Machine learning data forgetting verification system and method and storage medium

Abstract

The invention relates to the technical field of artificial intelligence security, and provides a machine learning data forgetting verification system and method. The system comprises a data storage component, a model linked list component, a key linked list component and a filter, wherein the key linked list component and the filter are arranged in a trusted execution environment. The method is suitable for a universal machine learning model, correctness of data forgetting execution of the server is asserted by verifying validity of a data deletion proof sigma d, a model learning proof sigma m and a model prediction proof sigma p, and machine learning data forgetting verification can be efficiently realized; according to the method, the trusted execution environment is adopted as a secure memory area, potential integrity attacks can be effectively prevented, and in cooperation with a high-memory-efficiency data structure composed of a key chain table assembly and a filter arranged in the trusted execution environment and a data storage assembly and a model chain table assembly arranged outside the trusted execution environment, the security of the trusted execution environment is improved. High data read-write efficiency and high machine learning data forgetting verification efficiency can be realized under the condition of low calculation cost.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and more specifically, to a machine learning data forgetting verification system, method and storage medium. Background Art

[0002] Machine learning (ML) models used for prediction services are often trained on user data, which can refer to the current machine learning as a service (MLaaS) paradigm. In particular, data owners can authorize service providers to train machine learning models based on data provided by the data owner, and then use the trained models to provide prediction services. However, the data owner may withdraw the authorization, that is, send a request to delete the data owner's data from the trained model, and complying with the deletion request requires retraining the model or deleting the model completely. Recently, some strict data bills have explicitly stipulated that users have the "right to be forgotten" of data, which is crucial from the perspective of privacy and security.

[0003] Traditional machine learning can use the accuracy of forgotten data to verify whether forgetting is successful or not, but this method is difficult to ensure the compliance of the "right to be forgotten" in an untrusted environment. In reality, powerful servers are likely not to delete user data. In addition, dishonest servers can also strategically evade the verification indicators recommended by previous forgetting methods by launching forgery attacks. In addition, there are currently proposals to achieve approximate data deletion from the parameter level and accurate data deletion from the parameter level. For example, the SISA framework (Secure Information Sharing Architecture) provides an accurate data forgetting method for general machine learning models, which complies with the deletion request of the data owner through forgetting learning. However, this method has certain limitations. In order to verify the correctness of data forgetting, it is necessary to effectively track the lineage from the authenticated learning data to the learned intermediate sub-model, and to effectively verify the correctness of forgetting learning, but this will bring huge computational costs. Summary of the invention

[0004] In order to overcome the defects of the above-mentioned prior art in that the effective verification of data forgetting is inefficient and requires a large amount of computing cost, the present invention provides a machine learning data forgetting verification system, method and storage medium.

[0005] In order to solve the above technical problems, the technical solution of the present invention is as follows:

[0006] A machine learning data forgetting verification system includes a data storage component, a model chain table component, a key chain table component and a filter, wherein the key chain table component and the filter are arranged in a trusted execution environment.

[0007] The server packs the data set D uploaded by the user into the filter to construct an index kid for each data point d∈D in the data set, links the data point d with the index kid and stores them in the data storage component; and stores the index kid in the key linked list component;

[0008] Reading the data set D from the data storage component through the index kid, performing machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtaining a first model M1, and storing it in the model linked list component; returning the first model M1 to the user;

[0009] When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point d in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d ;

[0010] Read the data set D' after deleting the data from the data storage component, re-perform machine learning of the target learning method F in the trusted execution environment, obtain the second model M2, and store it in the model linked list component; generate a model learning proof σ m , and returns the second model M2 and the model learning proof σ to the user m ;

[0011] When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p ;

[0012] The user proves that the data has been deleted d , model learning proof σ m And the model prediction proves that σ p Perform validity verification to ensure that the server correctly executes data forgetting.

