A privacy-preserving inference method and system for diffusion model sampling

Abstract

The application discloses a privacy protection reasoning method and system for diffusion model sampling, and belongs to the technical field of network security. The method comprises the following steps: receiving privacy model parameter data of a model owner and preprocessed privacy data of a user; the privacy model and the privacy data are respectively divided into privacy model secret sharing and privacy data secret; a three-party server performs diffusion model sampling on the model privacy secret sharing and the privacy data secret sharing and reconstructs the secret sharing, wherein the diffusion model sampling process comprises the following steps: an exponential function e x of Chebyshev polynomial fitting is used to replace the exponential operation in the nonlinear activation function of the diffusion model; and the reconstructed secret sharing is returned to the user, so that the user obtains a sampling generated image. The application improves the calculation and communication performance of the privacy diffusion model by fitting various nonlinear numbers through linear polynomials and Chebyshev polynomials.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a privacy-preserving inference method and system for diffusion model sampling. Background Technology

[0002] Diffusion model generation technology is a key technology in the field of computer vision. In recent years, diffusion model generation technology has surpassed traditional generative adversarial model technology, achieving remarkable results in the fields of image and audio / video. It can synthesize images and audio / video that are indistinguishable from real ones. However, during the inference process, it seriously infringes on users' privacy information and has attracted widespread attention from all sectors of society.

[0003] The training and sampling of the diffusion model consists of two Markov chains: a forward process and a backward process. The forward process progressively adds Gaussian noise to the real image to simulate the data distribution, while the backward process starts from the noisy map and progressively denoises and samples, attempting to recover the original real image. Noise prediction is implemented by a neural network (usually U-Net). By combining the forward and backward processes, the diffusion model can effectively capture complex data distributions and generate high-quality sampled images.

[0004] During the sampling and generation phase of using a diffusion model, users typically have two options: downloading and deploying a pre-trained model locally, or using a third-party website or software. The former requires significant device and coding skills from the user and may leak the model's parameters from the publisher, while the latter requires users to upload their own images and prompts, potentially revealing private information that could include user identity and preferences. The unauthorized collection and use of this private information will seriously infringe upon users' privacy and data security.

[0005] Secure multi-party computation offers a solution for privacy-preserving inference, allowing mutually distrustful parties to collaboratively evaluate a function using their private inputs. This ensures that only the function's output is displayed, and no party has access to any other information. This computational paradigm guarantees privacy and correctness, preventing corrupt parties from learning any information beyond the output and ensuring that honest parties do not accept incorrect outputs.

[0006] Implementing privacy-preserving inference generated by diffusion model sampling is more challenging than in other domains for two main reasons. First, combining diffusion models and privacy computation presents significant challenges due to their different general deployment frameworks. Second, since both diffusion model sampling and privacy computation suffer from inference inefficiencies, using privacy computation for diffusion model sampling leads to even more severe problems of high computational complexity and low communication efficiency.

[0007] Existing security efforts for diffusion models primarily focus on content security, i.e., whether the generated content contains sensitive information, and how to distinguish between generated and real images, lacking protection for data security. Meanwhile, existing privacy-preserving computing technologies mainly focus on traditional machine learning and Transformer-based natural language models, lacking exploration of diffusion models. Summary of the Invention

[0008] To address the aforementioned issues, this invention discloses a privacy-preserving inference method and system for diffusion model sampling. It performs privacy-preserving inference through secure multi-party computation technology, thereby achieving privacy protection in the diffusion model sampling process. Furthermore, by fitting various nonlinear activation functions using linear and Chebyshev polynomials, it improves the computational and communication performance of the privacy diffusion model.

[0009] To achieve the above-mentioned objectives, the technical solution of the present invention includes the following:

[0010] A privacy-preserving inference method for diffusion model sampling, applied to a secure multi-party computation system containing non-colluding third-party cloud servers, the method comprising:

[0011] Receive privacy model parameter data from the model owner and preprocessed privacy data from the user;

[0012] The privacy model and privacy data are separately divided into secret sharing of the privacy model and secret sharing of the privacy data.

[0013] The third-party server performs diffusion model sampling on the model privacy secret sharing and the privacy data secret sharing, and reconstructs the secret sharing; wherein, the process of performing diffusion model sampling includes: fitting an exponential function e using Chebyshev polynomials. x To replace the exponential operation in the nonlinear activation function of the diffusion model;

[0014] The secret of the reconstruction is shared back to the user so that the user can obtain the sampled and generated image.

