] S1-22. The prover uses a hash function to select a random number r d , the random number r d Record it in the proof π and calculate

[0033] S1-23, for numerical values Starting from i=d until i=2, the zk-sumcheck protocol is repeatedly called for the following summation formula, reducing the correctness of the value at layer i=d to the correctness of the value at layer i=0 layer by layer:

[0034]

[0035] Where X represents the output value of a neuron in a certain layer; W represents the weight parameter; i represents any layer, and 1≤i≤d; i-1 represents that the input wire x or y of the operation gate comes from the adjacent layer; x and y represent the first input wire and the second input wire of the operation gate in their source layer; z represents the output wire of the operation gate in the i-th layer.

[0036] The method of the present invention further comprises, in step S1, the final generation of proof π, comprising:

[0037] If the output result Y of the arithmetic circuit C at the output layer is a single value, a proof π is generated and the random number r is recorded in the proof π;

[0038] If the output result Y of the arithmetic circuit C at the output layer is a vector of length n, then let Y = (y 1 ,y 2 , ..., y n ), the arithmetic circuit C is divided into corresponding n subcircuits according to the output layer, that is, C = (C 1 , C 2 , ..., C n ), the corresponding relationship is C j (X, W, aux) = y j , where j∈[1,n], thus generating proof π=(π 1 , π 2 , ..., π n ), and record the random number r into the proof π.

[0039] In the method of the present invention, step S4 further comprises:

[0040] S4-1. The verifier checks whether record A actually exists on the block numbered λ 1 ; If record A exists 1 , then proceed to the next step;

[0041] S4-2. The verifier checks whether record A exists on the block with a number less than or equal to λ 2 =(Hash(Y), Hash(π), xID, xTime), where xID≠ProverID and xTime<Time; if there is no record A 2 , then the output is verify(A 1 )=1, indicating that the prover corresponding to ProverID is indeed the first person to generate proof π.

[0042] In the method of the present invention, step S5 further comprises:

[0043] S5-1. Call the zk-sumcheck protocol for the following summation formula, and The correctness of the value is reduced to a value in the input layer Thus, z is finally locked to the random number vector r a :

[0044]

[0045]

[0046] In the formula, Indicates the first value that needs to be checked at the i-th layer during the reduction process; Indicates the second value that needs to be checked at the i-th layer during the reduction process; r i，0 and r i，1 Represents a random number; represents the zth wire of the input layer; C i (z i，0 , z) represents a function that outputs 0 or 1;

[0047] S5-2. The verifier generates a random number vector r a =(r 1 , r 2 , ..., r logN , r 1+logN , r 2+logN ), the length of the random number vector is 2+logN; then the random number vector r is trimmed a The last two components of the random number vector r are obtained b =(r 1 , r 2 , ..., r logN), the length of the random number vector is logN;

[0048] S5-3. The verifier uses the random number vector r b and random number r to open the commitment polynomial com, through zkPC.open(com, r, r b ),get and The value of

[0049] S5-4. The verifier completes the final check according to the following formula:

[0050]

[0051] In the formula, represents the MLE defined by the input vector of the arithmetic circuit C; Represents the MLE defined by the output value X, weight parameter W, and auxiliary parameter aux of a certain layer of neurons; r a represents a random number vector; r b represents a random number vector;

[0052] If the equation holds, then output verify(π)=1;

[0053] S5-5. For all j∈[1,n], verify(π j )=1, and verify(A 1 )=1, then the verifier can trust the prover's statement, that is, the output result Y is indeed generated by the prover's private neural network model.

[0054] It can be seen from the above technical solution that the overall process of the method of the present invention is as follows:

[0055] In the proof generation phase, first, the prover generates proof π about the proposition C(X, W, aux) = Y. In particular, if the output result Y is a vector of length n, let Y = (y 1 ,y 2 , ..., y n ), the arithmetic circuit is divided into n corresponding subcircuits according to the output layer, that is, C = (C 1 , C 2 , ..., C n ), the corresponding relationship is C j (X, W, aux) = y j , where j∈[1,n], the prover executes the zkCNN protocol on each of them, calling it n times in total, thus generating a proof π=(π 1 , π 2 , ..., π n ). Then, the prover generates record A1 =(Hash(Y), Hash(π), ProverID, Time), and send the record to the blockchain.

[0056] In the verification phase, the verifier verifies the components of the zero-knowledge proof π and the blockchain record A respectively. 1 Execute the verification algorithm. If for all j∈[1,n] there is verify(π j )=1, and verify(A 1 )=1, then the verifier can trust the prover’s statement, that is, “the output result Y is indeed generated by the prover’s private neural network.”

