Method and system for training and testing on encrypted classical data

Abstract

The invention belongs to the technical field of quantum neural networks, and discloses a method and system for allowing a quantum neural network to train and test on encrypted classical data. The classic client firstly trains a simple classic neural network (as an encryptor En) to encrypt original input data and then sends ciphertext data to the quantum cloud server for QNN training, and the two models are cooperatively trained together; when the En and the QNN are trained, the classic client directly uses the En to encrypt input data and then sends the input data to the quantum cloud server to use the QNN to test; and obtaining a prediction result of the QNN after testing. According to the method, the client is not required to have quantum capability, extra interaction except training and testing is not needed, so that the communication overhead is reduced, and the model performance of the QNN is not reduced. In addition, the method does not increase too much calculation cost.

Description

Technical Field

[0001] The present invention belongs to the field of quantum neural network and cloud computing technology, and in particular to a method and system that allow quantum neural network to be trained and tested on encrypted classical data. Background Art

[0002] In recent years, classical neural network (NN) technology has developed rapidly and has been widely used in processing data classification, data regression, data generation and other tasks. At the same time, quantum computing (QC), a new computing mode that follows the laws of quantum mechanics, is also developing rapidly and has been proven to be more advantageous than classical computing in solving certain specific problems. As a new technology that cross-integrates QC and NN, quantum neural network is expected to use the potential advantages of QC to enhance the performance of NN, such as improving the accuracy of model prediction or speeding up the training process. However, quantum computers are still in the early stages of development, and they are expensive and have a harsh operating environment. Only a few institutions have real quantum computers. In the short term, ordinary users will not have strong quantum capabilities to train and test QNN models. However, just as customers with limited classical computing resources can entrust NN training or testing to cloud servers, customers with no quantum capabilities or limited quantum capabilities can also use quantum cloud servers to perform quantum computing. However, directly uploading sensitive data to quantum cloud servers for quantum computing will lead to privacy leakage of input data. At the same time, training QNN models is usually costly. When training QNN models directly on quantum cloud servers, the models may be used by the server to provide prediction services to other users for profit, or they may be stolen by third-party attackers. Therefore, the privacy of QNN models is also worthy of attention.

[0003] In order to solve the above problems, there are some technologies that can be used to train or test on encrypted data to protect the privacy of input data or models of cloud computing-based QNNs. These technologies mainly include quantum homomorphic encryption (QHE) and blind quantum computing (BQC). Most QHE technologies require the client to be able to prepare quantum data (possess or prepare quantum data, or encode classical data into quantum data) and operate quantum data (for example, execute X and Z quantum gates to encrypt quantum data) and even measure quantum data, without considering the needs of pure classical clients. In addition, QHE cannot protect the privacy of QNN models. BQC technology requires the client and the quantum cloud server to perform multiple additional interactions during the execution of the quantum algorithm to drive quantum computing. Each time a quantum gate is executed, an interaction is required, which will increase a lot of communication overhead. In addition, most BQC technologies require the client's minimum quantum capability to prepare quantum bits. In addition, technologies based on conversion networks (referred to as encryption networks or encryptors in this invention) inspired by adversarial attacks can well protect the privacy of classical neural networks. The main idea of ​​this technology is that the customer trains a classical neural network to encrypt classical data, and then sends the encrypted data to the server to train or test the privacy-protected classical neural network model for predicting data. However, this type of technology has not yet been used for privacy protection of QNN. At the same time, this type of technology also has the problem of increasing the customer's large classical computing cost (for example, training two generative adversarial networks) and reducing model performance, or only allowing testing on encrypted classical data but not training.

[0004] Through the above analysis, the problems and defects of the prior art are as follows:

[0005] (1) Due to the high cost of quantum computers and their strict operating environment, clients with no or limited quantum capabilities will face privacy leakage issues of input data and models when using quantum cloud servers to perform QNN training or testing. Existing technologies for protecting the privacy of QNNs require clients to have quantum capabilities and increase client communication overhead.

[0006] (2) Most privacy protection technologies based on QHE are only for clients with certain quantum capabilities, and do not consider purely classical clients to protect the privacy of their classical data. At the same time, QHE cannot protect the model privacy of QNN.

[0007] (3) Most privacy protection technologies based on BQC will increase communication overhead and reduce efficiency and practicality. In addition, this technology also requires smaller quantum capabilities from customers.

[0008] (4) Encrypted network-based technologies that can effectively protect the privacy of classical neural networks have not yet been applied to the privacy protection of QNNs. In addition, such technologies will reduce the performance of neural network models and bring more classical computing costs to customers, or cannot simultaneously meet customers' needs for training and testing neural network models on encrypted classical data. Summary of the invention

[0009] In view of the problems existing in the prior art, the present invention provides a method and system that allow quantum neural networks to be trained and tested on encrypted classical data.

