A privacy protection method, device, system and medium for artificial intelligence model

Abstract

The present invention discloses a privacy protection method, device, system and medium for an artificial intelligence model, including: obtaining model parameters and input data, inputting the model parameters and input data into a trusted execution environment, the model parameters including weight parameters or bias parameters, taking each layer of the artificial intelligence model as the current layer in turn, if the current layer is a layer requiring matrix multiplication, obtaining an encrypted data matrix collection according to the multiplication left matrix and the multiplication right matrix of the current layer, transmitting the encrypted data matrix collection to an untrusted execution environment, obtaining an intermediate result collection, returning the intermediate result collection to the trusted execution environment, obtaining the output data of the current layer, the multiplication right matrix of the first layer is the input data, if the current layer is a layer not requiring a multiplication matrix, obtaining the output data of the current layer according to the output data of the previous layer, and taking the output data of the last layer as the query result. The present invention can improve the speed and accuracy of model reasoning and can be applied to the field of artificial intelligence technology.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a privacy protection method, device, system and medium for an artificial intelligence model. Background Art

[0002] The success of artificial intelligence models depends on their billions or even trillions of parameters and their core attention mechanisms, such as large language models (LLM). However, studies have shown that the reasoning of artificial intelligence models is vulnerable to attacks.

[0003] Although existing technologies have proposed various AI model protection methods, such as secure multi-party computing, homomorphic encryption, differential privacy, etc., the reasoning performance of AI models has been severely damaged, and these protection methods have reduced the reasoning speed and accuracy of AI models. Summary of the invention

[0004] In order to solve the above problems, the purpose of the present invention is to provide a privacy protection method, device, system and medium for an artificial intelligence model. Compared with the existing privacy-protecting artificial intelligence models, the present invention can improve the speed and accuracy of reasoning.

[0005] On the one hand, the present invention provides a privacy protection method for an artificial intelligence model, which is applied to a server, wherein the server includes a trusted execution environment and an untrusted execution environment, and comprises the following steps:

[0006] Obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into the trusted execution environment, and sequentially use each layer of the artificial intelligence model as the current layer; the model parameters include weight parameters or bias parameters of each layer; the artificial intelligence model includes layers requiring matrix multiplication and layers not requiring matrix multiplication;

[0007] If the current layer is a layer that requires matrix multiplication, in the trusted execution environment, according to the left multiplication matrix of the current layer and the right multiplication matrix of the current layer, an encrypted data matrix collection is obtained; the encrypted data matrix collection is transmitted to the untrusted execution environment to obtain an intermediate result collection; the intermediate result collection is returned to the trusted execution environment to obtain the output data of the current layer; the left multiplication matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the right multiplication matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the right multiplication matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0;

[0008] If the current layer is a layer that does not require a multiplication matrix, in the trusted execution environment, output data of the current layer is obtained according to output data of a previous layer;

[0009] The output data of the last layer is used as the query result.

[0010] Optionally, in the trusted execution environment, obtaining an encrypted data matrix collection according to a left multiplication matrix of a current layer and a right multiplication matrix of a current layer specifically includes:

[0011] If a first instruction is obtained, the trusted execution environment randomly generates a random encryption matrix; the first instruction indicates that the data to be protected is the input data;

[0012] The multiplication right matrix of the current layer is first encrypted according to the random encryption matrix to obtain an encrypted data matrix collection; the multiplication right matrix of the current layer is the output data of the previous layer, and the encrypted data matrix collection includes the first encrypted right matrix and the multiplication left matrix of the current layer.

[0013] Optionally, in the trusted execution environment, obtaining an encrypted data matrix collection according to a left multiplication matrix of a current layer and a right multiplication matrix of a current layer specifically includes:

[0014] If the second instruction is obtained, the trusted execution environment performs a second encryption on the left multiplication matrix and the right multiplication matrix of the current layer, and performs a third encryption on the right multiplication matrix of the current layer to obtain the encrypted data matrix collection; the second instruction indicates that the data to be protected is the left multiplication matrix and the right multiplication matrix.

[0015] Optionally, the encrypted data matrix collection includes a second encrypted left and right matrix subset, a third encrypted right matrix subset, a blinded left matrix key subset, and a blinded right matrix key subset; the trusted execution environment performs a second encryption on the multiplication left matrix and the multiplication right matrix of the current layer, and performs a third encryption on the multiplication right matrix of the current layer to obtain the encrypted data matrix collection, specifically including:

[0016] The trusted execution environment randomly generates a first random matrix collection of the multiplication left matrix and a second random matrix collection of the multiplication right matrix;

[0017] Using the first random matrix collection, the second encryption is performed on the left multiplication matrix and the right multiplication matrix respectively to obtain the second encrypted left and right matrix subsets; performing a first transformation according to the first random matrix collection to obtain a multiplication blinded left matrix key subset;

[0018] The multiplication right matrix is ​​encrypted for the third time using the second random matrix collection to obtain the third encrypted right matrix subset; and a second transformation is performed according to the first random matrix collection and the second random matrix collection to obtain a blinded right matrix key subset.

[0019] Optionally, the intermediate result collection includes an intermediate subset of a left multiplication matrix and an intermediate subset of a right multiplication matrix; and transmitting the encrypted data matrix collection to an untrusted execution environment to obtain the intermediate result collection specifically includes:

[0020] Performing a first matrix multiplication on the second encrypted left and right matrix subsets and the multiplication blinded left matrix key subset to obtain a multiplication left matrix intermediate subset;

[0021] A second matrix multiplication is performed on the third encrypted right matrix subset and the blinded right matrix key subset to obtain a multiplied right matrix intermediate subset.