[0057] Secondly, the present invention provides a neural network output result property rights certification system, including a generation certification module, a submission certification module, a record addition and presentation certification module, a uniqueness verification module, and a verification certification module; wherein,

[0058] The generation proof π module is used for the process of calculating the output result Y for the neural network model. The prover uses the hash function to simulate the behavior of the verifier, independently executes the layer-by-layer proof algorithm, and finally generates the proof π;

[0059] The submission proof module is used by the prover to generate record A 1 =(Hash(Y), Hash(π), ProverID, Time), then record A 1 Send it to the blockchain and record the block number as λ;

[0060] The record adding and proof producing module is used to add records A to the blockchain. 1 , and record A 1 Send it to the verifier, and the prover sends the proof π to the verifier;

[0061] The verification uniqueness module is used by the verifier to verify the record A of the blockchain. 1 Execute the uniqueness verification algorithm to determine whether to believe that the prover corresponding to the ProverID is indeed the first person to generate proof π;

[0062] The verification proof π module is used for the verifier to execute the verification proof algorithm on the components of the proof π to determine whether to believe the prover's proof π on the output result Y.

[0063] Thirdly, the present invention also provides a neural network output result property rights certification device, comprising at least one processor; and a memory connected to at least one of the processors; wherein,

[0064] The memory stores instructions executable by the processor;

[0065] The instructions are used to be executed by the processor to implement the method for proving the property rights of a neural network output result.

[0066] In summary, the method of the present invention mainly solves the following two problems: first, the problem of "proof theft" that may occur in the property rights proof scenario; second, the zkCNN protocol currently supports limited types of neural networks, and only supports neural network models whose output results are single numbers, such as various classification models, but cannot support neural network models whose output results are vectors, such as various generative networks.

[0067] Moreover, while ensuring that the neural network weight parameters are not leaked, the method of the present invention generates a secure, reliable and durable proof π, proving that a certain value or vector is indeed calculated by the neural network, thereby providing a new way to prove the ownership of the neural network output results, ensuring the completeness, rationality and zero-knowledge of the data proof of blockchain users, making it impossible for malicious nodes to obtain the user's true privacy data through the proof provided by the user, thereby improving the security of the system.

[0068] Compared with the prior art, the key technical points of the present invention are: (1) The blockchain records the identity of the prover who first calculated the proof of π, ensuring that the proof of π cannot be stolen, so that the zkCNN protocol can support non-interactive proof in actual scenarios. (2) The zkCNN protocol can be used to prove vectors by dividing the circuit and executing the zkCNN protocol multiple times in sequence.

[0069] At the same time, the present invention has a wider scope of application, better cost-effectiveness and stronger reliability. The specific technical advantages are as follows:

[0070] A. Compared with the neural network verifiable computing scheme based on zero-knowledge proof:

[0071] First, the present invention adopts zero-knowledge proof technology with lower proof complexity, so it can support proofs for large neural networks, so its scope of application is better than that of the vCNN protocol.

[0072] Secondly, the present invention can be used to prove the neural network (generative network) whose output result is a vector, so it can support the property rights proof of various objects such as pictures, audio, video, text, etc., so its scope of application is better than that of the zkCNN protocol.

[0073] Furthermore, the present invention eliminates the potential "proof theft" problem by using digital signatures, and thus can support non-interactive proofs, thereby outperforming the zkCNN protocol in terms of cost-effectiveness, service response speed, and concurrency.

[0074] Finally, the present invention does not require a trusted third party or verifier to participate in the parameter initialization process, and is therefore superior to the vCNN protocol in terms of deployment flexibility and cost.

[0075] B. Compared with the digital watermarking technology of neural network:

[0076] Firstly, the proof information generated by the present invention is independent of the proof object, so it will not interfere with its subsequent use, and it is more flexible in the timing of presenting the proof, so there is no need to worry about the evidence being destroyed.

[0077] Secondly, digital watermarks may be destroyed or eliminated by algorithms, and old digital watermarks may be covered by new ones. However, the present invention benefits from the reliability of zero-knowledge proof, which can ensure that no one can forge a certificate for the same object, thus having a more reliable proof of property rights. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0079] Figure 1 A schematic diagram of the process of proving the misappropriation problem in the prior art;

[0080] Figure 2 It is a flow chart of the sumcheck protocol in the prior art;

[0081] Figure 3 It is a schematic diagram of the process of the present invention;

[0082] Figure 4 Schematic diagram of the process of using the zkCNN protocol in the method of the present invention;

[0083] Figure 5 It is a principle block diagram of the system of the present invention;

[0084] Figure 6 It is a principle block diagram of the device of the present invention; DETAILED DESCRIPTION

[0085] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0086] Example 1: A method for proving ownership of neural network output results based on zero-knowledge proof and blockchain.

[0087] like Figure 3 , Figure 4As shown, this embodiment provides a method for proving the ownership of a neural network output result based on zero-knowledge proof and blockchain, which is mainly divided into a proof generation stage and a verification stage.