[0010] The present invention specifically designs a new framework that allows quantum neural networks (QNNs) to be trained and tested on encrypted classical data to protect the privacy of user data and models. The framework includes two alternately trained models: an encryptor En and a predictor QNN. The classical client first trains En defined by a classical neural network to map plaintext input data to very different ciphertext data to protect data privacy. Then, the ciphertext data is sent to a quantum cloud server to train QNN to indirectly predict the label of the plaintext data, and En is also trained to generate ciphertext data that is no more difficult to learn than plaintext data without affecting the performance of QNN. After both En and QNN are trained, the client can send the data encrypted by En to the server for prediction using QNN, and obtain almost the same prediction results as the QNN trained using plaintext data.

[0011] The present invention is achieved by a method that allows quantum neural networks to be trained and tested on encrypted classical data, the method comprising:

[0012] S1: Set up the overall framework called Encrypted Collaborative Network (ECN). The framework ECN includes two entities: the classical client and the quantum cloud server, and two models: the encryptor En and the predictor QNN;

[0013] S2: In ECN, the classic client first trains a simple classical neural network (as an encryptor En) to encrypt the original classical input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together. When both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing.

[0014] S3: After testing, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN trained directly on plaintext data.

[0015] Furthermore, the training process of the encryptor En and the predictor QNN is as follows:

[0016] The client first inputs the plaintext sample x into the encryptor En, and obtains the output x'=En(x), which is the encrypted sample; then the client calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'; the goal of the encryptor is to make x' and x be distinguished to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc );L enc It can be written as:

[0017] L enc =E x ||x-En(x)|| p (1)

[0018] in, Indicates L p norm, which is often used to measure distance. We minimize (1-L enc ) as the optimization goal 1 of ECN;

[0019] After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'; then calculates the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN;

[0020] The client trains QNN and En simultaneously to minimize L pre ; L pre As the optimization goal of ECN2;

[0021] The objective function or total loss of the entire ECN network can be written as:

[0022] L = α*(1-L enc )+β*L pre (2)

[0023] Among them, α and β are used to control the importance of each target; Target 1 and Target 2 are optimized alternately, first train En once to optimize Target 1, then train En and QNN once to optimize Target 2, until the total loss is within an acceptable range, that is, less than the expected loss or the maximum number of training times is reached;

[0024] After the training is completed, the customer saves the trained encryptor En, and the quantum cloud server saves the trained QNN model (or its quantum part, the classical part is also saved by the customer).

[0025] Furthermore, the goal of the QNN is to indirectly and accurately predict the label of x through x', that is, to make the prediction error of the QNN as small as possible;

[0026] The goal of En is to make x' no more difficult to learn by QNN than x when it is very different from x; to achieve this goal, the encryptor En can be made to make L pre The smallest direction is used to generate x' for x, rather than generating it randomly; that is, En should cooperate with QNN to generate x'.

[0027] Furthermore, the L pre Different machine learning tasks can have different definitions. For example, in classification tasks, it is often defined by cross entropy. Definition, in regression tasks, it is often represented by the mean square error

[0028] Definition; It can be seen that n*MSE=(L2) 2 , MSE is proportional to the L2 norm, so L enc Can also be defined by MSE.

[0029] Further, the test of the QNN model is as follows:

[0030] During the testing phase, customers will use the trained QNN model to predict new data without labeled labels. To protect data security, customers will first use the trained encryptor En to encrypt the new input data x into ciphertext input data x' and then send it to the quantum cloud server to run the trained QNN model. Finally, the QNN model outputs a predicted label y' that is almost identical to the prediction result of the QNN model trained on the plaintext training data. In other words, the performance of QNN will not decrease due to data encryption.

[0031] Furthermore, during the training and testing of the QNN, the quantum cloud server can only perform calculations on encrypted data and cannot access the original input data. The ECN framework ensures the privacy of the user's input data. In addition, the QNN in the ECN framework is trained on encrypted data. It can only learn the knowledge of encrypted data and predict encrypted data with high accuracy, but cannot accurately predict the original data. The quantum cloud server and third-party attackers cannot directly use the ECN-based QNN model to more accurately predict the original data without the client's trained encryptor. Therefore, the framework can also unexpectedly protect the model privacy of the QNN.

[0032] Another object of the present invention is to provide a system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data. The system comprises:

[0033] The training module is connected to the framework setting module. In ECN, the classic client first trains a simple classical neural network (as an encryptor En) to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together;

[0034] Testing module, when En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

[0035] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0036] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0037] Another object of the present invention is to provide an information data processing terminal, characterized in that the information data processing terminal is used to implement the system that allows quantum neural networks to be trained and tested on encrypted classical data.

[0038] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0039] First, this invention applies encrypted network technology to privacy protection of quantum neural networks in cloud environments for the first time, and designs a new method that allows quantum neural networks to be trained and tested on encrypted classical data. In this method, customers simultaneously train simple classical neural networks for encrypted data and quantum neural networks for predicting data.