[0022] Optionally, returning the intermediate result set to the trusted execution environment to obtain output data of the current layer specifically includes:

[0023] If the current layer is the first multiplication matrix layer, a first decryption is performed according to the intermediate result set to obtain a matrix multiplication result; output data of the current layer is obtained according to the matrix multiplication result and the bias parameter; the first multiplication matrix layer needs to perform matrix multiplication and add a linear bias;

[0024] If the current layer is a second multiplication matrix layer, a second decryption is performed according to the intermediate result set to obtain output data of the current layer; the second multiplication matrix layer requires matrix multiplication and no linear bias is required.

[0025] Optionally, if the current layer is a layer that does not require a multiplication matrix, in the trusted execution environment, obtaining output data of the current layer according to output data of a previous layer specifically includes:

[0026] The trusted execution environment substitutes the output data of the previous layer into a preset function to obtain the output data of the current layer; the preset function includes one or more of a normalization function, a nonlinear activation function, a residual function or a standardization function.

[0027] On the other hand, the present invention provides a privacy protection system for an artificial intelligence model, comprising a first module, a second module, a third module and a fourth module, wherein:

[0028] The first module is used to obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into the trusted execution environment, and sequentially use each layer of the artificial intelligence model as the current layer; the model parameters include weight parameters or bias parameters of each layer; the artificial intelligence model includes layers requiring matrix multiplication and layers not requiring matrix multiplication;

[0029] The second module is used for, if the current layer is a layer requiring matrix multiplication, in the trusted execution environment, obtaining an encrypted data matrix collection according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer; transmitting the encrypted data matrix collection to an untrusted execution environment to obtain an intermediate result collection; returning the intermediate result collection to the trusted execution environment to obtain output data of the current layer; the multiplication left matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the multiplication right matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the multiplication right matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0;

[0030] The third module is used for obtaining output data of the current layer according to output data of the previous layer in the trusted execution environment if the current layer is a layer that does not require a multiplication matrix;

[0031] The fourth module is used to use the output data of the last layer as the query result.

[0032] In another aspect, the present invention provides a privacy protection device for an artificial intelligence model, comprising:

[0033] At least one trusted execution environment and a memory of the trusted execution environment; the memory of the trusted execution environment is used to store at least one program;

[0034] At least one untrusted execution environment and a memory of the untrusted execution environment, wherein the memory of the untrusted execution environment is used to store at least one program;

[0035] When the program is executed by the trusted execution environment and the untrusted execution environment, the trusted execution environment and the untrusted execution environment implement the method described above.

[0036] In another aspect, the present invention provides a computer-readable storage medium storing a program executable by a processor. When the program executable by the processor is executed by the processor, it is used to perform the method as described above.

[0037] The implementation of the present invention includes the following beneficial effects: the present invention obtains the model parameters of the artificial intelligence model and the input data of the client, inputs the model parameters and the input data into the trusted execution environment, and sequentially uses each layer of the artificial intelligence model as the current layer; the model parameters include the weight parameters or bias parameters of each layer; the artificial intelligence model includes layers that require matrix multiplication and layers that do not require matrix multiplication; if the current layer is a layer that requires matrix multiplication, in the trusted execution environment, according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer, an encrypted data matrix collection is obtained; the encrypted data matrix collection is input into the untrusted execution environment to obtain an intermediate result Collection; return the collection of intermediate results to the trusted execution environment to obtain the output data of the current layer; the multiplication left matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the multiplication right matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the multiplication right matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, and N is a natural number greater than 0; if the current layer is a layer that does not require a multiplication matrix, in the trusted execution environment, the output data of the current layer is obtained according to the output data of the previous layer; the output data of the last layer is used as the query result. By shielding the data in the trusted execution environment, the privacy of the data input into the trusted execution environment can be protected. Outside the trusted execution environment, the encrypted data matrix collection obtained by shielding is subjected to matrix operation, and the result obtained by the matrix operation is then input into the trusted execution environment for decryption. The data that needs to be protected are all in the trusted execution environment, and the matrix multiplication process with a large amount of calculation is performed outside the trusted execution environment. Compared with the existing privacy-protecting artificial intelligence model, the present invention can improve the speed and accuracy of reasoning. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a flowchart of the steps of a privacy protection method for an artificial intelligence model;

[0039] Figure 2 It is a simplified diagram of the architecture of a large language model provided by the present invention;

[0040] Figure 3 is a simplified diagram of a Transformer layer provided by the present invention;

[0041] Figure 4 is a simplified diagram of an attention mechanism layer provided by the present invention;

[0042] Figure 5 It is a schematic diagram of an implementation environment of a privacy protection method for an artificial intelligence model provided by the present invention;

[0043] Figure 6 It is a structural schematic diagram of a privacy protection system for an artificial intelligence model provided by the present invention;

[0044] Figure 7 It is a structural schematic diagram of a privacy protection device for an artificial intelligence model provided by the present invention. DETAILED DESCRIPTION

[0045] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only provided for the convenience of explanation and description, and the order between the steps is not limited in any way. The execution order of each step in the embodiment can be adaptively adjusted according to the understanding of those skilled in the art.

[0046] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit the embodiments of the present application. The singular forms of "a", "said" and "the" used in the embodiments of the present application and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0047] When the following description relates to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. In the description of the present application, it is necessary to understand that the terms "first / S100", "second / S200", "third / S300", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to the specific circumstances.

[0048] like Figure 1 As shown, Figure 1 The invention provides a privacy protection method for an artificial intelligence model, which is applied to a server, wherein the server includes a trusted execution environment and an untrusted execution environment, and includes the following steps:

[0049] S100. Obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into a trusted execution environment, and take each layer of the artificial intelligence model as the current layer in turn.