[0088] (I) Proof generation phase, including: S1, generate proof π; S2, submit proof; S3, add record and present proof π, as described in detail below.

[0089] S1. Generate proof π: The prover uses the hash function to simulate the behavior of the verifier, thereby independently executing the layer-by-layer proof algorithm for the process of "the neural network model calculates the output result Y", and finally outputs proof π, which is described in detail as follows.

[0090] S1-1. The neural network model calculates the output result Y, which is described in detail as follows.

[0091] S1-11. First, prepare the circuit and represent the neural network model as the corresponding arithmetic circuit C. Assuming that the arithmetic circuit C has a total of d layers, the definition formula is as follows:

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098] In the formula, any layer is denoted as i, and 1≤i≤d; when i=1, it represents the input layer; when i=d, it represents the output layer. The zth wire of the i-th layer is denoted as V i (z), the total number of wires in the i-th layer is recorded as s i , the total number of wires in the input layer (i=1) is denoted as s in . Moreover, Xadd represents an addition gate, which has one output wire and one input wire; Xmult represents a multiplication gate, which has one output wire and two input wires. z represents the output wire of the operation gate, which is the wire number of the i-th layer; x or y represents the first input wire and the second input wire of the operation gate, which are the wire numbers of their source layers. The input wire x or y of the operation gate may come from the adjacent layer, indicated by the subscript i-1; it may also come from the input layer, indicated by the subscript in. It can be seen that there are two types of addition gates and three types of multiplication gates. The value of any wire in the arithmetic circuit C can be summed up by position matching these five operation gates.

[0099] S1-12. Convert all parameters of the input layer of the arithmetic circuit C into integers through a quantization formula or fixed-point representation.

[0100] S1-13. Count the lengths of the three fields, namely the output value X, weight parameter W, and auxiliary parameter aux of a certain layer of neurons, and obtain that the length of the longest field is N. Use 0 to fill the lengths of the other two fields to N, and use a string of 0s with a length of N as the fourth field. Then concatenate the four fields together to form a vector T = (X, W, aux, 0) with a length of 4N.

[0101] S1-14. The prover uses a hash function to select a random number r, and uses the zero-knowledge polynomial commitment zkPC and the random number r to commit to the vector T. After zkPC(T, r), a commitment polynomial com is obtained.

[0102] It should be noted that in the prior art, zero-knowledge polynomial commitment (zkPC) is a cryptographic primitive with three basic functions: first, it allows the prover to make a commitment in advance for the polynomial he will use in a certain protocol to eliminate the possibility of subsequent substitution of the polynomial; second, it allows the verifier to randomly specify a point and obtain the value of the polynomial at that point when needed, and be sure that the value is correct; third, except for the value actively revealed by the prover, the verifier can never obtain any information about the polynomial. And, it consists of four algorithms: parameter generation algorithm KeyGen(), commitment algorithm Co(), opening algorithm Open(), verification algorithm Verify(), and its usage process is: let the prover generate a commitment com by calling the commitment algorithm Commit() on a polynomial f. f Submit it to the verifier, and then when necessary, commit to com f The open algorithm is called to calculate the value f(t) of the polynomial f at the point t specified by the verifier, as well as a proof π used to prove the correctness of the calculation result. The verifier calls the verification algorithm Verify() on the proof π to check the correctness of the calculation result. In particular, a zkPC scheme that meets the above definition was proposed in the 2018 S&P conference. The scheme is based on the discrete logarithm problem, with a proof complexity of O(n), a verification complexity of 0.0000, and a communication complexity of 0.00000. The zkPC mentioned in this embodiment refers to the solution in this paper.

[0103] S1-15. Use vector T as input vector, use arithmetic circuit C to perform operation, and calculate output result Y.

[0104] S1-2. The prover uses the hash function to simulate the behavior of the verifier and independently executes the layer-by-layer proof algorithm for the process of "the neural network model calculates the output result Y", which is described in detail as follows.

[0105] S1-21. According to the definition formula of multivariable linear expansion (MLE), subcircuit C j The only conductor X of the output layer d =y j Defined as

[0106] It should be noted that in the prior art, multivariate linear extension (MLE) is a polynomial definition method, which inputs a multivariate function with l variables. The output is another multivariable function “Extension” indicates that the domain of each input variable of function g is extended from {0, 1} to the domain This ensures that the reliability of the protocol can be met when the summation check protocol is used on the function G. While expanding the function domain, this method requires that the output value of the function G at any point on the domain of the original function g remains unchanged, that is: The multivariable linear expansion G of the function g is as follows:

[0107]