[0040] This method only requires classical clients to have classical computing capabilities that can run simple classical neural networks, solving the problem that quantum homomorphic encryption technology and blind quantum computing technology require clients to have certain quantum capabilities, and the high classical computing costs brought by encryption network technology or only allowing testing on encrypted classical data. At the same time, in the method of the present invention, the encryption network is not only trained to generate ciphertext data that is completely different from the plaintext data to protect data privacy, but the difficulty of learning the generated ciphertext data by QNN is not greater than that of the plaintext data, which solves the problem that the existing encryption network technology reduces model performance.

[0041] Since the QNN based on the method of the present invention is trained on encrypted data, it can only learn the knowledge of encrypted data and predict the encrypted data with high accuracy, but cannot accurately predict the original data. The quantum cloud server and third-party attackers cannot directly use the trained QNN model on the cloud to accurately predict the original data without the client's trained encrypted neural network. Therefore, although the QNN model is not completely private to the quantum cloud server, the prediction function of the model is protected, and there is no need to increase a large amount of communication overhead to keep the quantum computing on the cloud private, as in blind quantum computing technology.

[0042] The method of the present invention allows quantum neural networks to be trained and tested on encrypted classical data, which can realize secure entrusted quantum neural networks in a cloud environment, that is, it provides a method for protecting the privacy of user input data and models for classical users who use quantum cloud servers to train and test quantum neural network models. Compared with previous methods, this method does not require users to have quantum capabilities and does not increase additional communication overhead except for training and testing. This method will not reduce the performance of quantum neural networks while protecting data and model privacy, and is applicable to a variety of QNN models. In addition, this method does not increase too much computing cost.

[0043] Second, the present invention proposes a method that allows quantum neural networks in a cloud environment to be trained and tested on encrypted classical data. This method can help clients without quantum capabilities use quantum cloud services to train a quantum neural network model whose performance will not be reduced due to encryption and used for subsequent testing while protecting the privacy of their data and models. This method also avoids unnecessary communication overhead and improves the efficiency of quantum neural network training and testing while protecting the privacy of the model. The additional computational cost of this method is only to train a simple classical encrypted neural network, which is friendly to classical clients.

[0044] The technical solution of the present invention fills the technical gap in the industry at home and abroad: the existing research on privacy protection of quantum neural networks based on cloud computing mainly revolves around the application of quantum homomorphic encryption technology and blind quantum computing technology. Encrypted network technology can already protect the privacy of classical neural networks in cloud environments, but this type of technology has not yet been applied to the privacy protection of quantum neural networks. This invention applies encrypted network technology to the privacy protection of data and models of quantum neural networks in cloud environments for the first time. The applied encrypted network technology is also innovative and solves the problems existing in existing encrypted network technology. This provides a new direction for the research on privacy protection of quantum neural networks.

[0045] Third, the innovative method provided by the present invention allows quantum neural networks to be trained and tested on encrypted classical data, and its significant technical advances are reflected in the following aspects:

[0046] 1. Synergy between encryption and computing:

[0047] This method closely combines encryption with the computing process of quantum neural networks, encrypts the original input data through the encryptor En trained by the classical client, and ensures the security of the data during transmission.

[0048] This collaborative training method not only ensures data privacy, but also enables the quantum cloud server to train quantum neural networks without direct access to the original data, thus resolving the contradiction between data privacy and computing needs.

[0049] 2. Efficient use of quantum computing resources:

[0050] By sending encrypted data to a quantum cloud server for training a quantum neural network (QNN), this method can efficiently utilize quantum computing resources and avoid expensive quantum computing locally.

[0051] This approach lowers the threshold for quantum computing, enabling more research institutions and companies to take advantage of quantum computing and promoting the popularization and application of quantum computing technology.

[0052] 3. Maintain forecast accuracy:

[0053] Although the data is encrypted before transmission, the method ensures that the QNN prediction results obtained after testing are almost equivalent to those obtained by training directly on the plaintext data by jointly training the encryptor En and the quantum neural network QNN.

[0054] This maintenance of prediction accuracy is crucial for practical applications, allowing this method to protect data privacy without sacrificing model performance.

[0055] 4.Flexibility and versatility:

[0056] This method does not rely on a specific encryption algorithm or quantum neural network structure and therefore has high flexibility and versatility.

[0057] Different encryptors and quantum neural networks can be selected and adjusted according to specific needs to suit different application scenarios and data types.

[0058] The present invention combines encryption technology and quantum computing to achieve efficient quantum neural network training and testing while protecting data privacy, which is a significant technological advancement and innovation. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a flow chart of a method for allowing quantum neural networks to be trained and tested on encrypted classical data provided by an embodiment of the present invention;

[0060] Figure 2 It is a schematic diagram of the principle of a classic client training a QNN with the help of a local classic computer and a quantum cloud server provided by an embodiment of the present invention;

[0061] Figure 3 It is a process in which a classical client provided by an embodiment of the present invention runs a QNN to test data by using a local classical computer and a quantum cloud server;

[0062] Figure 4 It is a schematic diagram of the principle that a classic client according to an embodiment of the present invention trains a QNN based on an ECN framework on encrypted data with the help of a local classic computer and a quantum cloud server;

[0063] Figure 5 It is a process in which a classic client provided by an embodiment of the present invention uses a local classic computer and a quantum cloud server to run a QNN based on an ECN framework to test encrypted data;