[0013] Furthermore, the present invention also proposes a machine learning data forgetting verification method, which applies the machine learning data forgetting verification system proposed by the present invention. The method includes the following steps:

[0014] S1. The server packages the dataset D uploaded by the user into the filter to construct an index kid for each data point d∈D in the dataset, links the data point d with the index kid, and stores it in the data storage component;

[0015] S2, reading the data set D from the data storage component through the index kid, performing machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtaining a first model M1, and storing it in the model linked list component; returning the first model M1 to the user;

[0016] S3. When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point d in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d ;

[0017] S4, read the data set D' after deleting the data from the data storage component, re-perform the machine learning of the target learning method F in the trusted execution environment, obtain the second model M2, and store it in the model linked list component; generate a model learning proof σ m , and returns the second model M2 and the model learning proof σ to the user m ;

[0018] S5. When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model linked list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p ;

[0019] S6. User proves data deletion σ d , model learning proof σ m And the model prediction proves that σ p Verify that the server is correctly performing data forgetting.

[0020] Furthermore, the present invention also proposes a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the machine learning data forgetting verification method proposed in the present invention.

[0021] Furthermore, the present invention also proposes a storage medium on which computer-readable instructions are stored, wherein the computer-readable instructions, when executed by a processor, implement the steps of the machine learning data forgetting verification method proposed in the present invention.

[0022] Compared with the prior art, the technical solution of the present invention has the following beneficial effects: the present invention is applicable to general machine learning models, and can verify the deletion of data by proving σ d , model learning proof σ m And the model prediction proves that σp The validity assertion server correctly executes data forgetting, its computational cost is small and stable, and it can efficiently realize machine learning data forgetting verification; the present invention adopts a trusted execution environment as a secure memory area, which can effectively prevent potential integrity attacks, and cooperates with the high memory efficiency data structure composed of the key linked list component and the filter set in the trusted execution environment, as well as the data storage component and the model linked list component set outside the trusted execution environment, which can achieve high data reading and writing efficiency and high machine learning data forgetting verification efficiency with low computational cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is an architectural diagram of the machine learning data forgetting verification system of the present invention.

[0024] Figure 2 Schematic diagram of pseudo code for the machine learning data forgetting verification protocol of the present invention.

[0025] Figure 3 The present invention is a flowchart of the method for forgetting verification of machine learning data. DETAILED DESCRIPTION

[0026] The accompanying drawings are only used for illustrative purposes and are not to be construed as limiting the present invention;

[0027] It is understandable to those skilled in the art that some well-known descriptions may be omitted in the drawings.

[0028] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0029] Example 1

[0030] This embodiment proposes a machine learning data forgetting verification system, such as Figure 1 , which is an architecture diagram of the machine learning data forgetting verification system of this embodiment.

[0031] The machine learning data forgetting verification system proposed in this embodiment includes a data storage component, a model linked list component, a key linked list component and a filter, and the key linked list component and the filter are set in a trusted execution environment.

[0032] The server packs the data set D uploaded by the user into the filter to construct an index kid for each data point D∈D in the data set, links the data point d with the index kid and stores them in the data storage component; and stores the index kid in the key linked list component.

[0033] The filter reads the data set D from the data storage component through the index kid, performs machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtains the first model M1, and stores it in the model linked list component. The first model M1 is returned to the user.

[0034] When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point D in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d .

[0035] Read the data set D' after deleting the data from the data storage component, re-perform machine learning of the target learning method F in the trusted execution environment, obtain the second model M2, and store it in the model linked list component; generate a model learning proof σ m , and returns the second model M2 and the model learning proof σ to the user m .

[0036] When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p .

[0037] The user proves that the data has been deleted d , model learning proof σ m And the model prediction proves that σ p Perform validity verification to ensure that the server correctly executes data forgetting.

[0038] The system of this embodiment is applicable to general machine learning models, and has little impact on the modification of machine learning models, without compromising the accuracy of the model. d , model learning proof σ m And the model prediction proves that σ p The validity assertion proves that the server correctly performs data forgetting. The generation overhead of the proof is low and stable, and it can efficiently implement machine learning data forgetting verification.