[0108] Among them, b i Refers to the i-th bit of the input binary string b of function g, that is, b=(b 1 , b 2 , ..., b l ). This definition can be understood as follows: the function G is composed of 2 l The sum of the terms is A·B, where A is the term represented by the product symbol and B is g(b). 1 , x 2 , ..., x l ), if x∈{0,1} l , then G's 2 l Among the terms, only the one with b=x satisfies A=1 and B=g(b). l In the -1 term, since b≠x, A=0, so G(x)=g(x) is finally satisfied. In this embodiment, when using multivariate linear expansion (MLE), there will be a horizontal line mark above the symbol. For example, the multivariate linear expansion of function V is recorded as

[0109] S1-22. The prover uses the hash function to select a random number r d , the random number r dRecorded in the proof π, calculated according to the definition formula of multivariate linear extension (MLE)

[0110] It should be noted that zero-knowledge proof ZK often requires the prover and verifier to interactively complete the proof in multiple rounds of communication; while the so-called non-interactive NIZK is that the prover uses a hash function to simulate the interactive behavior of the verifier (the verifier is originally only responsible for providing random numbers), thereby allowing the prover to complete the proof independently, which is also the key technical point of this step.

[0111] S1-23, for numerical values Starting from i=d until i=2, the zk-sumcheck protocol is repeatedly called for the following summation formula, thereby reducing the correctness of the value at layer i=d to the correctness of the value at layer i=0 layer by layer:

[0112]

[0113] In the formula, X represents the output value of a certain layer of neurons, that is, the input vector of the neural network model; W represents the weight parameter, that is, the neuron weight layer vector of the neural network model; i represents any layer, and 1≤i≤d; i-1 represents that the input wire x or y of the operation gate comes from the adjacent layer; W i-1 Essentially, it is a part of the input vector T, which is the part of the W field of the vector T = (X, W, aux, 0) that is used in the i-1 layer; x and y respectively represent the first input wire and the second input wire of the operation gate in their source layer; z represents the output wire of the operation gate in the i-th layer.

[0114] Specifically, this is a matrix operation formula, indicating that the xth row and yth column of the output matrix X of the i-th layer is obtained by the summation formula on the right, that is, traversing all z, summing the product of the value of the xth row and zth column of the output matrix X of the i-1th layer and the value of the zth row and yth column of the neuron weight matrix W of the i-1th layer. This step is important for confirming the correctness of the Y calculation process. The final test is completed by checking the value of the input layer after reducing to i=1.

[0115] Furthermore, when constructing the arithmetic circuit C corresponding to the neural network model, if a certain layer of the neural network model is a fully connected layer, the weight values ​​of the neurons in this layer are placed in W, then The correctness of and Similarly, if a layer of the neural network model is an activation function and a pooling layer, the auxiliary parameters required for the pooling operation are placed in aux, then The correctness of and The correctness of these two values.

[0116] In this way, after using the zk-sumcheck protocol layer by layer through the above formula, the correctness will be reduced to certain wire values ​​in the middle layer of the arithmetic circuit C. Each layer will have two values, and the d layer will have a total of 2d values. When the zk-sumcheck protocol is subsequently used on the formula of step S5-1, the correctness of these 2d values ​​will be reduced to the correctness of a value in the input layer of the arithmetic circuit C. In this way, step S5 only needs to check the remaining value (i.e., the "one value of the input layer" in step S5-1). ”) for inspection, thus reducing the cost of subsequent verification.

[0117] S1-3. Finally, proof π is generated. The details are as follows.

[0118] In specific implementation, according to the output result Y, the proof π will have the following two situations:

[0119] Case 1: If the output result Y of the arithmetic circuit C in the output layer is a single value, it only needs to be executed once according to the process of the zkCNN protocol to complete the proof, thereby outputting the proof π and recording the random number r in the proof π.

[0120] Case 2: If the output result Y of the arithmetic circuit C in the output layer is a vector of length n, let Y = (y 1 ,y 2 , ..., y n ), then the arithmetic circuit C is divided into corresponding n subcircuits according to the output layer, that is, C = (C 1 , C 2 , ..., C n ), the corresponding relationship is C j (X, W, aux) = y j , where j refers to the jth circuit and j∈[1,n]. Any subcircuit C j The output result y j It is still a single value, and the proof can still be generated according to the process of the zkCNN protocol, but it needs to be executed n times in total to generate the proof π=(π 1 , π 2 , ..., π n ), and record the random number r into the proof π.

[0121] It should be noted that the explanation of the vector proof idea is: the neural network whose output result is a vector and the neural network whose output result is a numerical value can have similar structures, and the corresponding arithmetic circuits can often be divided into multiple sub-circuits, and the output of each sub-circuit is a component in the final output vector. Since the zkCNN protocol cannot start from an entire vector and can only generate a proof from a single numerical value, the zkCNN protocol is called once for each component in the vector in sequence, and the verifier only needs to check the proof string in sequence. Since the circuit architecture is open to the verifier, the prover cannot cheat in the order of proof. For example, given the vector Y=(y 1 ,y 2 , ..., y n ), vector Y′=(y 2 ,y 1 , ..., y n ), and a valid proof corresponding to the vector Yπ=(π 1 , π 2 , ..., π n ), where vector Y becomes vector Y′ after exchanging the first two components. Based on the above explanation, it is proved that π is only valid for vector Y but not for vector Y′.