[0050] Among them, the model parameters include weight parameters or bias parameters of each layer of the artificial intelligence neural network layer. The weight parameter can be but is not limited to a weight matrix used for matrix multiplication calculation, and the bias parameter can be but is not limited to a bias matrix used for matrix addition calculation. For example, for a linear layer, the model processes the input data X as Z=WX+bais, where Z is the output of the linear layer, W is the weight parameter, and bais is the bias parameter.

[0051] The artificial intelligence model includes layers that require matrix multiplication and layers that do not require matrix multiplication. The layers that require matrix multiplication include multiplication matrices, that is, there are multiplication calculations between matrices when processing data; the layers that do not require matrix multiplication do not include multiplication matrices, that is, there are no multiplication calculations between matrices when processing data.

[0052] S200a. If the current layer is a layer that requires matrix multiplication, in the trusted execution environment, according to the left multiplication matrix of the current layer and the right multiplication matrix of the current layer, an encrypted data matrix collection is obtained; the encrypted data matrix collection is transmitted to the untrusted execution environment to obtain an intermediate result collection; the intermediate result collection is returned to the trusted execution environment to obtain the output data of the current layer.

[0053] When the first layer is the current layer, the output data of the previous layer is the input data of the client.

[0054] Among them, Figure 2-4 As shown, Figure 2 This is a simplified diagram of the architecture of a large language model. Figure 3 is a simplified diagram of a Transformer layer. Figure 4 This is a simplified diagram of the attention mechanism layer. A large language model includes 30 Transformer layers and linear layers (Linear layer). The Transformer layer includes attention layers (Masked Multi-Head Attention layer and Multi-Head Attention layer), normalization layer (SoftMax layer), residual and standardization layer (Add&norm layer) and feedforward neural network layer (Feed Forword layer), etc. The attention layer includes several sublayers.

[0055] The left multiplication matrix of the current layer is the model parameters of the current layer or the output data of the previous layer. When all layers after the second layer are the current layer, the right multiplication matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0. Specifically, if the layer that requires matrix multiplication uses the model parameters to process the output data of the previous layer, the left multiplication matrix of the current layer is the model parameters of the current layer, and the right multiplication matrix of the current layer is the output data of the previous layer. For example, Q=W for a large language model q X, K = W k X、V=W v X-layer, W q , W k and W v are model parameters, all of which are multiplication left matrices, X is the output data of the previous layer, and is the multiplication right matrix.

[0056] If the layer that requires matrix multiplication uses the output data of two or more previous layers for processing, the left matrix of the current layer is the output data of the previous layer, and the right matrix of the current layer is the output data of the previous layer. For example, S = QK for a large language model T layer, Q is an output data of the previous layer (the multiplication left matrix of the current layer), and K is another output data of the previous layer (the multiplication right matrix of the current layer).

[0057] If the layer that needs matrix multiplication uses the output data of the previous layer and the output data of the previous Nth layer for processing, the left multiplication matrix of the current layer is the output data of the previous layer, and the right multiplication matrix of the current layer is the output data of the previous Nth layer. For example, Figure 4 As shown, O = TV layer of the large language model, T is the output data of T = Softmax (S) layer (O = the previous layer of TV layer), V is V = W v Output data of layer X (O = the third layer before layer TV). Wherein, when the first instruction is received, that is, the data to be protected is the input data of the client, when performing the first layer calculation, the encrypted data matrix collection may include, but is not limited to, the multiplication left matrix of the current layer and the first encrypted multiplication right matrix, when performing calculations after the first layer.

[0058] The untrusted execution environment may be an AI accelerator (AI Accelerator, AIA). The intermediate result collection includes but is not limited to a multiplication left matrix intermediate subset and a multiplication right matrix intermediate subset.

[0059] When the second instruction is received, that is, the data to be protected are model parameters and output data, the encrypted data matrix collection may include, but is not limited to, a second encrypted left and right matrix subset, a third encrypted right matrix subset, a blinded left matrix key subset, and a blinded right matrix key subset. Among them, the second encrypted left and right matrix subset may include, but is not limited to, at least one encrypted left matrix, and the blinded left matrix key subset may include, but is not limited to, at least one blinded left matrix key for auxiliary decryption; the third encrypted right matrix subset may include, but is not limited to, at least one encrypted right matrix, and the blinded right matrix key subset may include, but is not limited to, at least one blinded right matrix key for auxiliary decryption.

[0060] Specifically, the model parameters and input data are input into the trusted execution environment. In the artificial intelligence model, the output data of the previous layer or the output data of a previous layer is generally the input data of the current layer. The left multiplication matrix and the right multiplication matrix in the layer requiring matrix multiplication are determined. In the trusted execution environment, the type of data that needs to be protected is confirmed. If the data that needs to be protected is input data, the trusted execution environment performs a first encryption on the right multiplication matrix to obtain a collection of encrypted data matrices. When performing the first layer of calculations, there is no previous layer on the first layer. The input data of the client is the right multiplication matrix, and the model parameters are the left multiplication matrix.

[0061] If the data that needs to be protected is model parameters and input data, in the trusted execution environment, the trusted execution environment performs a second encryption on the left multiplication matrix and the right multiplication matrix of the current layer, and performs a third encryption on the right multiplication matrix of the current layer to obtain a collection of encrypted data matrices. Similarly, when performing the first layer of calculations, the first layer has no previous layer, the client's input data is the right multiplication matrix, and the model parameter is the left multiplication matrix.