[0064] Figure 6 It is a 4-qubit VQC used to construct the QCCNN provided by an embodiment of the present invention; the number of dashed boxes (variable layers of the VQC) and the number of specifically measured qubits can be adjusted in different learning tasks;

[0065] Figure 7 The original training images and the ciphertext images generated before the encryptor is trained and after the training converges are provided in the embodiment of the present invention; (1) four types of training images, (2) ciphertext images obtained by the untrained encryptor En, (3) ciphertext images generated by En after the training converges;

[0066] Figure 8The encrypted test image predicted by QCCNN_ECN provided in the embodiment of the present invention is (1) the original image and its label (2) the ciphertext image and its label and predicted category;

[0067] Fig. 9 It is a comparison between the training prediction loss Lpre and the training accuracy of QCCNN_ECN and QCCNN in image classification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0069] like Figure 1 As shown, an embodiment of the present invention provides a method for allowing a quantum neural network to be trained and tested on encrypted classical data, the method comprising:

[0070] S1: Set up the overall framework called Encrypted Collaborative Network (ECN). The framework ECN includes two entities: the classical client and the quantum cloud server, and two models: the encryptor En and the predictor QNN;

[0071] S2: In ECN, the classic client first trains a simple classical neural network (as an encryptor En) to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together. When both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing.

[0072] S3: After testing, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN trained directly on plaintext data.

[0073] Given a training data set in and is the feature vector of the ith data sample and its label, is the jth feature of the ith sample, and a suitable model F. After training, F can learn the mapping relationship between training data x and its label y that obeys the unknown probability distribution p1 and is used to predict the label of new (non-training) data that obeys the same distribution p1. However, when F is a QNN and ordinary users do not have quantum capabilities, users can send data to the quantum cloud server for QNN (or the quantum part of QNN) calculations. The process of training and testing QNN on plaintext data is as follows: Figure 2 and Figure 3As shown. A full quantum neural network has only the quantum part, while a hybrid quantum classical neural network includes a quantum part consisting of quantum circuits and a classical part of a classical neural network layer. The classical part can be executed by the customer himself or by a cloud server that integrates quantum computing and classical computing.

[0075] The working principle of this method is based on the encrypted collaborative network (ECN) framework, which allows quantum neural networks (QNN) to be trained and tested on encrypted classical data without direct access to the original data. The key to this method is to jointly train the two models of classical encryptor (En) and quantum predictor (QNN) to ensure data privacy without sacrificing the prediction ability of QNN. The following is the detailed working principle:

[0076] S1: Setting up the ECN

[0077] Classical client and quantum cloud server: The system consists of two parts. The classical client is responsible for data preprocessing and encryption, while the quantum cloud server is responsible for training and testing quantum neural networks.

[0078] Encryptor En and Predictor QNN: Encryptor En is a simple classical neural network used to encrypt raw data into ciphertext to ensure the security of data during transmission and processing. QNN is a quantum neural network on the quantum cloud server side, used to train and test encrypted data.

[0079] S2: Co-training and data processing

[0080] Encrypting the original data: The classic client first uses the encryptor En to encrypt the original input data to generate ciphertext data. This step ensures the privacy of the data, and the data will not be maliciously accessed by a third party during network transmission and quantum server processing.

[0081] Quantum cloud server training QNN: The encrypted data is sent to the quantum cloud server, and the QNN on the server is trained on these encrypted data. During the training process, the QNN is specially designed to adapt to and learn the distribution of encrypted data without decrypting the data.

[0082] Co-training: The encryptor En and the predictor QNN are trained together, which means that during the training process, the encryption method of the encryptor En will be adjusted according to the training requirements of QNN to optimize the learning effect of QNN.

[0083] S3: Testing and Prediction

[0084] Testing encrypted data: After training is completed, when new input data needs to be predicted, the classic client uses the trained encryptor En to encrypt the data and sends the ciphertext data to the QNN on the quantum cloud server for testing.

[0085] Accuracy of prediction results: Since En and QNN are trained collaboratively, QNN can achieve similar prediction accuracy on encrypted data as on plaintext data. In this process, the privacy of the original data is protected because the data remains encrypted during transmission and processing between the classical client and the quantum cloud server.

[0086] In this way, the method effectively solves the challenge of using quantum neural networks to process encrypted data while protecting data privacy. This not only provides a new solution for quantum computing in processing sensitive data, but also opens up new avenues for the practical application of quantum machine learning.

[0087] When the user's data contains sensitive information, the user does not want the data to be public, but wants to obtain the results of quantum computing on the data by the quantum cloud server. Therefore, the user can use an encryption method En to map the training sample x to a very different ciphertext sample En(x), that is, En(x) obeys the new distribution p2, and then send En(x) to the quantum cloud server. The QNN directly learns the mapping relationship between En(x) and y, and indirectly learns the mapping between x and y. At the same time, En should make it no more difficult for QNN to learn the mapping relationship between En(x) and y than to directly learn the mapping relationship between x and y. For example, in the classification task, the features of the same type of data in the p1 distribution are always similar, so the same type of data in the p1 distribution should also have similar features when transformed to the p2 distribution, that is, the features of each data have changed, but the direction of change of the features of the same type of data is similar. Finally, in the inference stage, the user can directly use En to encrypt the new data and send it to the server, and then use the trained QNN to predict the encrypted data and obtain the inference result.