[0122] It should be noted that if Figure 4 As shown, this step S1 adopts the zkCNN protocol in the circuit preparation, commitment input, and layer-by-layer proof. The commitment input also adopts the zkPC protocol, and the layer-by-layer proof also adopts the zk-sumcheck protocol.

[0123] In the prior art, the zero-knowledge sum check protocol (zk-sumcheck) is a zero-knowledge version constructed on the basis of the sum check protocol (sumcheck), and while completing the original proof goal, it does not disclose the function numerical information in the calculation process. The specific process is as follows:

[0124] (a) P randomly selects a polynomial g(x 1 , ..., x l )=a 0 +g 1 (x 1 )+g 2 (x 2 )+…+g l (x l ), where g i (x i )=a i，1 x i +a i，2 x i 2 +…+ai，t x i t , and all coefficients a i，j They are all selected uniformly at random.

[0125] (b) P calculates the sum of polynomial f to be H, calculates the sum of polynomial g to be G, and then makes a commitment to polynomial g to obtain com g =zkPC.Commit(g, r g , pp), and H, G and com g Send to V.

[0126] (c) V randomly selects a coefficient Calculate the value H+ρG and then send ρ to P.

[0127] (d) P and V call the sumcheck protocol on the following formula:

[0128]

[0129] In the last round of the sumcheck protocol, P sends V an equation h to be verified l (r l )=f(r 1 , r 2 , ..., r l )+ρg(r 1 , r 2 , ..., r l ). P publishes the polynomial g at a random point r = (r 1 , r 2 , ..., r l ) value g(r 1 , r 2 , ..., r l ), and then V confirms the correctness of this value through the verification algorithm of the commitment protocol. If it fails to pass the verification, V refuses to accept the proposition and terminates the protocol.

[0130] (e) V calculation h l (r l )-ρg(r 1 , r 2 , ..., r l ), and then compare it with the value f(r 1 , r 2 , ..., r l ) for comparison: if they are equal, accept the proposition; otherwise reject the proposition.

[0131] It can be seen that the main body of the above process is the zkCNN protocol described in the form of interactive proof. When it is converted into a non-interactive proof, the verifier will no longer participate in the protocol interaction. Therefore, for all random numbers that need to be given by the verifier, they are changed to be obtained by the prover using a hash function alone, that is, the prover executes Hash(a)=r, and then records the input and output of the hash function (a, r) ​​into the final proof π, and uses it as part of the final proof. In other words, the above proof process is completed by the prover alone, and the verifier does not actually participate. The verifier only performs actual verification in step S5. In addition, the final proof π consists of two parts in total. The first part is these random numbers, and the second part is the value that originally needs to be sent to the verifier in the interactive protocol. Therefore, in step S5, after receiving the proof π, the verifier, in addition to verifying the equation that originally needs to be verified by the verifier, also needs to verify whether these random numbers are given by the hash function, that is, whether Hash(a)=r is satisfied.

[0132] S2. Submit proof: Based on the proof π of the output result Y generated in step S1, the prover generates a record A 1 =(Hash(Y), Hash(π), ProverID, Time), where Hash represents the hash function, ProverID represents the prover's ID, and Time represents the time; then record A 1 Sent to the blockchain, and record the block number as λ.

[0133] S3. Add records and present proof π: Blockchain adds record A 1 , and record A 1 Sent to the verifier, and the prover sends the proof π about the output result Y to the verifier.

[0134] (ii) Verification phase, including: S4, uniqueness verification; S5, verification proof π, as described in detail below.

[0135] S4. Verify uniqueness: The verifier checks the record A of the blockchain. 1 Execute the uniqueness verification algorithm to determine whether to believe that the prover corresponding to ProverID is indeed the first person to calculate the proof of π.

[0136] In specific implementation, the verifier executes the verification uniqueness algorithm verify(A 1 ) to perform the inspection operation, which is divided into the following two steps:

[0137] S4-1. The verifier checks whether record A actually exists on the block numbered λ 1 If record A exists 1 , then proceed to the next step.

[0138] S4-2. The verifier checks whether there is such a record A in the block numbered less than or equal to λ in the blockchain. 2 =(Hash(Y), Hash(π), xID, xTime), where xID≠ProverID and xTime<Time. If no record A exists 2 , then the output is verify(A 1 )=1, indicating that the person corresponding to ProverID is indeed the first person to calculate and prove π.

[0139] The above-mentioned uniqueness verification algorithm can ensure that any thief cannot commit fraud by stealing proof π, because the thief's identity is not supported by valid records on the blockchain.