[0062] If the data to be protected is input data, that is, client data to be protected, the untrusted execution environment obtains a collection of intermediate results of an intermediate subset of a multiplication left matrix based on the encrypted data matrix collection of step S200, wherein the intermediate subset of a multiplication right matrix of the intermediate result collection includes at least an intermediate right matrix.

[0063] If the data to be protected are model parameters and input data, the untrusted execution environment obtains an intermediate subset of the left multiplication matrix and an intermediate subset of the right multiplication matrix based on the encrypted data matrix collection of step S200, wherein the intermediate subset of the left multiplication matrix includes at least one intermediate left matrix, and the intermediate subset of the right multiplication matrix includes at least one intermediate right matrix.

[0064] If the current layer is the first multiplication matrix layer of the linear layer, the first decryption is performed according to the intermediate result set to obtain the matrix multiplication result, and the output data of the current layer is obtained according to the matrix multiplication result and the bias parameter. Among them, the first multiplication matrix layer needs to perform matrix multiplication and add a linear bias.

[0065] If the current layer is the second multiplication matrix layer, the second decryption is performed according to the intermediate result set to obtain the output data of the current layer. Among them, the second multiplication matrix layer needs to perform matrix multiplication and no linear bias is required.

[0066] S200b: If the current layer is a normalized layer, in the trusted execution environment, the output data of the current layer is obtained according to the output data of the previous layer.

[0067] Specifically, in the artificial intelligence model, for the normalization layer or activation layer, when performing reasoning, the multiplication calculation between the weight matrix of the artificial intelligence model and the input data is not considered. Therefore, the amount of calculation is small, and the input data can be directly input into the trusted execution environment to obtain the output data of the current layer.

[0068] S300: Use the output data of the last layer as the query result.

[0069] Finally, the output data of the last network layer obtained in the trusted execution environment is output to the client as the user's query result.

[0070] In some embodiments, in step S200a, obtaining the encrypted data matrix collection according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer in the trusted execution environment specifically includes:

[0071] S210a: If the first instruction is obtained, the trusted execution environment randomly generates a random encryption matrix.

[0072] The first instruction indicates that the data to be protected is input data.

[0073] Specifically, in a trusted execution environment, the model parameter of the current layer is A, the input data of the client is X, and the output data of the previous layer is B. If the first instruction is obtained, the data to be protected is the input data X, and the trusted execution environment generates a random encryption matrix F3 for the output data B of the previous layer.

[0074] S220a. Perform a first encryption on the multiplication right matrix of the current layer according to the random encryption matrix to obtain a collection of encrypted data matrices.

[0075] The multiplication right matrix of the current layer is the output data of the previous layer.

[0076] The encrypted data matrix collection includes the first encrypted right matrix and the multiplication left matrix A of the current layer.

[0077] Specifically, the multiplication right matrix B is first encrypted using the random encryption matrix F3 to obtain a collection of encrypted data matrices. As shown in formula (1), formula (1) is the encryption method:

[0078] B mask3 =B+F3 (1)

[0079] Among them, B mask3 It is the first encrypted multiplication right matrix in the encrypted data matrix collection.

[0080] If the data to be protected is input data X, according to this step, the untrusted execution environment may be an AIA accelerator, and step 300 specifically includes: inputting the encrypted data matrix collection into the untrusted execution environment, and the untrusted execution environment performs the multiplication based on the first encrypted right matrix B. mask3 The left matrix A of the multiplication of the current layer is obtained to obtain a collection of intermediate results. For example, an intermediate matrix in the collection of intermediate results can be AB mask3 , as shown in formula (2):

[0081] AB mask3 =A(B+F3) (2)

[0082] Among them, B and F3 on the right side of the equal sign are invisible, just to better illustrate the present invention, in an untrusted execution environment, directly calculate AB mask3 As an intermediate matrix in the collection of intermediate results.

[0083] At this time, step S400 may specifically include: calculating AF3 according to the left matrix A and F3 of the current layer, and combining AF3 with the intermediate matrix AB in the intermediate result set mask3 Substitute into the preset decryption formula (3) to obtain the output data c of the current layer:

[0084] C=AB mask3 -AF3=AB (3)

[0085] Among them, the C of each layer before the last layer is located in the trusted execution environment and is not output to the client. Only the C of the last layer is output to the client as the query result.

[0086] In some embodiments, in the trusted execution environment, step S200a, obtaining an encrypted data matrix collection according to a left multiplication matrix of a current layer and a right multiplication matrix of a current layer specifically includes:

[0087] S230a. If the second instruction is obtained, the trusted execution environment performs a second encryption on the left multiplication matrix and the right multiplication matrix of the current layer, and performs a third encryption on the right multiplication matrix of the current layer to obtain the encrypted data matrix collection.

[0088] The second instruction indicates that the data to be protected are model parameters and input data. The encrypted data matrix collection includes the second encrypted left and right matrix subsets, the third encrypted right matrix subset, the blinded left matrix key subset, and the blinded right matrix key subset.

[0089] Specifically, in a trusted execution environment, the left matrix of multiplication is A, the input data of the client is X, the right matrix of multiplication is B, and the data to be protected are the input data X and the model parameters.

[0090] The trusted execution environment generates a first random matrix set of the multiplication left matrix A. For example, the first random matrix set includes random matrices F1, β3, β4, Γ2 and ∑2, and β3 and β4 must satisfy the following conditions: for any j∈[0,n-1] and any i,i′∈[0,n-1], β3[i,j] / β3[i′,j]≠β4[i,j] / β4[i′,j]; Γ2 and Σ2 are random matrices pre-generated in the TEE and the elements in each column are the same. It should be noted that those skilled in the art can expand based on F1 and use C1+C2 The case where F1 is equivalently replaced by the sum of more matrices should also be protected by the present invention. The trusted execution environment generates a second random matrix collection of the multiplication right matrix B. For example, the second random matrix collection includes random matrices F2, β1, β2, Γ1 and ∑1, and β1 and β2 must satisfy the following conditions: for any i∈[0,n-1], and any j, j′∈[0,n-1], β1[i,j] / β1[i,j′]≠β2[i,j] / β2[i,j′]; Γ1 and ∑1 are random matrices pre-generated in the TEE and the elements in each row are the same.