[0088] Based on the above ideas, a method is designed to allow quantum neural networks (QNNs) to be trained and tested on encrypted classical data. It is summarized as follows: The overall framework of this method is called encrypted collaborative network (ECN). The framework ECN includes two entities: the classical client and the quantum cloud server, and two models: the encryptor En and the predictor QNN. In ECN, the classical client first trains a simple classical neural network (as the encryptor En) to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together. Once En and QNN are trained, the classical client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing. Finally, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN trained directly on plaintext data. During the training and reasoning process of QNN, the quantum cloud server can only perform calculations on encrypted data and cannot access the original input data. This framework ensures the privacy of the user's input data. In addition, the QNN in the ECN framework is trained on encrypted data. It can only learn the knowledge of encrypted data and predict encrypted data with high accuracy, but cannot accurately predict the original data. Quantum cloud servers and third-party attackers cannot directly use the ECN-based QNN model to accurately predict the original data without the client's trained encryptor. Therefore, the framework can also unexpectedly protect the privacy of the QNN model.

[0089] The method that allows quantum neural networks (QNN) to be trained and tested on encrypted classical data includes two stages: 1. training the encryptor En and the QNN model based on the ECN framework; 2. testing the QNN model based on the ECN framework.

[0090] 1. Train the Encryptor En and QNN model based on the ECN framework

[0091] The training principles of En and QNN are as follows Figure 4 As shown, and is a training data (sample) of a customer containing n features and its feature vector of labels, x j ∈R is the jth feature of the sample. The following is the detailed training process.

[0092] The client first inputs the plaintext sample x into the encryptor En, and obtains the output x'=En(x), which is the encrypted sample. Then the client calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'. The goal of the encryptor is to make x and x' distinguishable to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc). enc It can be written as:

[0093] L enc =E x ||x-En(x)|| p (1)

[0094] in, Indicates L p norm, often used to measure distance. We minimize (1-L enc ) as the optimization goal 1 of ECN.

[0095] After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'. Then calculate the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN. The goal of QNN is to indirectly and accurately predict the label of x through x', that is, to make the prediction error of QNN as small as possible. Another goal of the encryptor is to make x' less difficult to learn by QNN than x. We found that in order to achieve this goal, the encryptor En can move towards making L pre The minimum direction is used to generate x' for x, rather than randomly. In other words, En should cooperate with QNN to generate x'. Therefore, the client needs to train QNN and En at the same time to minimize L pre We will L pre As the optimization goal of ECN2.

[0096] L pre Different machine learning tasks can have different definitions. For example, in classification tasks, it is often defined by cross entropy. Definition, in regression tasks, it is often represented by the mean square error Definition. It can be seen that n*MSE=(L2) 2 , MSE is proportional to the L2 norm, so L enc Can also be defined by MSE.

[0098] The objective function or total loss of the entire ECN network can be written as:

[0099] L = α*(1-L enc )+β*L pre (2)

[0100] Among them, α and β are used to control the importance of each target. Target 1 and Target 2 are optimized alternately. First, En is trained once to optimize Target 1, and then En and QNN are trained once to optimize Target 2, until the total loss is within an acceptable range, that is, less than the expected loss, or the maximum number of training times is reached. Of course, during the training phase, users usually take m training data, that is, a training data set. To train the model, the loss will take the average of the losses of all training data, that is, or where x (i) is the i-th training data.

[0101] After the training is completed, the customer saves the trained encryptor En, and the quantum cloud server saves the trained QNN model (or its quantum part, the classical part is also saved by the customer).

[0102] 2. Testing of the QNN model based on the ECN framework

[0103] During the testing phase, customers will use the trained QNN model to predict new data without labeled labels. To protect data security, customers first use the trained encryptor En to encrypt the new input data x into ciphertext input data x' and then send it to the quantum cloud server to run the trained QNN model. Finally, the QNN model outputs a predicted label y' that is almost the same as the prediction result of the QNN model trained on the plaintext training data. In other words, the performance of QNN will not decrease due to data encryption.

[0104] Figure 5 The process of testing encrypted data for privacy-preserving QNN based on the ECN framework is demonstrated. The input data owned locally by the classic client is not open to the quantum cloud server, and the privacy of the data is protected. At the same time, the trained QNN model that the cloud server can obtain can only accurately predict the data encrypted by En because it does not directly learn the features of the plaintext data. The privacy of the trained QNN model is also unexpectedly protected.