[0015] Furthermore, the Chebyshev polynomial fitting exponential function e x The process includes:

[0016] Set the breakpoint T for dividing the fitting interval. exp ;

[0017] Fit the Chebyshev polynomial to the exponential function e x The fitting form is defined as Where negExp represents the exponential function e x The range of negative numbers, Chebyshev polynomial Chebyshev = C0T0(t) + C1T1(t) + … + Cj T j (t)+…+C7T7(t), C j T represents the coefficient of the j-th polynomial. j (t) represents the j-th polynomial, where t is the value of x linearly mapped to the interval [-1, 1], and 0 ≤ j ≤ 7.

[0018] Furthermore, the nonlinear activation function includes: the SoftMax activation function;

[0019] The exponential function e fitted using Chebyshev polynomials x To replace the exponential operation in the nonlinear activation function of the diffusion model, including:

[0020] Third-party cloud server P i Boolean value secret sharing form of joint computation of sampled objects The secret sharing form of the maximum value of vector x Where B represents the Boolean secret sharing type of the sampled object, 1≤i≤3;

[0021] Secret sharing form for calculating the normalization result of negative values Secret sharing form of mapping values Where ∈ is a constant;

[0022] Secret sharing form by calculating the mapping power value of each term. Obtaining the polynomial secret sharing form

[0023] Third-party cloud server P i Local computation of exponential vector secret sharing form and the secret sharing form of index value n represents the length of vector x;

[0024] Third-party cloud server P i Joint computation reciprocal secret sharing form And the secret sharing form of the product

[0025] The result value is shared secretly. As the output of the SoftMax activation function.

[0026] Furthermore, the process of performing diffusion model sampling to obtain inference results also includes:

[0027] The SiLU activation function or the Mish activation function is piecewise linearly fitted using a linear polynomial on the intervals [-6, -2] and [-2, 6] to obtain the fitted function of the SiLU activation function or the fitted function of the Mish activation function.

[0028] The SiLU activation function in the diffusion model can be calculated using a fitting function based on the SiLU activation function, or the Mish activation function can be calculated using a fitting function based on the Mish activation function.

[0029] Furthermore, the fitting function of the SiLU activation function Wherein, the function F0(x) = -0.01420163x 2 -0.16910363x-0.52212664, function F1(x)=

[0030] 0.00008032x 6 -0.00602401x 4 +0.19784596x 2 +0.49379432x+0.03453821.

[0031] Furthermore, the fitting function based on the SiLU activation function to complete the calculation of the SiLU activation function in the diffusion model includes:

[0032] Third-party cloud server P i Joint computation of Boolean value secret sharing form Boolean secret sharing format Boolean value secret sharing form Where B represents the Boolean secret sharing type of the sampled object, 1≤i≤3;

[0033] Boolean-based secret sharing format Boolean secret sharing format Boolean value secret sharing form Third-party cloud server P i Joint calculation interval determination value Interval determination value and interval determination value

[0034] Third-party cloud server P i Joint calculation of power value secret sharing form Power value secret sharing format And the secret sharing format of exponentiation

[0035] Third-party cloud server P i Locally computed function value secret sharing format and function value secret sharing form

[0036] The result value is shared secretly. As the output of the SiLU activation function.

[0037] Furthermore, the fitting function of the Mish activation function Wherein, the function F0(x) = -0.01572019x 2 -0.18375535x - 0.55684445, function F1(x) = 0.00010786x 6 -0.00735309x 4 +0.20152583x 2 +0.54902050x+0.07559242.

[0038] A privacy-preserving inference system for diffusion model sampling, the privacy-preserving inference system comprising:

[0039] The model owner is responsible for providing privacy-preserving model parameter data.

[0040] On the user side, it provides preprocessed privacy data; based on the reconstructed secret sharing, it obtains sampled and generated images;

[0041] A secure multi-party computation system comprising non-collusive third-party cloud servers is used to segment privacy models and privacy data into privacy model secret sharing and privacy data secret sharing, respectively. The third-party servers perform diffusion model sampling on the privacy model secret sharing and the privacy data secret sharing, and reconstruct the secret sharing. The diffusion model sampling process includes: fitting an exponential function e using a Chebyshev polynomial. x To replace the exponential operation in the nonlinear activation function of the diffusion model;

[0042] An electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the privacy-preserving inference method for diffusion model sampling as described above.