[0039] In this embodiment, a trusted execution environment Enclave is optionally used as a secure memory area for executing application code with confidentiality and integrity guarantees, as well as isolation from untrusted external platforms. A remote attestation mechanism is provided by issuing a signature-based attestation (enhanced privacy ID signature scheme) for a requested quote, which contains measurements of the enclave code and data. With the evidence, the remote client can assert the authenticity of the enclave identity and the authenticity of code execution after subscribing to the authentication service of the trusted execution environment vendor.

[0040] In addition, the key list components and filters set in the trusted execution environment form a highly memory-efficient data structure, which, together with the cheap pointers that link data slices, enables the trusted execution environment to achieve data lineage tracking with correctness guarantees and the performance of related sub-models outside the trusted execution environment. The data and sub-models are truly stored in the data storage components and model list components outside the trusted execution environment, which, together with the structural design in the trusted execution environment, effectively prevent potential integrity attacks.

[0041] The data storage component and model linked list component of this embodiment use the same size Merkle hash tree (MHT) to separately package data and corresponding intermediate sub-models. By making the position of a data slice in one MHT consistent with the position of the earliest intermediate sub-model affected by a data slice in another MHT, their lineage can be preserved. At the same time, with the cheap pointers linking the data slices, the pointers are stored in the key linked list component in the trusted execution environment, so that the trusted execution environment itself can achieve data lineage tracking with correctness guarantee and related sub-models outside the trusted execution environment. This structural design can effectively improve the efficiency of data reading and writing and reduce computing costs.

[0042] The data storage component of this embodiment is used to store the list of sharded learning data data and corresponding message authentication codes dmac, and its basic unit is a single data point.

[0043] The model linked list component is used to store a linked list of sub-models model and integrity message authentication code m_s_mac, and its basic unit is a sub-model. The sub-model is learned by adding learning data of a new data piece, and the linkability between two adjacent sub-models is enforced by the key linked list component.

[0044] The key list component is used to store a list of keys corresponding to each data point, with the purpose of efficiently obtaining data and sub-models, and allowing data slices and sub-models to be stored in the correct order outside the trusted execution environment. Each key entry includes a data index kid, an indication tag, a data pointer *data for finding the corresponding data point, a model pointer *model for connecting the data slice with the corresponding sub-model, and a seed seed.

[0045] Among them, the storage order of the index kid can determine the order of storing and restoring data points (and data slices) and sub-models from the trusted execution environment, and quickly extract them to the trusted execution environment through pointers during learning and forgetting learning.

[0046] The indication tag is a binary field that indicates whether the data point is inserted into the filter or deleted from the filter. The indication tag can avoid repeated querying and inserting data points in the filter from scratch, especially when deleting data points from one data slice and relearning the remaining data, effectively reducing the computational cost. More importantly, when looking up the deleted data point later, the label can be used to mitigate false positives caused by the presence of certain data points that share the same fingerprint as the deleted data point.

[0047] The model pointer *model is used to connect the data slice with the corresponding sub-model, which is trained on the training data of the most recently added data slice. A data slice can contain multiple data points, and the model pointer in the key of the last data point is linked to the corresponding sub-model.

[0048] The seed is generated when a new sub-model is constructed in the trusted execution environment and is used as the index of the sub-model. In this embodiment, the seed is assigned to the key of the last data point in the data slice for easy retrieval.

[0049] The filters are used to package data points and support deletion and membership queries. The filters run in a trusted execution environment to verify the data, support fast deletion of a data point, and tell the learning program that the data point is not allowed to be used.

[0050] It should be noted that in the data storage component, model linked list component, key linked list component and filter in this embodiment, each data point is represented as<kid,data> , where kid is an identifier of data with a consensus hash function, such as a non-encrypted xxHash function.

[0051] The system structure of this embodiment stores learning data and sub-models outside the trusted execution environment area to reduce storage costs while ensuring data security. At the same time, it effectively tracks the lineage from data slices to learning sub-models, supports rapid deletion and update requests for deleted data points when receiving sub-models, and maintains traceable lineage.

[0052] Further, the filter optionally adopts a cuckoo filter for membership query from a generally large data set with a low and controllable false positive rate. Compared with a cuckoo hash table, a cuckoo filter only stores data fingerprints of a short and constant size.