[0105] like Figure 4 , 5 The embodiment of the present invention provides a system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data. The system includes:

[0106] The training module is connected to the framework setting module. In ECN, the classic client first trains a simple classical neural network (as an encryptor En) to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together;

[0107] Testing module, when En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

[0108] An embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0109] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0110] An embodiment of the present invention provides an information data processing terminal, characterized in that the information data processing terminal is used to implement the system that allows quantum neural networks to be trained and tested on encrypted classical data. Specific embodiment:

[0112] A hybrid quantum classical convolutional neural network (QCCNN, a quantum neural network commonly used for image classification) is trained and tested on encrypted image data as a specific embodiment. In order to distinguish it from the QCCNN trained and tested on the original image data, the QCCNN trained and tested on the encrypted image data is called "QCCNN_ECN".

[0113] 1. Introduction to image data and QCCNN model

[0114] Here we use part of the data in the MNIST dataset to conduct a four-category experiment on images. The MNIST dataset is a benchmark dataset for image classification, containing 60,000 training images and 10,000 test images. Each image is a 28x28 pixel grayscale image of a handwritten number, and the label is the corresponding number. Each pixel or feature of each image is an integer between 0 and 255. We preprocess it into a real number between 0 and 1 for the convenience of the experiment. For each of the four categories of images 1, 3, 7, and 9 in the MNIST dataset, we randomly select 50 training images and 30 test images, that is, there are a total of 200 training samples and 120 test samples in this experiment.

[0115] For the four-classification task of MINST, the quantum part of QCCNN_ECN is a quantum convolution layer with a convolution kernel size of 2x2, a step size of 2, and an output channel number of 4 as the input layer to extract the features of the image, where the convolution kernel is as follows: Figure 6 The VQC shown has 3 variational layers and measures the expected value of the observable PauliZ of each qubit as the value of each output channel. The classical part of QCCNN_ECN sequentially contains a maximum pooling layer with a kernel size of 2 and a stride of 2, a fully connected layer with 64 neurons and an activation function of ReLU, and a fully connected layer with 4 neurons. The output value of each neuron in the last layer represents the probability that the sample belongs to the corresponding category; En is an encryptor matching QCCNN_ECN, with an input layer of 28x28=784 neurons, a hidden layer of 4 neurons and an activation function ReLU, and an output layer of 784 neurons and an activation function Sigmoid. QCCNN has the same structure as QCCNN_ECN, but QCCNN does not have a matching En.

[0116] 2. QCCNN_ECN training and testing on encrypted image data

[0117] 2.1 Training

[0118] The training process is mainly divided into the following four steps:

[0119] (1) The client first uses the encryptor En to encrypt all the original images for training. Mapped to an encrypted image, where θ En is the model parameter of En. Then the client calculates the encryption loss L enc , represents the distance between the original image and the encrypted image, that is:

[0120]

[0121] Then, the client uses the classic optimizer 1 to update the parameters of En by gradient descent: Among them l En is the learning rate of the classic optimizer1.

[0122] (2) The client regenerates the encrypted sample with the updated parameter En Send it to the quantum cloud server, run the QCCNN_ECN model with the help of the server, and get the output of QCCNN_ECN That is, the predicted label, where θ QCCNN_ECN is the model parameter of QCCNN_ECN. Then calculate the prediction loss Represents the distance between the predicted label and the true label, that is, the prediction error of QCCNN_ECN.

[0123] (3) The client uses the classic optimizer 2 to update the parameters of QCCNN_ECN by gradient descent, that is, Among them l QCCNN_ECN is the learning rate of the classic optimizer 2, and the parameters of En are updated using the gradient descent method using the classic optimizer 1, i.e.

[0124] (4) The client calculates the total objective function L = α*(1-L enc )+β*L pre If L is less than or equal to the expected error el or the number of training iterations has reached the maximum number of training iterations tmax, continue with step 4, otherwise repeat steps (1) to (3).

[0125] The customer saves the trained encryptor En, the quantum cloud server saves the quantum part of the trained QCCNN_ECN model, and the classical part of QCCNN_ECN is also saved by the customer.

[0126] Figure 7 (1) is the four types of training images we randomly selected, with four samples in each type. We encrypt them using the untrained encryptor En and the trained En respectively. The generated ciphertext images are as follows: Figure 7 (2) and Figure 7 (3) As shown in Figure 3, both encrypted images can be well distinguished from the plaintext image, completely covering the features of the plaintext image and protecting the privacy of the original image. However, Figure 7 Similar images in (2) do not have obvious similar features and cannot be distinguished by the human eye, which makes it difficult for the model to learn. Figure 7 Images of the same type in (3) will have similar features and can be distinguished from images of different types, so the difficulty of model learning will not be too high. Therefore, we found a suitable encryption method, En, for this image classification task.

[0127] 2.2 Testing

[0128] During the testing phase, when customers want to predict new image data, they can first encrypt it using the trained En, and then send it to the quantum cloud server to run QCCNN_ECN and obtain the prediction results.