[0043] A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the privacy-preserving inference method for diffusion model sampling as described above.

[0044] Compared with the publicly available related technologies, this method has the following main advantages:

[0045] (1) This invention is the first to realize privacy reasoning for diffusion model sampling, which can simultaneously protect the user's privacy input and the model owner's model parameters;

[0046] (2) Security outsourcing is a practical need, privacy protection methods are practical, and it is easy to find a trustworthy third-party organization to deploy a secure multi-party computation system and perform privacy inference.

[0047] (3) A series of effective privacy computing security protocols were designed. Since there are many errors in privacy computing scenarios, it is necessary to design corresponding protocols to reduce errors and thus ensure accuracy.

[0048] (4) An efficient activation function operation protocol was designed, which uses linear polynomials and Chebyshev polynomials to fit complex nonlinear activation functions, greatly improving computational efficiency and reducing communication volume.

[0049] (5) A general diffusion model sampling privacy computing system was designed, which implemented privacy reasoning on a general basic model and can be extended to multi-task work based on the diffusion model. Attached Figure Description

[0050] Figure 1 A graph showing the percentage of plaintext inference time for residual modules with different activation functions.

[0051] Figure 2 A flowchart of a privacy-preserving inference method for diffusion model sampling. Detailed Implementation

[0052] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0053] The privacy-preserving inference method for diffusion model sampling of this invention addresses the issues of user privacy and low computational efficiency from two main aspects. Regarding protecting user privacy during the diffusion model sampling generation process, the specific operation involves employing a redundant secret-sharing technique for secure three-party computation in a secure outsourcing scenario. Users and model owners respectively input their privacy data and the model to a cloud server, which then divides this data into secret shares and distributes them to non-colluding participants. After the sampling process, the secret shares are reconstructed to obtain the final output, and the computation results are made public to the user. To address the issue of low computational and communication efficiency, the computational bottleneck module is identified through testing and analysis, and the nonlinear activation function is fitted using linear polynomials and Chebyshev polynomials.

[0054] The plaintext inference time during the diffusion model sampling process is mainly concentrated in the U-Net module of the noise prediction stage. Experimental analysis shows that the residual module accounts for 82.87% of the execution time of U-Net, such as... Figure 1As shown, the attention mechanism and activation function account for almost half of the execution time of the residual module. In the encrypted inference stage, secure multi-party computation accounts for the majority of the runtime, with the nonlinear activation function being the main computational bottleneck.

[0055] This invention defines the threat model as a semi-honest attack scenario, which has no more than one semi-honest adversary. The semi-honest adversary strictly adheres to the protocol specifications, but may attempt to learn about the private information of other participants during the execution of the relevant protocols.

[0056] This invention defines a practical application scenario as a secure outsourcing model, where users upload privacy data, the model owner uploads a privacy model to a cloud server, the cloud system performs privacy calculations during the diffusion model sampling process, obtains inference results, and sends them to the user.

[0057] This invention defines the technical approach as three-party redundant secret sharing, based on the theoretical proof of security guaranteed by the ABY3 protocol. The calculation is performed in 2... l Implemented on an integer ring (where l is the encoding length, typically 32 or 64), secret value Divided into three random values And satisfying x=x0+x1+x2, the three participants in the calculation, P1, P2, and P3, respectively receive the shared value. The addition operation z = c1x + c2y + c3 requires calculation secret sharing. (c1, c2, and c3 are constant coefficients), and the addition result z satisfies z = z0 + z1 + z2. This can be achieved by summing each part of (c1x0 + c2y0 + c3, c1x1 + c2y1, c1x2 + c2y2), and these results can all be calculated locally using P1, P2, and P3. The multiplication protocol requires P... i During the preprocessing stage, random number pairs α0 + α1 + α2 = 0 are generated, P i Local calculation z i =x i y i +x i+1 y i +x i y i+1 And send z′ i =α i +z i Give P i-1 The secret to the multiplication result z = x·y It can be reconstructed using {(z′0,z′1),(z′1,z′2),(z′2,z′0)}.

[0058] This invention defines the privacy computing deployment framework as SPU (Secret Processing Unit), and the underlying protocols (fixed-point encoding, addition, multiplication, matrix multiplication, bit extraction, truncation, etc.) follow multiple advanced privacy computing protocols.