[0140] S5. Verify proof π: Figure 4 As shown in the figure, this step mainly adopts the zkCNN protocol. The verifier is responsible for the zero-knowledge proof π or π=(π 1 , π 2 , ..., π n ) executes the verification and proof algorithm to determine whether the prover's proof of ownership of vector Y can be trusted.

[0141] It should be noted that, in essence, the prover's layer-by-layer proof in step S1 has simulated the verifier's completion of the verification algorithm for zero-knowledge proof π in step S5. The verifier only checks the verification process published by the prover in step S5.

[0142] In specific implementation, the verification and proof algorithm includes the following steps:

[0143] S5-1. For the following summation formula, call the zk-sumcheck protocol to let the verifier confirm the correctness of the calculation process. The zk-sumcheck protocol will specify the variable z as a random number vector, which will be used later with r a Represents the random number vector:

[0144]

[0145]

[0146] Specifically, the reduction process will result in two values ​​to be checked at each layer, where Represents the first value of the i-th layer; represents the second value of the i-th layer; r i,0 and r i，1 is a random number used to combine these values ​​into a random linear combination; represents the zth wire of the input layer, which means that we only need to check the correctness of the value of this wire in the input layer; C i (z i，0 , z) is a function that either outputs 0 or 1 if and only if z i，0 = z, outputs 1, and outputs 0 otherwise.

[0147] Therefore, the The value of (when i∈[2, d], Either Either When i = 1, then yes ) is reduced to a value in the input layer , which will The z in the brackets is finally locked into a random number vector and represented as r a In this way, the correctness of the 2d values ​​obtained in step S1-32 is reduced to the correctness of a value of the input layer of the arithmetic circuit C, and only this value needs to be checked later, which reduces the cost of subsequent verification.

[0148] S5-2. The verifier generates a random number vector r a =(r 1 , r 2 , ..., r log , r 1+log , r 2+logN ), the length of the random number vector is 2+logN. Then, the random number vector r is trimmed a The last two components of , thus obtaining a shorter random number vector r b =(r 1 , r 2 , ..., r logN ), the length of the random number vector is logN.

[0149] S5-3. The verifier cooperates with the prover to use the random number vector r b Open the commitment polynomial com with the random number r used in the previous commitment, that is, zkPC.open(com, r, r b ), thus obtaining and The value of .

[0150] S5-4. The verifier completes the final check according to the following formula:

[0151]

[0152] If the equation holds, verify(π)=1 is output.

[0153] In the formula, r a is the random number vector used in step S5-2 (the vector length is 2+logN), and the source of the random number vector is the summation formula used in step S5-1 The final value of z in r b is the random number vector of step S5-2 (the vector length is 2+logN); It is the MLE (multivariable linear extension, which can be understood as a polynomial) defined by the input vector of the arithmetic circuit C; It is the MLE defined by the three different fields that make up the input vector T. The three fields are the output value X of a neuron in a certain layer of the neural network model, the weight parameter W (that is, the neuron weight vector of the neural network model), and the auxiliary parameter aux used to implement the pooling operation in the arithmetic circuit C.

[0154] S5-5. If for all j∈[1,n] there is verify(π j )=1, and verify(A 1 )=1, then the verifier can trust the prover’s statement, that is, “the output result Y is indeed generated by the prover’s private neural network (with weight parameter W and arithmetic circuit C)”.

[0155] In summary, the technical effects of the method of the present invention are summarized as follows: the prover generates a proof π about the value Y calculated by the neural network model (or a proof π about the vector Y) in a non-interactive way, and then generates a record A about the proof π 1 And submit it to the blockchain. When the verifier performs verification, if verify(π)=1 and verify(A 1 )=1, the verifier can trust the prover’s proof of ownership of the output result Y.

[0156] In other embodiments, the method of the present invention can use an authority instead of a blockchain to store records related to π. Specifically, whenever the prover calculates a property certificate π for the output result Y, it always generates a record A for it as soon as possible. 1 =(Hash(Y), Hash(π), ProverID, Time), and record A 1 The verifier also queries the authority for relevant records. In this alternative, before registering any record, the authority first needs to check the previously stored record table to see if there is such a record A. 2=(Hash(Y), Hash(π), xID, xTime), where xID≠ProverID and xTime<Time. If no such record exists, record A 1 In the previous embodiment, this verification step was undertaken by the verifier, but now it is undertaken by the authority.

[0157] Embodiment 2: Neural network output result property rights certification system based on zero-knowledge proof and blockchain.

[0158] like Figure 5 As shown, this embodiment provides a neural network output result property rights certification system based on zero-knowledge proof and blockchain, including a proof generation π module, a proof submission module, a record addition and proof presentation π module, a uniqueness verification module, and a proof verification π module, which are specifically introduced as follows.