[0129] Figure 8 (1) are five randomly selected test images. The customer directly encrypts them using the trained encryptor En, and obtains the following: Figure 8(2) shows the ciphertext image, and then uses the trained QCCNN_ECN to classify the ciphertext image. It can be seen that when the quantum cloud server has no contact with the plaintext image, QCCNN_ECN still gives the correct classification result. Therefore, ECN can enable the entrusted quantum convolutional neural network to be trained and tested on encrypted images without affecting the final prediction accuracy of the model.

[0130] 3. Comparison between QCCNN_ECN and QCCNN

[0131] Fig. 9 Table 1 shows the performance comparison of QCCNN_ECN for encrypted image datasets and QCCNN for original image datasets. It can be found that QCCNN_ECN is not affected by encryption, and the converged prediction loss and training accuracy are consistent with QCCNN. The training convergence speed is even slightly faster than QCCNN, and the test accuracy is the same as QCCNN.

[0132] Table 1 Test accuracy of QCCNN_ECN and QCCNN in image classification

[0133]

[0134] 4. Model privacy of QCCNN_ECN

[0135] Customers usually only expose the quantum part of QCCNN_ECN to the quantum cloud server, so the complete model of QCCNN_ECN itself is secure. Now, assume that the classical part of QCCNN_ECN is also run by a classical cloud server (or a server that integrates classical and quantum cloud computing). Table 2 shows the comparison of the classification accuracy of the fully public QCCNN_ECN on encrypted and original datasets. It can be seen that the trained QCCNN_ECN performs well only on data encrypted by En owned by the customer, but performs poorly on plaintext data. Cloud servers and third-party model stealers cannot directly use the QCCNN_ECN model to predict plaintext data. This shows that the method that allows quantum neural networks to be trained and tested on encrypted classical data can indeed protect the model privacy of the QCCNN_ECN model.

[0136] Table 2 Training accuracy and test accuracy of QCCNN_ECN on the original dataset and encrypted dataset respectively

[0137]

[0138] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. A person of ordinary skill in the art will appreciate that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0139] The method provided by the embodiment of the present invention for allowing quantum neural networks to be trained and tested on encrypted classical data is a newly designed encryption network technology for privacy protection. The comparison of this technology with other privacy protection technologies is shown in Table 3. The quantum homomorphic encryption technology and blind quantum computing technology in the table only represent these two mainstream technologies. First, from the perspective of the implementation function of the technology, the technology of the present invention has the advantage of protecting the privacy of the model in addition to protecting the data privacy of the quantum neural network compared with the quantum homomorphic encryption technology. Secondly, from the perspective of the customer's capability requirements and computing costs, the biggest advantage of the encryption network technology compared with the other two technologies is that it does not require the customer to have quantum capabilities, and the computing cost is not very high, which is very friendly to classical customers. Finally, from the perspective of additional communication overhead, the advantage of the encryption network technology over the other two technologies is that during the operation of the quantum neural network (or its quantum part), the customer does not need to communicate and interact with the quantum cloud server, which improves the efficiency of quantum neural network training and testing.

[0140] Table 3 Comparison of privacy protection techniques for quantum neural networks

[0141]

[0142] Based on the working principle of the above-mentioned encrypted collaborative network (ECN) framework, two specific embodiments are listed below to demonstrate the practicality and effect of this method in different application scenarios.

[0143] Example 1: Medical data analysis

[0144] In the medical field, protecting patients' privacy data is crucial. Using this method, we can conduct in-depth analysis of medical data without leaking patients' sensitive information.

[0145] 1. Classic client preparation stage: As a classic client, the hospital has a large number of patient medical records that need to be analyzed. The hospital uses a simple classical neural network as an encryptor (En) to encrypt the patient's original medical records, such as medical records, test results, etc., and convert them into ciphertext data.

[0146] 2. Quantum cloud server training phase: The encrypted medical data is sent to the quantum cloud server, and the quantum neural network (QNN) on the server is trained on this data, aiming to learn and predict the development trend of the disease or the patient's recovery probability.

[0147] 3. Testing and application stage: When there is new patient data to be analyzed, the hospital uses the encryptor En again to encrypt it and send it to the quantum cloud server. QNN is tested on the encrypted data, and the prediction results help doctors make more accurate diagnosis and treatment decisions.

[0148] Example 2: Financial Fraud Detection

[0149] In the financial industry, using machine learning models to detect fraud is a common application scenario. However, this involves a large amount of sensitive personal and transaction data, and the protection of data privacy is particularly critical.

[0150] 1. Classic client preparation stage: A bank, as a classic client, has a large amount of transaction data. The bank uses a simple classic neural network encryptor (En) to encrypt the transaction data, converting personal information, transaction amount, etc. into ciphertext to ensure the security and privacy of the data during the processing.

[0151] 2. Quantum cloud server training phase: Encrypted transaction data is sent to the quantum cloud server, and the quantum neural network (QNN) on the server is specially trained to identify potential fraudulent behavior patterns.

[0152] 3. Testing and application phase: In actual operation, the bank encrypts new transaction data and sends it to the quantum cloud server. The QNN on the quantum server tests the encrypted data, detects and warns of potential fraud in a timely manner, helps banks reduce losses and improve service security.