[0053] It should be noted that the cuckoo filter consists of a series of buckets, where each bucket contains a number of entries, such as 4 or 8. The fingerprint of an element can be filled into two possible buckets. This is determined by two hash functions derived from the standard cuckoo hash. For example, given a new element e to be inserted and its fingerprint f e (such as 16-bit truncated PRESENT ciphertext), find the alternative position hash h1 of bucket B by calculating the 64-bit hash value h1=Hash(e). The hash function can use CityHash. If it is empty, insert the fingerprint of the element into B[h1]. Otherwise, by calculating Another position h2 is found where the original element e does not need to be retrieved. Next, if B[h2] is also not empty, the position shift method is called. Specifically, the element at h2 is replaced by f e , and place the element in its alternative position. Repeat this displacement process until an empty bucket is found or the displacement threshold is reached.

[0054] Optionally, the fingerprint in the filter is generated in the form of Enc(kid||data||eid), where Enc can use a lightweight encryption algorithm and eid is the identity of the initialized trusted execution environment. When a data forget request is received, the data fingerprint is deleted from the filter. In addition, in addition to checking the MAC, the filter also helps the trusted execution environment check whether the loaded data point matches the corresponding kid.

[0055] In this embodiment, the integrity of the data point can be checked by verifying the MAC of the data point and then using the fingerprint Enc(kid||data||eid) query filter. When calling the sub-model, the integrity is checked by retrieving the respective seed and rebuilding its MACm_s_mac, thereby verifying the authenticity of the sub-model.

[0056] In addition, to consider potential threats that damage the integrity of data and sub-models outside the trusted execution environment, the present embodiment includes the trusted execution environment identity in each fingerprint to prevent forking attacks, thereby preventing the server from scheduling multiple enclave instances to execute the same forgetting learning task.

[0057] Further optionally, an inenclave filter is selected to protect each data point from replacement attacks, for example, replacing a data point with a data point that does not match a specific kid.

[0058] As for model checkpoints, this embodiment generates a trusted and fresh seed for each newly generated sub-model, and associates the seed in the trusted execution environment with its integrity MAC to mitigate integrity destruction attacks.

[0059] Furthermore, this embodiment divides the machine learning data forgetting verification into a setting phase and a deletion phase based on the definition of forgetting learning. Figure 2 As shown, it is a pseudo code diagram of the machine learning data forgetting verification protocol of this embodiment.

[0060] In an optional embodiment, the trusted execution environment is initialized with a public verification key and a signature key pair (pk sgx ,sk sgx ).

[0061] The trusted execution environment is also configured with prog k Program, prog c Program, prog t Program and prog p Program; wherein the prog k A program is used to generate the key for each data point; the prog c A program is used to perform the insertion of feed data into the filter; the prog t The program is used to perform incremental training intermediate model checkpoints; the prog p The program is used to perform model predictions on given test data.

[0062] In an alternative embodiment, the model learns to prove σ m By using the signature key sk sgx The machine learning process is signed; the data deletion proof σ d By using the signature key sk sgx About data d u The forgetting learning process signature is obtained; the model prediction proves σ p By using the signature key sk sgx The test data t, the prediction result p, the second model M2 and the test process signature are obtained.

[0063] In the setup phase, the server packages the dataset D uploaded by the user into the filter to build a key list, such as Figure 2 As shown in the pseudo code of lines 3-7 in . Afterwards, the filter unloads the data point to free up the trusted execution environment memory. In order to perform machine learning, as Figure 2 As shown in the pseudo code of lines 15-24 in prog t The batches of data can be specified by their keys and fetched into the trusted execution environment with integrity checks. The generated sub-models are stored in order in the model list component with guaranteed integrity and freshness, and the last one will be the predicted model, i.e., the first model M1. Afterwards, users can enjoy model predictions by providing test data, such as Figure 2 This is shown in the pseudo code on lines 25-30.