[0059] The present invention provides a privacy-preserving inference method for diffusion model sampling in a real-world scenario, the overall process of which is as follows: Figure 2 As shown, the steps include:

[0060] (1) The model owner preprocesses the privacy model to obtain privacy model parameter data that participates in the calculation but is unrelated to the user input. The user preprocesses the privacy input (image or text) by performing operations such as image cropping and data normalization to obtain the corresponding embedding data. Both parties upload the processed data to the secure multi-party computation system in the cloud.

[0061] (2) The secure multi-party computation system divides the privacy model and privacy data into secret sharing segments and distributes them to three non-colluding cloud servers;

[0062] (3) Each of the three participating servers performs the sampling process of the diffusion model locally;

[0063] (4) After the sampling process ends, the third-party servers publish the calculation results and reconstruct the secret shared value;

[0064] (5) The secure multi-party computation system returns the computation results to the user, and the post-processing converts the sampling results into image data format to obtain the final sampled image and store it.

[0065] Throughout the entire computation process, neither the model owner nor the cloud server can obtain the user's private input information, nor can the user or the cloud server obtain the model's parameter information.

[0066] Because privacy sampling in diffusion models suffers from slow computation speed and high communication volume, this invention designs a series of optimization methods for diffusion model sampling. By fitting the nonlinear activation function with linear polynomials and Chebyshev polynomials, the computation speed is significantly improved and the communication volume is reduced. These methods will be explained in detail below.

[0067] (1) Fitting the exponential function e x

[0068] This invention uses a 7th-order Chebyshev polynomial to represent the exponential function Exp(x) = e x Perform a linear fit, the fit form of which is defined as:

[0069]

[0070] Among them, Texp NegExp represents the breakpoint for dividing the interval, indicating the exponential function e. x The range of negative numbers.

[0071] Chebyshev polynomials are defined as follows:

[0072] Chebyshev(x)

[0073] =C0T0(t)+C1T1(t)+C2T2(t)+C3T3(t)+C4T4(t)+C5T5(t)

[0074] +C6T6(t)+C7T7(t)

[0075] Polynomial T j (t) and polynomial coefficients C j The correspondence is shown in Table 1:

[0076]

[0077] Table 1

[0078] Among them, considering that the secure multi-party computation system uses 18-bit fixed-point number encoding, based on exp(-14)<2 -18 The fact is, setting T exp =-14, in the Chebyshev polynomial, t represents the input x from the interval [T exp A linear mapping from [0] to [-1,1].

[0079] (2) Fitting the SoftMax activation function

[0080] This invention uses a fitted exponential function e x The protocol for replacing the exponential operation in the SoftMax activation function is as follows:

[0081] Algorithm 1: Secure SoftMax Protocol ∏SoftMax

[0082] Input: P i i∈{1,2,3} holds redundant secret sharing x is a vector of length n.

[0083] Output: P i Redundant secret sharing is obtained for i∈{1,2,3} The expression y = SoftMax(x) is satisfied.

[0084] 1. Joint calculation of Boolean value by P0, P1, and P2 using a secret sharing method. The maximum sum of vector x

[0085] Value Secret Sharing Form

[0086] 2.P i Secret sharing format for locally computed negative value normalization results and mapping value secret

[0087] Secret sharing format Where ∈ is a minimal constant, for Ming

[0088] For plaintext, take 0; for ciphertext, take 10. -6 ;

[0089] 3. For j = 2, 3, ..., 7, calculate the secret sharing form of the mapping power value. and multiple

[0090] Secret sharing format

[0091] 4.P i Local computation of exponential vector secret sharing form Secretly sharing shape with index values

[0092] Mode

[0093] 5. Joint calculation of reciprocal values ​​by P0, P1, and P2, using a secret sharing method. Sharing the secrets of products

[0094] form

[0095] 6. Return result value in secret sharing format

[0096] (3) Fitting SiLU and Mish activation functions

[0097] This invention uses linear polynomials to perform piecewise linear fitting of the SiLU and Mish activation functions on the intervals [-6, -2] and [-2, 6]. The highest order of the piecewise polynomials is 2 and 6, respectively. To reduce the number of computations, only an even number of fittings are performed on the higher-order functions on the interval [-2, 6]. The fitting function is defined as follows:

[0098]

[0099] For the SiLU activation functions, F0(x) and F1(x) are defined as follows:

[0100]

[0101] For the Mish activation functions, F0(x) and F1(x) are defined as follows:

[0102]

[0103] The specific agreement is as follows:

[0104] Algorithm 2: Secure SiLU and Mish Protocol ∏SiLU / Mish

[0105] Input: P i i∈{1,2,3} holds redundant secret sharing x is a vector of length n.