[0091] The first random matrix set is used to perform a second encryption on the multiplication left matrix and the multiplication right matrix respectively, to obtain a second encrypted left and right matrix subset. Formula (4)-(5) is a specific encryption method:

[0092] A mask = A+F1 (4)

[0093] B mask2 =B+β3+β4 (5)

[0094] Among them, A mask is an encrypted left matrix in the second encrypted left and right matrix subset and B mask2 It is the encrypted right matrix in the second encrypted left and right matrix subset.

[0095] The first transformation is performed according to the first random matrix set to obtain a blinded left matrix key subset. Formula (6)-(7) is a specific embodiment of the first transformation:

[0096] β public3 =β3·Γ2 (6)

[0097] β public4 =β4·∑2 (7)

[0098] Among them, β public3 and β public4 are two blinded left matrix keys in the blinded left matrix key subset. It is worth noting that in a trusted execution environment, directly generating β public3 and β public4 Two random matrices as model parameter keys should also be within the scope of protection of the present invention.

[0099] The second random matrix set is used to perform a third encryption on the multiplication right matrix to obtain a third encrypted right matrix subset. Formula (8) is a specific implementation method of encryption:

[0100] B mask = B+F2 (8)

[0101] Among them, B mask is an encrypted right matrix in the third encrypted right matrix subset.

[0102] A second transformation is performed based on a random matrix in the first random matrix set and a second random matrix set to obtain a blinded right matrix key subset. Formula (9)-(11) is a specific embodiment of the second transformation:

[0103] F mask1 =F1+β1+β2 (9)

[0104] β public1 =Γ1·β1 (10)

[0105] β public2 =∑1·β2 (11)

[0106] Among them, F mask1 , β public1 and β public2 are three blinded right matrix keys in the blinded right matrix key subset.

[0107] In some embodiments, if the data to be protected are model parameters and input data, the intermediate result collection includes an intermediate subset of the multiplication left matrix and an intermediate subset of the multiplication right matrix; the step S200a of transmitting the encrypted data matrix collection to the untrusted execution environment to obtain the intermediate result collection specifically includes:

[0108] S240a, performing a first matrix multiplication on the second encrypted left and right matrix subsets and the blinded left matrix key subset to obtain a multiplied left matrix intermediate subset.

[0109] Specifically, if the second instruction is received, the data to be protected are the model parameters and input data of the current layer, and the multiplication left matrix middle subset is obtained according to the second encrypted left and right matrix subsets and the blinded left matrix key subset. See formulas (4)-(7), formulas (12)-(14) are a specific reasoning process:

[0110] A mask B mask2 =A mask (B+β3+β4) (12)

[0111] A mask β public3 =A mask β3·Γ2 (13)

[0112] A mask β public4 =A mask β4·∑2 (14)

[0113] The right side of the equal sign is invisible, and is only used to better illustrate the present invention. In an untrusted execution environment, A is directly calculated. mask B mask2 , A mask β public3 and A mask β public4 As three intermediate left matrices in the intermediate subset of the multiplication left matrices.

[0114] S250a, performing a second matrix multiplication on the third encrypted right matrix subset and the blinded right matrix key subset to obtain a multiplied right matrix intermediate subset.

[0115] Specifically, the second matrix multiplication is performed on the third encrypted right matrix subset and the blinded right matrix key subset to obtain the multiplication right matrix intermediate subset. See formula (8)-(11), formula (15)-(17) is a specific reasoning process:

[0116] F mask1 B mask =(F1+β1+β2)B mask (15)

[0117] β public1 B mask =Γ1·β1B mask (16)

[0118] βpublic2 B mask =∑1·β2B mask (17)

[0119] The right side of the equal sign is invisible, and is only used to better illustrate the present invention. In an untrusted execution environment, F is directly calculated. mask1 B mask , β public1 B mask and β public2 B mask As three intermediate right matrices in the intermediate subset of multiplication right matrices.

[0120] In some embodiments, returning the intermediate result set to the trusted execution environment to obtain output data of the current layer in step S200a specifically includes:

[0121] S260aa: If the current layer is the first multiplication matrix layer, perform a first decryption based on the intermediate result collection to obtain a matrix multiplication result, and obtain output data of the current layer based on the matrix multiplication result and the bias parameter.

[0122] The first multiplication matrix layer needs to perform matrix multiplication and add a linear bias. For example, the linear layer Z = WX + bais of a large language model.

[0123] If the current layer is the first multiplication matrix layer, and the data to be protected is only the input data, the process of decrypting the output data of the current layer is referred to the above formulas (4)-(5) to obtain C.

[0124] If the current layer is the first multiplication matrix layer, and the data to be protected are model parameters and input data, the first decryption is performed according to the multiplication left matrix intermediate subset to obtain the left matrix decryption intermediate result. Formulas (18)-(19) are a decryption process:

[0125]

[0126] Among them, A mask β3 and A mask β4 is the intermediate result of decryption of the two left matrices.

[0127] According to A mask β3, A mask β4 and A in the middle subset of the multiplication left matrix mask B mask2 Calculate. As shown in formula (20):

[0128] Res0=A mask B mask2 -A mask β3-A mask β4=Amask B (20)

[0129] Among them, A mask B is the decryption result of the left and right matrices.