[0064] Further, in an optional embodiment, when performing machine learning of the target learning method F in a trusted execution environment, the following steps are performed:

[0065] The filter reads the training data data from the data storage component through the key chain table component and checks its integrity through MAC;

[0066] The filter obtains the latest sub-model model' from the model link list component through the key link list component, and checks its integrity through MAC;

[0067] Input the training data into the prediction model model' to perform machine learning of the target learning method F, and obtain a new sub-model model: = prog t (model′,data);

[0068] Generate a seed based on the current state of the sub-model model and add it to the key of the sub-model model;

[0069] Generate model parameters h model =H(model||seed), and use it as the MAC of the child model;

[0070] The sub-model model and its model parameters h model Unload from the trusted execution environment and store in the model linked list component;

[0071] Link the model pointer *model of the sub-model model to the storage location of the sub-model model;

[0072] Generative model learning proof σ m :=∑.Sign(sk sgx ,(c,h model ,prog t )).

[0073] Among them, during the initial training, the filter obtains the latest sub-model model' from the model list component through the key list component as the preset initial model M0. The machine learning of the target learning method F is performed based on the initial model M0 in the trusted execution environment, and the final sub-model model generated is the first model M1. After the execution data is forgotten, the machine learning of the target learning method F is performed again in the trusted execution environment, and the final sub-model model generated is the second model M2, wherein the second model M2 does not contain the first model M1.

[0074] When deleting data point d uAfter that, the trusted execution environment performs a delete operation on the filter to delete the data point and invalidate the affected sub-model, i.e. Figure 2 The pseudo code of lines 8-14 is shown in .

[0075] Further, in an optional embodiment, when a data forgetting request is received, the step of performing a data forgetting operation through the filter in the trusted execution environment includes:

[0076] Determine the data point d in the data storage component by index kid u The position of the data point d u and delete the data point d from the data storage component u ;

[0077] Delete the sub-model linked to the index kid in the model linked list component;

[0078] Deleting the seeds after the index kid position in the key linked list component; the seeds include the key of the last data point in the data slice;

[0079] Delete data point d from the filter u ;

[0080] Generate data deletion proof σ d :=Σ.Sign(sk sgx , (c, prog c , prog k )).

[0081] After the deletion operation is completed, the machine learning of the target learning method F is re-performed in the trusted execution environment using the dataset D′ after the data is deleted, as shown in Figure 2 As shown in the pseudo code lines 15-24, a second model M2 is obtained, wherein the second model M2 does not include the first model M1.

[0082] Further, in an optional embodiment, when performing prediction through the filter in the trusted execution environment, the following steps are performed:

[0083] The filter reads the second model M2 from the model link list component through the key link list component according to the index kid, and checks its integrity through MAC;

[0084] Input the test data t into the second model M2 and output the prediction result p:=prog p (model, t);

[0085] Generative model prediction proof σ p :=Σ.Sign(sk sgx , (p, t, h model, prog p )).

[0086] Furthermore, the user deletes the data based on the proof σ d , model learning proof σ m And the model prediction proves that σ p When performing validity verification, the steps include:

[0087] (1) Using the verification key pk sgx Proof of data deletion d The validity is verified and the filter is used to query the data point d u The membership degree verifies the authenticity of the filter and key and confirms whether the data point d is deleted correctly. u ; It is expressed as: assertΣ.Verify(pk sgx , σ d ,c,prog c , prog k ).

[0088] (2) Using the verification key pk sgx Learning to prove σ m The validity of the second model M2 is verified to confirm whether it is obtained through the data increment learning in the filter; it is expressed as: assertΣ.Verify(pk sgx , σ m ,c,h modl , prog t ).

[0089] (3) Using the verification key pk sgx Prove that the model predicts p The validity of the second model M2 is verified to confirm whether it is a prediction model; it is expressed as: assertΣ.Verify(pk sgx , σ p ,p,t,h model , prog p ).

[0090] When confirming the data deletion proof σ d , model learning proof σ m And the model prediction proves that σ p When valid, asserts that the server correctly implements data forgetting.