[0106] Output: P i Redundant secret sharing is obtained for i∈{1,2,3} The expression y = SiLU / Mish(x) is satisfied.

[0107] 1. Joint calculation of Boolean value by P0, P1, and P2 using a secret sharing method. and interval determination value

[0108] in

[0109]

[0110] 2. Secret sharing method for jointly calculating the power value of P0, P1, and P2

[0111] and

[0112] 3.P i Locally computed function value secret sharing format and

[0113] 4. Return result value in secret sharing format

[0114]

[0115] (4) Calculate the time encoding module

[0116] The temporal encoding module (tMLP) in the diffusion model consists of a positional embedding layer, two linear layers, and a SiLU layer. The main delay component is still the exponential operation, so all exponential functions e are fitted using Chebyshev polynomials. x In some parts, the SiLU layer is computed using the ∏SiLU protocol.

[0117] Experimental verification

[0118] To demonstrate the innovativeness of this invention, an experiment was conducted comparing it with the direct deployment of the diffusion model on an SPU. The experiment shows that the diffusion model sampling generation method of this invention has higher computational speed and lower communication overhead. This invention evaluates the privacy-preserving inference method generated by diffusion model sampling based on two evaluation metrics: runtime and communication overhead. The dataset construction and evaluation results are as follows:

[0119] 1) Dataset and Experiment Configuration:

[0120] Training dataset selection: The handwritten digit recognition dataset (MNIST) is used as the dataset for model training and evaluation to verify the effectiveness of the proposed method.

[0121] Diffusion model architecture selection: This invention selects two classic diffusion model architectures, DDPM and DDIM, for evaluation and verification. Other tasks related to diffusion models can be extended by these two classic model architectures.

[0122] System and Hardware Environment Selection: The privacy model of this invention is implemented in C++ and Python. The system environment is Ubuntu 20.04.1LTS, and the hardware environment is an Intel(R) Xeon(R) Silver 4314 CPU @ 2.40GHz, 500GB RAM. Our model is named CipDM, and it is compared with experiments on plaintext execution (CPU) and direct ciphertext deployment (SPU).

[0123] Network environment selection: This invention uses two scenario simulation experiments: local deployment environment and local area network environment. The local deployment environment has no communication overhead limit, while the communication overhead of the local area network environment is limited by the amount of communication, network latency and network bandwidth. In the local area network environment deployed in this invention, the network latency is 0.1ms and the network bandwidth is 1Gbps.

[0124] Activation function selection: The activation functions used in this experiment include ReLU, SiLU and Mish, which cover the commonly used activation function types in diffusion models. Comparative experiments were conducted on each of them.

[0125] 2) Experimental results:

[0126]

[0127]

[0128] Table 2

[0129]

[0130] Table 3

[0131]

[0132] Table 4

[0133]

[0134] Table 5

[0135] Tables 2 (DDPM) and 3 (DDIM) show the performance improvement in time overhead (in seconds) of the privacy-preserving inference method for diffusion model sampling proposed in this invention. Tables 4 (DDPM) and 5 (DDIM) show the time overhead (in seconds) and communication overhead (in GB) of the method proposed in this invention during ciphertext inference. Compared with ciphertext inference directly deployed on the SPU, the method proposed in this invention can improve the computation speed by 1.166×~2.232× (DDPM) and 1.084×~2.328× (DDIM), respectively, and reduce the communication volume by 1.348×~1.698× (DDPM) and 1.212×~1.791× (DDIM), respectively.

[0136] In summary, this invention not only effectively protects user privacy and model parameters, ensuring data security during the diffusion model sampling and generation process, but also significantly improves model computation performance and reduces inference time and communication costs by replacing complex nonlinear activation functions with effective linear function fitting methods.

[0137] The method disclosed in this invention can be practically deployed in actual production environments, ensuring privacy and security during the application of diffusion models and protecting users' privacy information from being leaked, thus possessing high practical application value.

[0138] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those skilled in the art can modify or make equivalent substitutions to the technical solutions of the present invention without departing from the scope of the present invention. The scope of protection of the present invention should be determined by the claims.