[0130] The first decryption is performed according to the middle subset of the multiplication right matrix to obtain the middle result of the right matrix decryption. Formula (21)-(22) is a decryption process:

[0131]

[0132] Among them, β1B mask and β2B mask It is the intermediate result of decrypting the two right matrices.

[0133] According to β1B mask β2B mask And multiplication right matrix middle subset Γ mask1 B mask Continue to decrypt, as shown in formula (23):

[0134] Res1=F mask1 B mask -β1B mask -β2B mask =F1B mask (twenty three)

[0135] Among them, F1B mask is the decryption result of the right matrix.

[0136] Decrypt the left and right matrices to get the result A mask B and the right matrix decryption result F1B mask Substituting into the preset decryption formula, we get the matrix multiplication result C, as shown in formula (24):

[0137] C=AB=(A+F1)B-F1(B+F2)+F1F2=A mask B-F1B mask +F1F2 (24)

[0138] According to the structure of the first multiplication matrix layer, the matrix multiplication result C is added to the bias parameter to obtain the output data of the current layer.

[0139] For example, the calculation formula of a linear layer is as shown in formula (25):

[0140] Z=WX+bais (25)

[0141] Among them, Z is the output of the linear layer in the normal case, W is the weight matrix of the linear layer, and bais is the bias parameter.

[0142] Let W be the multiplication left matrix A, X be the multiplication right matrix B, perform the above calculations, and obtain the matrix multiplication result C. Finally, the output data of the linear layer = C + bais.

[0143] S260ab: If the current layer is the second multiplication matrix layer, perform a second decryption based on the intermediate result collection to obtain output data of the current layer.

[0144] Among them, the second multiplication matrix layer requires matrix multiplication and no linear bias is required.

[0145] Specifically, if the current layer is the second multiplication matrix layer, according to step S260aa, C is obtained as the output data of the current layer.

[0146] In some embodiments, if the layer that does not need a multiplication matrix in step S200b, in the trusted execution environment, obtains output data of the current layer according to output data of the previous layer, specifically including:

[0147] The trusted execution environment substitutes the output data of the previous layer into the preset function to obtain the output data of the current layer.

[0148] Among them, the preset function includes one or more of a normalization function, a nonlinear activation function, a residual function or a standardization function.

[0149] The layers that do not require multiplication matrices may be, but are not limited to, normalization layers, activation layers, residual layers, and standardization layers of the artificial intelligence model.

[0150] For example, the current layer is a normalization layer. In the trusted execution environment, the output data of the previous layer is S, including S i,j , j and i are both natural numbers greater than 0. The output data S of the previous layer is directly substituted into the preset normalization function to obtain the output data of the current layer, as shown in formula (26):

[0151]

[0152] in, Represents exponential operation.

[0153] In some embodiments, after the present invention inputs the model parameters and input data into the trusted execution environment at S100, it can also determine whether the first instruction or the second instruction is received. If the first instruction is received, S200b and processes related to S200b are executed, such as formulas (1)-(3). If the second instruction is received, step S200a and the subordinate steps of step S200a, including S210a-S260aa, S260ab, are executed.

[0154] If there are multiple matrix multiplications in a certain layer, for example, the output data of a certain layer C=AB+CD+EF has three matrix multiplications, then the privacy protection method of the aforementioned artificial intelligence model can be executed on each matrix multiplication separately. In the trusted execution environment, the decrypted results of each matrix multiplication are added together to obtain C.

[0155] like Figure 5 As shown, Figure 5 It is a schematic diagram of the implementation environment of the privacy protection method of an artificial intelligence model, including client A that uses the artificial intelligence model for query, client B that owns the artificial intelligence model, and the server. The server obtains the input data of client A from client A and the model parameters of artificial intelligence from client B, implements the privacy protection method of the artificial intelligence model described above, and returns the output data of the last layer to client A as the query result. In actual applications, if the data to be protected is the input data of client A, the output data of each layer is in the trusted execution environment, and the input data of client A is not known by client B; if the data to be protected is the input data of client A and the model parameters of client B, the output data of each layer and the parameters of the model are in the trusted execution environment, the parameters of the model are not known by client A, and the output data of each layer is not known by client B. The trusted execution environment has high confidentiality.

[0156] In some embodiments, the present invention applies a privacy protection method for an artificial intelligence model to a large language model. The structure of the large language model is as follows: Figure 2-4 shown.

[0157] In the large language model, for Q = W q X, K = W k X、V=W v X, S = QK T , O = TV, such as Q = W q X, W q As the multiplication left matrix A, X is the multiplication right matrix B, and according to the above-mentioned privacy protection method of an artificial intelligence model, the matrix multiplication result C is obtained as the output data of the current layer.

[0158] For a network layer where T=Softmax(S) does not require matrix multiplication, the output data of the current layer is obtained according to the calculation of the normalization layer in the privacy protection method of the above-mentioned artificial intelligence model.

[0159] For network layers that require matrix multiplication and also need to add a bias matrix, such as the Learn layer, it is necessary to perform matrix multiplication of model parameters and input data, and add a bias parameter to the network layer. According to the processing method of the linear layer in the privacy protection method of the above-mentioned artificial intelligence model, the output data of the linear layer is obtained.

[0160] The large language model is processed in sequence until the last layer, and the output data of the last network layer is output to the client as the query result.