[0091] In this embodiment, based on the model learning proof σ m , Data deletion proof σ d And the model prediction proves that σ p, asserts whether the server provides a false target model, or performs an incorrect unlearning process, or uses an incorrect unlearning model to make new predictions.

[0092] In step (1), we prove σ by asserting that data is deleted. d The validity of the filter and querying the data point d u The membership of is used to verify the authenticity of the filter c and the key list to confirm whether the data point is deleted correctly. In step (2), the model learning proves that σ m The validity of , the integrity of the sub-models, and the confidentiality of the seed are verified to confirm that the last sub-model model is learned incrementally from the data present in filter c. In step (3), the model prediction proves σ p The validity of the target model is verified by checking the prediction model used in the prediction process.

[0093] Further optionally, the user verifies the data deletion proof σ on the updated filter c and key list after the data deletion operation d , to verify the correctness of data forgetting.

[0094] In particular, when performing the data forgetting operation, the deletion operation of the key list component is twofold. u The key entry of the change includes: indicating tag = 0, data pointer *data is unlinked to d u 、model pointer *model is unlinked to the affected submodel, seed seed=NULL. For the data point d to be deleted in the key list component u For other key entries after the key entry of , the model pointer *model is not linked to the sub-model, and the seed field is set to null. All remaining affected sub-models are relearned on the remaining data D' until the last sub-model h' is obtained, that is, the second model M2.

[0095] Second, this embodiment asserts that the corresponding model learns to prove σ by updating the filter c' m To verify that the new final sub-model h' is completely excluding d u Incrementally relearned on the data.

[0096] In addition, based on the data deletion proof σ d , model learning proof σ m And the model prediction proves that σ pBy verifying the validity of the trusted execution environment, users can assert that: the trusted execution environment guarantees integrity and partial confidentiality (i.e., sealing randomness and secret keys); the associated signature scheme ∑ satisfies chosen message attack-unforgeable (EU-CMA) security; the hash functions used to generate the trusted execution environment identity and integrity MACs are collision-resistant; and finally, all programs running within the trusted execution environment are error-free.

[0097] In this embodiment, the data deletion proof σ d , model learning proof σ m And the model prediction proves that σ p Validation is performed to verify the correctness of the target model, the correctness of the forgotten learning, and the correctness of the new model. Specifically, in the setup phase, we require the correctness of the target model to be guaranteed, so that the server cannot forge a target model that has never learned the data owner's data and claim to have forgotten it in the later deletion phase. In the deletion phase, the correctness of the forgotten learning and the correctness of the new model must be guaranteed, so that the server cannot perform an incorrect forgotten learning process, nor can it output an arbitrary model for subsequent predictions while claiming to have completed the undo learning. If the above correctness properties are met, users can be confident that their data forgetting requests are indeed processed by the server.

[0098] Further optionally, before validating the final model, i.e., learning the model to prove σ m Before verifying the validity of the sub-model, the authenticity of all previous sub-models is verified by the trusted execution environment itself by securely retaining the seed of each sub-model.

[0099] To further verify the model prediction, we prove that σ p The validity of the model prediction proof σ is optionally introduced to send a challenge to the previous enclave for execution. p Once the audit enclave finds an incorrect execution, it can generate an alarm report and a verification proof. With the audit enclave, users only need to verify the verification proof of the audit enclave to determine whether the subsequent prediction is provided by the correct model. Further optionally, the introduction of the audit enclave can support third-party audits.

[0100] Example 2

[0101] This embodiment proposes a machine learning data forgetting verification method, which is applied to the machine learning data forgetting verification system proposed in Embodiment 1. Figure 3 , which is a flow chart of the machine learning data forgetting verification method of this embodiment.

