Method and system for training and testing on encrypted classical data

Abstract

The present invention belongs to the field of quantum neural network technology and discloses a method and system that allows quantum neural networks to be trained and tested on encrypted classical data. The method includes: in an ECN, a classical client first trains a simple classical neural network (as an encryptor En) to encrypt the original input data and then sends the encrypted data to a quantum cloud server for QNN training. The two models are trained together; when both En and QNN are trained, the classical client directly uses En to encrypt the input data and then sends it to the quantum cloud server for testing using QNN; after testing, the QNN's prediction results are obtained. The present invention does not require the client to have quantum capabilities and does not require additional interactions beyond training and testing, thereby reducing communication overhead and not degrading the QNN model performance. In addition, this method does not increase computing costs significantly.

Description

Technical Field

[0001] The present invention belongs to the fields of quantum neural networks and cloud computing technology, and in particular to a method and system that allow quantum neural networks to be trained and tested on encrypted classical data. Background Art

[0002] In recent years, classical neural network (NN) technology has rapidly developed and is widely used in tasks such as data classification, regression, and generation. Simultaneously, quantum computing (QC), a new computing paradigm based on the laws of quantum mechanics, has also rapidly advanced and has been shown to offer advantages over classical computing for solving certain problems. Quantum neural networks, a new technology that integrates QC and NN, hold promise for leveraging the potential advantages of QC to enhance NN performance, such as improving model prediction accuracy or accelerating training. However, quantum computers are still in the early stages of development, are expensive, and operate in demanding environments. Only a few institutions possess actual quantum computers. In the short term, it will be difficult for ordinary users to acquire the powerful quantum capabilities required to train and test QNN models. However, just as customers with limited classical computing resources can delegate NN training or testing to cloud servers, customers with limited or no quantum capabilities can leverage quantum cloud servers to perform quantum computing. However, directly uploading sensitive data to quantum cloud servers for quantum computing raises concerns about the privacy of the input data. Furthermore, training QNN models is typically costly. When training QNN models directly on a quantum cloud server, the model could be used by the server to provide prediction services to other users for profit, or could be stolen by third-party attackers. Therefore, the privacy of QNN models is also worthy of attention.

[0003] To address the above issues, several technologies have been developed to protect the privacy of input data or models for cloud-based QNNs by training or testing on encrypted data. These technologies primarily include quantum homomorphic encryption (QHE) and blind quantum computation (BQC). Most QHE technologies require the client to be able to prepare quantum data (possess or prepare quantum data, or encode classical data into quantum data), manipulate quantum data (for example, executing X and Z quantum gates to encrypt quantum data), and even measure quantum data, without considering the needs of purely classical clients. Furthermore, QHE cannot protect the privacy of QNN models. BQC technologies require multiple additional interactions between the client and the quantum cloud server during the execution of the quantum algorithm to drive quantum computation. Each interaction requires one interaction for each quantum gate execution, which adds significant communication overhead. Furthermore, most BQC technologies require the client to have at least the quantum capability to prepare qubits. Furthermore, technologies based on transformation networks (referred to as encryption networks or encryptors in this document), inspired by adversarial attacks, can effectively protect the privacy of classical neural networks. The key idea behind this technology is that clients train a classical neural network to encrypt classical data, then send the encrypted data to a server to train or test a privacy-preserving classical neural network model for predictive data. However, this technology has not yet been used for privacy protection in QNNs. Furthermore, this technology can significantly increase clients' classical computing costs (for example, training two generative adversarial networks), reduce model performance, or only allow testing on encrypted classical data, preventing training.

[0004] Through the above analysis, the problems and defects of the existing technology are as follows:

[0005] (1) Due to the high cost of quantum computers and their strict operating environment, clients without or with limited quantum capabilities face privacy issues when using quantum cloud servers to train or test QNNs. Existing technologies for protecting the privacy of QNNs have the disadvantages of requiring clients to have quantum capabilities and increasing their communication overhead.

[0006] (2) Most privacy protection technologies based on QHE are only targeted at clients with certain quantum capabilities and do not consider purely classical clients to protect the privacy of their classical data. At the same time, QHE cannot protect the privacy of QNN models.

[0007] (3) Most privacy protection technologies based on BQC will increase communication overhead and reduce efficiency and practicality. In addition, this technology also requires less quantum capability from the client.