[0161] The implementation of the present invention includes the following beneficial effects: the present invention shields data through a trusted execution environment to protect the privacy of data input into the trusted execution environment; outside the trusted execution environment, matrix operations are performed on the collection of encrypted data matrices obtained after shielding; and then the collection of intermediate results obtained by the matrix operations is input into the trusted execution environment for decryption; the data that needs to be protected are all in the trusted execution environment, while the computationally expensive reasoning process is performed outside the trusted execution environment; while protecting data privacy, the present invention can improve the reasoning speed and accuracy of the privacy protection artificial intelligence model.

[0162] During inference, the AIA accelerator is selected as the untrusted execution environment so that the user's data and data-related features are masked in the TEE. The masked data is sent to the AIA accelerator for matrix operations, which can further improve the inference speed of the privacy-preserving artificial intelligence model.

[0163] like Figure 6 As shown, Figure 6 The invention is a structural diagram of a privacy protection system for an artificial intelligence model. The invention also provides a privacy protection system for an artificial intelligence model, including a first module, a second module, a third module and a fourth module, wherein:

[0164] The first module is used to obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into the trusted execution environment, and sequentially use each layer of the artificial intelligence model as the current layer; the model parameters include weight parameters or bias parameters of each layer; the artificial intelligence model includes layers requiring matrix multiplication and layers not requiring matrix multiplication;

[0165] The second module is used for, if the current layer is a layer requiring matrix multiplication, in the trusted execution environment, obtaining an encrypted data matrix collection according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer; transmitting the encrypted data matrix collection to the untrusted execution environment to obtain an intermediate result collection; returning the intermediate result collection to the trusted execution environment to obtain the output data of the current layer; the multiplication left matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the multiplication right matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the multiplication right matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0;

[0166] The third module is used for obtaining output data of the current layer according to output data of the previous layer in the trusted execution environment if the current layer is a layer that does not require a multiplication matrix;

[0167] The fourth module is used to use the output data of the last layer as the query result.

[0168] Specifically, the first model is used to implement step S100 and its subordinate steps, the second model is used to implement step S200a and its subordinate steps, the third model is used to implement step S200b and its subordinate steps, and the fourth model is used to implement step S300.

[0169] It can be seen that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0170] like Figure 7 As shown, Figure 7 The present invention is a structural schematic diagram of a privacy protection device for an artificial intelligence model. The present invention also provides a privacy protection device for an artificial intelligence model, including:

[0171] At least one trusted execution environment and a memory of the trusted execution environment; the memory of the trusted execution environment is used to store at least one program;

[0172] At least one untrusted execution environment and a memory of the untrusted execution environment, wherein the memory of the untrusted execution environment is used to store at least one program;

[0173] When the program is executed by the trusted execution environment and the untrusted execution environment, the trusted execution environment and the untrusted execution environment implement the method described above.

[0174] Among them, the memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. The memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a remote memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0175] It can be seen that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0176] In addition, the embodiment of the present application also discloses a computer program product or a computer program, and the computer program product or the computer program is stored in a computer-readable storage medium. The processor of the computer device can read the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the above method. Similarly, the contents in the above method embodiment are all applicable to the storage medium embodiment, and the functions specifically implemented by the storage medium embodiment are the same as those in the above method embodiment, and the beneficial effects achieved are also the same as those achieved by the above method embodiment.

[0177] The present invention also provides a computer-readable storage medium, which stores a program executable by a processor. The program executable by the processor is used to implement the above method when executed by the processor.

[0178] It is understood that all or some steps and systems in the disclosed method above can be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, and the computer-readable medium can include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those of ordinary skill in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, magnetic tape, disk storage or other magnetic storage device, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0179] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0180] The above is a specific description of the preferred implementation of the present invention, but the invention is not limited to the embodiments. Those skilled in the art may make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A privacy protection method for an artificial intelligence model, characterized in that: Applied to a server, the server includes a trusted execution environment and an untrusted execution environment, including the following steps: Obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into the trusted execution environment, and sequentially use each layer of the artificial intelligence model as the current layer; the model parameters include weight parameters or bias parameters of each layer; the artificial intelligence model includes layers requiring matrix multiplication and layers not requiring matrix multiplication; If the current layer is a layer that requires matrix multiplication, in the trusted execution environment, according to the left multiplication matrix of the current layer and the right multiplication matrix of the current layer, an encrypted data matrix collection is obtained; the encrypted data matrix collection is transmitted to the untrusted execution environment to obtain an intermediate result collection; the intermediate result collection is returned to the trusted execution environment to obtain the output data of the current layer; the left multiplication matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the right multiplication matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the right multiplication matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0; If the current layer is a layer that does not require a multiplication matrix, in the trusted execution environment, output data of the current layer is obtained according to output data of a previous layer; The output data of the last layer is used as the query result; The step of returning the intermediate result collection to the trusted execution environment to obtain the output data of the current layer specifically includes: if the current layer is the first multiplication matrix layer, performing a first decryption according to the intermediate result collection to obtain a matrix multiplication result; obtaining the output data of the current layer according to the matrix multiplication result and the bias parameter; the first multiplication matrix layer needs to perform matrix multiplication and needs to add a linear bias; if the current layer is the second multiplication matrix layer, performing a second decryption according to the intermediate result collection to obtain the output data of the current layer; the second multiplication matrix layer needs to perform matrix multiplication and does not need to add a linear bias; In the trusted execution environment, obtaining an encrypted data matrix collection according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer specifically includes: If a first instruction is obtained, the trusted execution environment randomly generates a random encryption matrix; the first instruction indicates that the data to be protected is the input data; the multiplication right matrix of the current layer is first encrypted according to the random encryption matrix to obtain a collection of encrypted data matrices; the multiplication right matrix of the current layer is the output data of the previous layer, and the encrypted data matrix collection includes the first encrypted right matrix and the multiplication left matrix of the current layer; If the second instruction is obtained, the trusted execution environment performs a second encryption on the left multiplication matrix and the right multiplication matrix of the current layer, and performs a third encryption on the right multiplication matrix of the current layer to obtain the encrypted data matrix collection; the second instruction indicates that the data to be protected is the left multiplication matrix and the right multiplication matrix.