[0102] The machine learning data forgetting verification method proposed in this embodiment includes the following steps:

[0103] S1. The server packages the dataset D uploaded by the user into the filter to construct an index kid for each data point d∈D in the dataset, links the data point d with the index kid, and stores it in the data storage component;

[0104] S2, reading the data set D from the data storage component through the index kid, performing machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtaining a first model M1, and storing it in the model linked list component; returning the first model M1 to the user;

[0105] S3. When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point d in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d ;

[0106] S4, read the data set D' after deleting the data from the data storage component, re-perform the machine learning of the target learning method F in the trusted execution environment, obtain the second model M2, and store it in the model linked list component; generate a model learning proof σ m , and returns the second model M2 and the model learning proof σ to the user m ;

[0107] S5. When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model linked list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p ;

[0108] S6. User proves data deletion σ d , model learning proof σ m And the model prediction proves that σ p Verify that the server is correctly performing data forgetting.

[0109] It can be understood that the method of this embodiment is applied to the machine learning data forgetting verification system of the above-mentioned embodiment 1, and the optional items in the above-mentioned embodiment 1 are also applicable to this embodiment, so they will not be repeated here.

[0110] Example 3

[0111] This embodiment proposes a computer device, including a memory and a processor, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the processor executes the steps of the machine learning data forgetting verification method proposed in Example 1.

[0112] Example 4

[0113] This embodiment proposes a storage medium on which computer-readable instructions are stored, wherein the computer-readable instructions, when executed by a processor, implement the steps of the machine learning data forgetting verification method proposed in Embodiment 1.

[0114] Exemplarily, the storage medium includes, but is not limited to, a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0115] Exemplarily, the instructions, programs, code sets or instruction sets may be implemented using conventional programming languages.

[0116] Exemplarily, the processor includes but is not limited to a smart phone, a personal computer, a server, a network device, etc., and is used to execute all or part of the steps of the machine learning data forgetting verification method described in Example 1.

[0117] The terms in the drawings are only used for illustrative purposes and are not to be construed as limiting the present invention;

[0118] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A machine learning data forgetting verification system, characterized in that: The invention comprises a data storage component, a model chain table component, a key chain table component and a filter, wherein the key chain table component and the filter are arranged in a trusted execution environment; wherein: The server packs the data set D uploaded by the user into the filter to construct an index kid for each data point d∈D in the data set, links the data point d with the index kid and stores them in the data storage component; and stores the index kid in the key linked list component; Reading the data set D from the data storage component through the index kid, performing machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtaining a first model M1, and storing it in the model linked list component; returning the first model M1 to the user; When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point d in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d ; Read the data set D' after deleting the data from the data storage component, re-perform machine learning of the target learning method F in the trusted execution environment, obtain the second model M2, and store it in the model linked list component; generate a model learning proof σ m , and returns the second model M2 and the model learning proof σ to the user m ; When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p ; The user proves that the data has been deleted d , model learning proof σ m And the model prediction proves that σ p Perform validity verification to ensure that the server correctly implements data forgetting.

2. The machine learning data forgetting verification system according to claim 1, characterized in that: The key linked list component stores a key corresponding to each data point, and each key entry includes a data index kid, an indicator tag, a data pointer *data for finding the corresponding data point, a model pointer *model for connecting the data slice with the corresponding sub-model, and a seed seed.

3. The machine learning data forgetting verification system according to claim 2, characterized in that: The trusted execution environment is initialized with a public verification key and a signature key pair (pk sgx ,sk sgx ); the trusted execution environment is also configured with prog k Program, prog c Program, prog t Program and prog p Program; wherein the prog k A program is used to generate the key for each data point; the prog c A program is used to perform the insertion of feed data into the filter; the prog t The program is used to perform incremental training intermediate model checkpoints; the prog p The program is used to perform model predictions on given test data.

4. The machine learning data forgetting verification system according to claim 3, characterized in that: The model learns to prove σ m By using the signature key sk sgx The machine learning process is signed; the data deletion proof σ d By using the signature key sk sgx About data d u The forgetting learning process signature is obtained; the model prediction proves σ p By using the signature key sk sgx The test data t, the prediction result p, the second model M2 and the test process signature are obtained.

5. The machine learning data forgetting verification system according to claim 4, characterized in that: When a data forgetting request is received, the step of performing a data forgetting operation through the filter in the trusted execution environment includes: Determine the data point d in the data storage component by index kid u The position of the data point d u and delete the data point d from the data storage component u ; Delete the sub-model linked to the index kid in the model linked list component; Deleting the seed after the index kid position in the key chain list component; the seed includes the key of the last data point in the data slice; Delete data point d from the filter u ; Generate data deletion proof σ d :=∑.Sign(sk sgx ,(c,prog c ,prog k )).