[0159] The module for generating proof π is used for the process of calculating the output result Y for the neural network model. The prover uses the hash function to simulate the behavior of the verifier, independently executes the layer-by-layer proof algorithm, and finally generates proof π.

[0160] The submission proof module is used by the prover to generate record A 1 =(Hash(Y), Hash(π), ProverID, Time), then record A 1 Sent to the blockchain, and the block number is recorded as λ.

[0161] The module for adding records and presenting proofs is used to add records to the blockchain. 1 , and record A 1 Send it to the verifier, and the prover sends the proof π to the verifier.

[0162] The verification uniqueness module is used by the verifier to verify the uniqueness of the record A. 1 Execute the uniqueness verification algorithm to determine whether to believe that the prover corresponding to ProverID is indeed the first person to generate proof π.

[0163] The verification proof π module is used for the verifier to execute the verification proof algorithm for the components in the proof π to determine whether to believe the prover's proof π about the output result Y.

[0164] Embodiment 3: A property rights certification device based on the output result of a neural network and zero-knowledge proof and blockchain.

[0165] like Figure 6As shown, this embodiment provides a device for proving the property rights of a neural network output result based on zero-knowledge proof and blockchain, comprising at least one processor; and a memory electrically connected to at least one of the processors; wherein the memory stores instructions executable by the processor; the instructions are used to be executed by the processor to implement the method for proving the property rights of a neural network output result based on zero-knowledge proof and blockchain.

[0166] The processor may be a central processing unit (CPu) or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the device to perform desired functions.

[0167] The memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor may execute the instructions to implement the methods of the various embodiments described above and / or the functions of the system thereof.

[0168] The instructions are computer program codes written in one or more programming languages ​​or a combination thereof for performing the operations of the present application, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server.

[0169] In addition, the block diagrams of the systems and devices to which the present invention relates are only illustrative examples, and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these systems and devices can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, meaning "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The word "such as" used here refers to the phrase "such as but not limited to", and can be used interchangeably with it.

[0170] Furthermore, it should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0171] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A method for proving property rights of a neural network output result, characterized in that: include: S1. Calculate the output result based on the neural network model In this process, the prover uses hash functions to simulate the behavior of the verifier, independently executes the layer-by-layer proof algorithm, and finally generates a proof. ; In step S1, the neural network model calculates the output result ,include: S1-11. Construct the arithmetic circuit corresponding to the neural network model ; S1-12, the arithmetic circuit All parameters of the input layer are converted into integers through quantization formula or fixed-point representation; S1-13. Count the output values ​​of neurons in a certain layer respectively , weight parameter , auxiliary parameters The length of the three fields, the length of the longest field is , use 0 to fill the length of the other two fields to , and use the length The string of 0s is used as the fourth field, and then the four fields are concatenated into a length of Vector ; S1-14. The prover uses a hash function to select a random number , using zero-knowledge polynomial commitments and random numbers Pair Vector Make a promise, through , we get the commitment polynomial ; S1-15, vector As input vector, using arithmetic circuit Calculate and get the output result ; In step S1, the final generated proof ,include: If the arithmetic circuit Output results at the output layer Is a single value, then generate a proof , and the random number Record to prove among; If the arithmetic circuit Output results at the output layer Is the length The vector of , the arithmetic circuit According to the output layer, it is divided into corresponding sub-circuit, then , the corresponding relationship is ,in , thus generating a proof , and the random number Record to prove among them, Refers to the indivual; is any subcircuit, Any subcircuit The output result of S2. The prover generates records , then record Sent to the blockchain and record the block number it is in as ;in, represents a hash function, On behalf of the certifier , Represents time; S3, blockchain adding records , and record Sent to the verifier, and the prover will prove Send to the validator; S4. Verifier records Execute the uniqueness check algorithm to determine whether to trust The corresponding prover is indeed the first to generate the proof people; S5. The verifier proves Execute the verification algorithm to determine whether to trust the prover's output results Proof .

2. A method for proving property rights of a neural network output result according to claim 1, characterized in that: In step S1-11, the arithmetic circuit corresponding to the neural network model is constructed ,include: Assuming arithmetic circuit Total Layer, the formula is as follows: ； ； ； ； ； ； In the formula, represents an addition gate, represents a multiplication gate; represents any layer, and , represents the input layer, represents the output layer; Represents the input wire of the operation gate or from adjacent layers; Represents the input wire of the operation gate or From the input layer; For the Layer wires; The output wire of the arithmetic gate is The number of wires in the layer; and Respectively indicate the wire numbers of the first input wire and the second input wire of the operation gate in their source layers; For the The total number of wires in the layer, is the total number of wires in the input layer.