[0153] These two embodiments demonstrate how to apply the Encrypted Collaborative Network (ECN) framework to scenarios that process sensitive data, which not only protects data privacy but also leverages the advantages of quantum computing to improve the efficiency and accuracy of data processing and analysis.

[0154] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method allowing quantum neural networks to be trained and tested on encrypted classical data, characterized in that The method includes: Set up an encrypted collaborative network framework, including a classical client and a quantum cloud server, as well as two models: the encryptor En and the quantum predictor QNN; In ECN, the classic client uses the encryptor En to encrypt the original input data, generate ciphertext data and send it to the quantum cloud server; The quantum cloud server receives the encrypted data and trains it using the quantum predictor QNN; The encryptor En and the quantum predictor QNN are trained collaboratively to optimize the learning effect of QNN on encrypted data; After the training is completed, the classic client uses the encryptor En to encrypt the new input data and sends it to the quantum cloud server for testing; The quantum predictor QNN is tested on the encrypted data and outputs a prediction that is almost identical to the prediction of the QNN trained on the plaintext data.

2. The method according to claim 1, characterized in that The collaborative training of the encryptor En and the quantum predictor QNN includes: The encryptor En adjusts the encryption method according to the training requirements of the quantum predictor QNN to optimize the learning effect of QNN on the encrypted data; The quantum predictor QNN adapts and learns the distribution of encrypted data during training, and can be trained and tested without decrypting data; Through the iterative training process, the encryption method of the encryptor En and the prediction ability of the quantum predictor QNN are continuously optimized until the predetermined training goal is reached. S3: After the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on the plaintext data.

3. A method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in claim 1, characterized in that The specific training process of the encryptor En and the predictor QNN is as follows: The client first inputs the plaintext sample x into the encryptor En, and obtains the output x'=En(x), which is the encrypted sample; then the client calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'; the goal of the encryptor is to make x and x' distinguishable to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc );L enc It can be written as: L enc =E x ||x-In(x)|| p (1), in, Indicates L p norm, which is often used to measure distance. We minimize (1-L enc ) as the optimization target 1 of ECN; After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'; then calculates the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN; The client trains QNN and En simultaneously to minimize L pre ; L pre As the optimization goal of ECN2; The objective function or total loss of the entire ECN network can be written as: L=α*(1-L enc )+β*L pre (2) Among them, α and β are used to control the importance of each target; Target 1 and Target 2 are optimized alternately, first train En once to optimize Target 1, then train En and QNN once to optimize Target 2, until the total loss is within an acceptable range, that is, less than the expected loss or the maximum number of training times is reached; After the training is completed, the customer saves the trained encryptor En, and the quantum cloud server saves the trained QNN model (or its quantum part, the classical part is also saved by the customer).

4. A method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in claim 3, characterized in that The goal of the QNN is to indirectly and accurately predict the label of x through x', that is, to make the prediction error of the QNN as small as possible; The goal of En is to make x' less difficult to learn by QNN than x; to achieve this goal, the encryptor En can be made to make L pre The smallest direction is used to generate x' for x, rather than generating it randomly; that is, En should cooperate with QNN to generate x'.

5. A method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in claim 3, characterized in that The L pre Different machine learning tasks can have different definitions. For example, in classification tasks, it is often defined by cross entropy. Definition, in regression tasks, it is often represented by the mean square error Definition; It can be seen that n*MSE=(L2) 2 , MSE is proportional to the L2 norm, so L enc It can also be defined by MSE. In the training phase, users usually take m training data, i.e. a training data set. To train the model, the loss will take the average of the losses of all training data, that is, or where x (i) is the i-th training data.

6. A method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in claim 1, characterized in that The test of the QNN model is as follows: During the testing phase, customers will use the trained QNN model to predict new data without labeled labels. To protect data security, customers will first use the trained encryptor En to encrypt the new input data x into ciphertext input data x' and then send it to the quantum cloud server to run the trained QNN model. Finally, the QNN model outputs a predicted label y' that is almost identical to the prediction result of the QNN model trained on the plaintext training data. In other words, the performance of QNN will not decrease due to data encryption.

7. A method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in claim 1, characterized in that During the training and reasoning process of the QNN, the quantum cloud server can only perform calculations on encrypted data and cannot access the original input data. The framework ensures the privacy of the user's input data. In addition, the QNN in the ECN framework is trained on encrypted data. It can only learn the knowledge of encrypted data and predict encrypted data with high accuracy, but cannot accurately predict the original data. The quantum cloud server and third-party attackers cannot directly use the ECN-based QNN model to more accurately predict the original data without the client's trained encryptor. Therefore, the framework can also unexpectedly protect the model privacy of the QNN.

8. A system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in any one of claim 17, characterized in that: The system includes: The training module is connected to the framework setting module. In ECN, the classic client first trains a simple classical neural network (as an encryptor En) to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The two models are trained together; Testing module, when En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

9. A computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data as claimed in any one of claim 16.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the system as claimed in claim 7 that allows quantum neural networks to be trained and tested on encrypted classical data.

Images