6. The machine learning data forgetting verification system according to claim 4, characterized in that: When performing machine learning of the target learning method F in a trusted execution environment, the following steps are performed: The filter reads the training data data from the data storage component through the key chain table component and checks its integrity through MAC; The filter obtains the latest sub-model model' from the model link list component through the key link list component, and checks its integrity through MAC; Input the training data into the prediction model model' to perform machine learning of the target learning method F, and obtain a new sub-model model: = prog t (model′,data); Generate a seed based on the current state of the sub-model model and add it to the key of the sub-model model; Generate model parameters h model =H(model||seed), and use it as the MAC of the sub-model model; The sub-model model and its model parameters k model Unload from the trusted execution environment and store in the model linked list component; Link the model pointer *model of the sub-model model to the storage location of the sub-model model; Generative model learning proves σ m :=∑.Sign(sk sgx ,(c,h model ,prog t )).

7. The machine learning data forgetting verification system according to claim 6, characterized in that: When executing a prediction through the filter within a trusted execution environment, the following steps are performed: The filter reads the latest prediction model model from the model link list component through the key link list component according to the index kid, and checks its integrity through MAC; Input the test data t into the prediction model model and output the prediction result p:=prog p (model,t); Generative model prediction proof σ p :=Σ.Sign(dk sgx ,(p,t,h model ,prog p )).

8. The machine learning data forgetting verification system according to any one of claims 1 to 7, characterized in that: The user proves that the data has been deleted d , model learning proof σ m And the model prediction proves that σ p When performing validity verification, the steps include: Using the verification key pk sgx Proof of data deletion d The validity is verified and the filter is used to query the data point d u The membership degree verifies the authenticity of the filter and key and confirms whether the data point d is deleted correctly. u ; Using the verification key pk sgx Learning to prove σ m Verify the validity of the filter to confirm whether the second model M2 is learned through the data increment in the filter; Using the verification key pk sgx Prove that the model predicts p The validity of the model M2 is verified to confirm whether the second model M2 is a prediction model; When confirming the data deletion proof σ d , model learning proof σ m And the model prediction proves that σ p When valid, asserts that the server correctly implements data forgetting.

9. A method for verifying forgotten machine learning data, using the machine learning data forgetting verification system according to any one of claims 1 to 8, characterized in that: The following steps are involved: S1. The server packages the dataset D uploaded by the user into the filter to construct an index kid for each data point d∈D in the dataset, links the data point d with the index kid, and stores it in the data storage component; S2, reading the data set D from the data storage component through the index kid, performing machine learning of the target learning method F based on the initial model M0 in the trusted execution environment, obtaining a first model M1, and storing it in the model linked list component; Return the first model M1 to the user; S3. When a data forgetting request is received, the data forgetting operation is performed by the filter in the trusted execution environment, and the data point d in the data storage component is deleted by the index kid. u ∈D, and the first model M1 in the model list component, and generate a data deletion proof σ d ; S4, reading the data set D' after the data is deleted from the data storage component, re-performing the machine learning of the target learning method F in the trusted execution environment, obtaining the second model M2, and storing it in the model linked list component; Generative model learning proves σ m , and returns the second model M2 and the model learning proof σ to the user m ; S5. When a prediction request is received, the test data t is obtained, and the second model M2 is read from the model list component through the index kid; the prediction is performed through the filter in the trusted execution environment, the test data t is input into the second model M2, and the prediction result p and the model prediction proof σ are output. p ; S6. User proves data deletion σ d , model learning proof σ m And the model prediction proves that σ p Verify that the server is correctly performing data forgetting.

10. A storage medium having computer-readable instructions stored thereon, characterized in that: When the computer-readable instructions are executed by a processor, the steps of the machine learning data forgetting verification method as described in claim 9 are implemented.

Images