Claims

1. A privacy-preserving inference method for diffusion model sampling, characterized in that, The method, applied to a secure multi-party computing system comprising three non-colluding cloud servers, includes: Receive privacy model parameter data from the model owner and preprocessed privacy data from the user; The privacy model parameter data and privacy data are respectively divided into privacy model secret sharing and privacy data secret sharing; The third-party cloud server performs diffusion model sampling on the privacy model secret sharing and the privacy data secret sharing, and reconstructs the secret sharing; wherein, the process of performing diffusion model sampling includes: fitting an exponential function using Chebyshev polynomials. To replace the exponential operation in the nonlinear activation function of the diffusion model; The secret of the reconstruction is shared back to the user so that the user can obtain the sampled and generated image; Among them, the exponential function fitted by Chebyshev polynomials The fitting form is defined as Chebyshev polynomials , Indicates the first polynomial coefficients, Indicates the first A polynomial, Let x be the value linearly mapped to the interval [-1, 1]. , This indicates the breakpoints that define the fitted intervals; The non-linear activation functions include: the SoftMax activation function; The exponential function fitted using Chebyshev polynomials To replace the exponential operation in the nonlinear activation function of the diffusion model, including: Third-party cloud server Boolean value secret sharing form of joint computation of sampled objects sum vector Maximum value secret sharing form ;in, Indicates the Boolean secret sharing type of the sampled object. ; Secret sharing form for calculating the normalization result of negative values Secret sharing form of mapping values ;in, It is a constant; Secret sharing form by calculating the mapping power value of each term. To obtain the polynomial secret sharing form ; Third-party cloud server Local computation of exponential vector secret sharing form and the secret sharing form of index value ; Representing vectors Length; Third-party cloud server Joint computation reciprocal secret sharing form And the secret sharing form of the product ; The result value is shared secretly. As the output of the SoftMax activation function.

2. The method according to claim 1, characterized in that, The process of obtaining inference results by performing diffusion model sampling also includes: Using polynomials in the interval and interval Piecewise polynomial fitting is performed on the SiLU activation function or the Mish activation function to obtain the fitting function of the SiLU activation function or the fitting function of the Mish activation function. The SiLU activation function in the diffusion model can be calculated using a fitting function based on the SiLU activation function, or the Mish activation function can be calculated using a fitting function based on the Mish activation function.

3. The method according to claim 2, characterized in that, The fitting function of the SiLU activation function ; where, function ,function .

4. The method according to claim 2, characterized in that, The fitting function of the Mish activation function ; where, function ,function .

5. A privacy-preserving inference system for diffusion model sampling, characterized in that, The privacy-preserving inference system includes: The model owner is responsible for providing privacy-preserving model parameter data. On the user side, it provides preprocessed privacy data; based on the reconstructed secret sharing, it obtains sampled and generated images; A secure multi-party computation system comprising non-collusive third-party cloud servers is used to segment privacy model parameter data and privacy data into privacy model secret sharing and privacy data secret sharing, respectively. The third-party cloud servers perform diffusion model sampling on the privacy model secret sharing and the privacy data secret sharing and reconstruct the secret sharing. The diffusion model sampling process includes: fitting an exponential function using a Chebyshev polynomial. To replace the exponential operation in the nonlinear activation function of the diffusion model; Among them, the exponential function fitted by Chebyshev polynomials The fitting form is defined as Chebyshev polynomials , Indicates the first polynomial coefficients, Indicates the first A polynomial, Let x be the value linearly mapped to the interval [-1, 1]. , This indicates the breakpoints that define the fitted intervals; The non-linear activation functions include: the SoftMax activation function; The exponential function fitted using Chebyshev polynomials To replace the exponential operation in the nonlinear activation function of the diffusion model, including: Third-party cloud server Boolean value secret sharing form of joint computation of sampled objects sum vector Maximum value secret sharing form ;in, Indicates the Boolean secret sharing type of the sampled object. ; Secret sharing form for calculating the normalization result of negative values Secret sharing form of mapping values ;in, It is a constant; Secret sharing form by calculating the mapping power value of each term. To obtain the polynomial secret sharing form ; Third-party cloud server Local computation of exponential vector secret sharing form and the secret sharing form of index value ; Representing vectors Length; Third-party cloud server Joint computation reciprocal secret sharing form And the secret sharing form of the product ; The result value is shared secretly. As the output of the SoftMax activation function.

6. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the privacy-preserving inference method for diffusion model sampling as described in any one of claims 1-4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the privacy-preserving inference method for diffusion model sampling as described in any one of claims 1-4.

Images