2. The method according to claim 1, characterized in that The encrypted data matrix collection includes a second encrypted left and right matrix subset, a third encrypted right matrix subset, a blinded left matrix key subset, and a blinded right matrix key subset; the trusted execution environment performs a second encryption on the multiplication left matrix and the multiplication right matrix of the current layer, and performs a third encryption on the multiplication right matrix of the current layer to obtain the encrypted data matrix collection, which specifically includes: The trusted execution environment randomly generates a first random matrix collection of the multiplication left matrix and a second random matrix collection of the multiplication right matrix; Using the first random matrix collection, the second encryption is performed on the left multiplication matrix and the right multiplication matrix respectively to obtain the second encrypted left and right matrix subsets; performing a first transformation according to the first random matrix collection to obtain a multiplication blinded left matrix key subset; The multiplication right matrix is ​​encrypted for the third time using the second random matrix collection to obtain the third encrypted right matrix subset; and a second transformation is performed according to the first random matrix collection and the second random matrix collection to obtain a multiplication blinded right matrix key subset.

3. The method according to claim 2, characterized in that The intermediate result set includes an intermediate subset of a left multiplication matrix and an intermediate subset of a right multiplication matrix; the encrypted data matrix set is transmitted to an untrusted execution environment to obtain an intermediate result set, specifically including: Performing a first matrix multiplication on the second encrypted left and right matrix subsets and the multiplication blinded left matrix key subset to obtain a multiplication left matrix intermediate subset; A second matrix multiplication is performed on the third encrypted right matrix subset and the multiplication blinded right matrix key subset to obtain a multiplication right matrix intermediate subset.

4. The method according to any one of claims 1 to 3, characterized in that: If the current layer is a layer that does not require a multiplication matrix, in the trusted execution environment, obtaining output data of the current layer according to output data of the previous layer specifically includes: The trusted execution environment substitutes the output data of the previous layer into a preset function to obtain the output data of the current layer; the preset function includes one or more of a normalization function, a nonlinear activation function, a residual function or a standardization function.

5. A privacy protection system for an artificial intelligence model, characterized in that: It includes a first module, a second module, a third module and a fourth module, wherein: The first module is used to obtain model parameters of the artificial intelligence model and input data of the client, input the model parameters and the input data into the trusted execution environment, and sequentially use each layer of the artificial intelligence model as the current layer; the model parameters include weight parameters or bias parameters of each layer; the artificial intelligence model includes layers requiring matrix multiplication and layers not requiring matrix multiplication; The second module is used for, if the current layer is a layer requiring matrix multiplication, in the trusted execution environment, obtaining an encrypted data matrix collection according to the multiplication left matrix of the current layer and the multiplication right matrix of the current layer; transmitting the encrypted data matrix collection to the untrusted execution environment to obtain an intermediate result collection; returning the intermediate result collection to the trusted execution environment to obtain the output data of the current layer; the multiplication left matrix of the current layer is the model parameter of the current layer or the output data of the previous layer; when the first layer is the current layer, the multiplication right matrix of the current layer is the input data of the client, and when all layers after the second layer are the current layer, the multiplication right matrix of the current layer is the output data of the previous layer or the output data of the Nth layer before the current layer, where N is a natural number greater than 0; The third module is used for obtaining output data of the current layer according to output data of the previous layer in the trusted execution environment if the current layer is a layer that does not require a multiplication matrix; The fourth module is used to use the output data of the last layer as the query result; The second module is further used for, if the current layer is the first multiplication matrix layer, performing a first decryption according to the intermediate result set to obtain a matrix multiplication result; obtaining output data of the current layer according to the matrix multiplication result and the bias parameter; the first multiplication matrix layer needs to perform matrix multiplication and needs to add a linear bias; if the current layer is the second multiplication matrix layer, performing a second decryption according to the intermediate result set to obtain output data of the current layer; the second multiplication matrix layer needs to perform matrix multiplication and does not need to add a linear bias; The second module is further configured to, if a first instruction is obtained, randomly generate a random encryption matrix by the trusted execution environment; the first instruction indicates that the data to be protected is the input data; the multiplication right matrix of the current layer is first encrypted according to the random encryption matrix to obtain a collection of encrypted data matrices; the multiplication right matrix of the current layer is the output data of the previous layer, and the encrypted data matrix collection includes the first encrypted right matrix and the multiplication left matrix of the current layer; If the second instruction is obtained, the trusted execution environment performs a second encryption on the left multiplication matrix and the right multiplication matrix of the current layer, and performs a third encryption on the right multiplication matrix of the current layer to obtain the encrypted data matrix collection; the second instruction indicates that the data to be protected is the left multiplication matrix and the right multiplication matrix.

6. A privacy protection device for an artificial intelligence model, characterized in that: include: at least one trusted execution environment and a memory of said trusted execution environment; The memory of the trusted execution environment is used to store at least one program; At least one untrusted execution environment and a memory of the untrusted execution environment, wherein the memory of the untrusted execution environment is used to store at least one program; When the program is executed by the trusted execution environment and the untrusted execution environment, the trusted execution environment and the untrusted execution environment implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium storing a program executable by a processor, characterized in that: The processor-executable program is used to perform the method according to any one of claims 1 to 4 when executed by the processor.

Images