3. A method for proving property rights of a neural network output result according to claim 2, characterized in that: In step S1, the prover uses a hash function to simulate the behavior of the verifier and independently executes a layer-by-layer proof algorithm, including: S1-21, according to multivariable linear expansion , the subcircuit The only wire in the output layer Defined as ;in, It is a subcircuit The original representation of the only wire of the output layer, where Indicates that this is the The wires of the layer, is the specific value calculated for this wire, It is using multivariate linear expansion In the case of , it indicates the value of this wire; S1-22. The prover uses a hash function to select a random number , the random number Record to prove Among them, according to the multivariate linear expansion The definition formula for calculating ; 1-23, for numerical values ,from Start until , repeatedly call the following summation formula Agreement, the The correctness of the layer value The correctness of the layer values ​​is reduced layer by layer: ； In the formula, Represents the output value of a certain layer of neurons; represents the weight parameter; represents any layer, and ; Represents the input wire of the operation gate or from adjacent layers; and Respectively indicate the wire numbers of the first input wire and the second input wire of the operation gate in their source layers; The output wire of the arithmetic gate is The first few wires of the layer.

4. A method for proving property rights of a neural network output result according to claim 1, characterized in that: The step S4 comprises: S4-1. Verifier check number is Is there a real record on the block? ; If the record exists , then proceed to the next step; S4-2. Verifier checks that the number is less than or equal to Is there a record on the block? ,in, ≠ and ; If no record exists , then the output ,show The corresponding prover is indeed the first to generate the proof person.

5. A method for proving property rights of a neural network output result according to claim 4, characterized in that: The step S5 comprises: S5-1, call the following summation formula The protocol will come from each layer The correctness of the value is reduced to a value in the input layer On, thus Finally locked into a random number vector : ； ； In the formula, Indicates the first The first value that the layer needs to check; Indicates the first The second value that the layer needs to check; and Represents a random number; The input layer wires; Represents a function that outputs 0 or 1; S5-2. The verifier generates a random number vector , the length of the random number vector is ; Then clip the random number vector The last two components of the random number vector , the length of the random number vector is ; S5-3. The verifier uses the random number vector and random numbers Open Commitment Polynomial ,go through ,get , and The value of S5-4. The verifier completes the final check according to the following formula: ； ； ； In the formula, Represents an arithmetic circuit The input vector is defined by ; , , Represents the output value of a neuron in a certain layer , weight parameter , auxiliary parameters Separately defined ; represents a random number vector; represents a random number vector; If this equation holds, then the output is ; S5-5. For all Both ,at the same time , then the verifier can trust the prover's statement and output the result It is indeed generated by a neural network model private to the prover.

6. A neural network output result property rights certification system, characterized in that: Including generating proof Module, Submit Proof Module, Add Record and Present Proof Module, check uniqueness module, verify proof Modules; The generated proof Module, used to calculate the output results for the neural network model In this process, the prover uses hash functions to simulate the behavior of the verifier, independently executes the layer-by-layer proof algorithm, and finally generates a proof. ; The neural network model calculates the output result ,include: S1-11. Construct the arithmetic circuit corresponding to the neural network model ; S1-12, the arithmetic circuit All parameters of the input layer are converted into integers through quantization formula or fixed-point representation; S1-13. Count the output values ​​of neurons in a certain layer respectively , weight parameter , auxiliary parameters The length of the three fields, the length of the longest field is , use 0 to fill the length of the other two fields to , and use the length The string of 0s is used as the fourth field, and then the four fields are concatenated into a length of Vector ; S1-14. The prover uses a hash function to select a random number , using zero-knowledge polynomial commitments and random numbers Pair Vector Make a promise, through , we get the commitment polynomial ; S1-15, vector As input vector, using arithmetic circuit Calculate and get the output result ; Among them, the final generation proof ,include: If the arithmetic circuit Output results at the output layer Is a single value, then generate a proof , and the random number Record to prove among; If the arithmetic circuit Output results at the output layer Is the length The vector of , the arithmetic circuit According to the output layer, it is divided into corresponding subcircuit, that is , the corresponding relationship is ,in , thus generating a proof , and the random number Record to prove among them, Refers to the indivual; is any subcircuit, Any subcircuit The output result of The submission proof module is used by the prover to generate records , then record Sent to the blockchain and record the block number it is in as ;in, represents a hash function, On behalf of the certifier , Represents time; Adding records and producing proof Module for adding records to blockchain , and record Send it to the verifier, and the prover will prove Send to the validator; The verification uniqueness module is used by the verifier to verify the records of the blockchain Execute the uniqueness check algorithm to determine whether to trust The corresponding prover is indeed the first to generate the proof people; The verification proves Module for verifiers to prove The components in it execute the verification and proof algorithm to determine whether to trust the prover's output results Proof .

7. A neural network output result property rights certification device, characterized in that: comprising at least one processor; and a memory connected to at least one of the processors; wherein, The memory stores instructions executable by the processor; The instructions are used to be executed by the processor to implement a method for proving the ownership of a neural network output result as described in any one of claims 1 to 5.

Images