[0008] (4) Encrypted network-based technologies that can effectively protect the privacy of classical neural networks have not yet been applied to QNN privacy protection. In addition, such technologies will reduce the performance of neural network models and bring more classical computing costs to customers, or they may not be able to simultaneously meet customers' needs for training and testing neural network models on encrypted classical data. Summary of the Invention

[0009] In response to the problems existing in the prior art, the present invention provides a method and system that allow quantum neural networks to be trained and tested on encrypted classical data.

[0010] The present invention specifically designs a new framework that allows quantum neural networks (QNN) to be trained and tested on encrypted classical data to protect the privacy of user data and models. The framework contains two alternately trained models: an encryptor En and a predictor QNN. The classical client first trains En, defined by a classical neural network, to map plaintext input data to very different ciphertext data to protect data privacy. The ciphertext data is then sent to a quantum cloud server to train the QNN to indirectly predict the label of the plaintext data, while also training En to generate ciphertext data that is no more difficult to learn than the plaintext data without affecting the performance of the QNN. After both En and QNN are trained, the client can send the data encrypted by En to the server for prediction using the QNN, and obtain prediction results that are almost the same as those of the QNN trained using the plaintext data.

[0011] The present invention is achieved by a method that allows quantum neural networks to be trained and tested on encrypted classical data, the method comprising:

[0012] S1: Set up the overall framework called Crypto Collaborative Network (ECN). The framework ECN includes two entities: the classical client and the quantum cloud server, and two models: the encryptor En and the predictor QNN;

[0013] S2: In ECN, the classic client first trains a simple classical neural network (as the encryptor En) to encrypt the original classical input data and then sends the encrypted data to the quantum cloud server for QNN training. The two models are trained together. When both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server for testing using the QNN.

[0014] S3: After testing, the prediction result of the QNN is obtained, which is almost equivalent to the prediction result of the QNN trained directly on the plaintext data.

[0015] Furthermore, the training process of the encryptor En and the predictor QNN is as follows:

[0016] The client first inputs the plaintext sample x into the encryptor En and obtains the output x'=En(x), which is the encrypted sample; then the client calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'; the goal of the encryptor is to make x' and x be distinguishable to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc );L enc It can be written as:

[0017] L enc =E x ||x-En(x)|| p (1),

[0018] in, Indicates L p Norm, often used to measure distance. We will minimize (1-L enc ) as the optimization goal 1 of ECN;

[0019] After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'; then calculates the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN;

[0020] The client trains QNN and En simultaneously to minimize L pre ; L pre As the optimization goal of ECN2;

[0021] The objective function or total loss of the entire ECN network can be written as:

[0022] L=α*(1-L enc )+β*L pre (2)

[0023] Among them, α and β are used to control the importance of each objective; Objective 1 and Objective 2 are optimized alternately, first training En once to optimize Objective 1, then training En and QNN once to optimize Objective 2, until the total loss is within an acceptable range, that is, less than the expected loss or the maximum number of training times is reached;

[0024] After the training is completed, the customer saves the trained encryptor En, and the quantum cloud server saves the trained QNN model (or its quantum part, the classical part is also saved by the customer).

[0025] Furthermore, the goal of the QNN is to indirectly and accurately predict the label of x through x', that is, to make the prediction error of the QNN as small as possible;

[0026] The goal of En is to make x' no more difficult to learn by QNN than x when it is very different from x; to achieve this goal, the encryptor En can move towards making L pre The smallest direction is used to generate x' for x, rather than generating it randomly; that is, En should cooperate with QNN to generate x'.

[0027] Furthermore, the L pre Different machine learning tasks can have different definitions. For example, in classification tasks, cross entropy is often used. Definition, in regression tasks, it is often represented by the mean square error

[0028] Definition; It can be seen that n*MSE=(L2) 2 , MSE is proportional to the L2 norm, so L enc Can also be defined by MSE.

[0029] Furthermore, the test of the QNN model is as follows:

[0030] During the testing phase, customers will use the trained QNN model to predict new data without labels. To protect data security, customers will first use the trained encryptor En to encrypt the new input data x into ciphertext input data x' and then send it to the quantum cloud server to run the trained QNN model. Finally, the QNN model outputs a predicted label y' that is almost identical to the prediction result of the QNN model trained on the plaintext training data. In other words, the performance of the QNN will not decline due to data encryption.

[0031] Furthermore, during the training and testing of the QNN, the quantum cloud server can only perform calculations on encrypted data and cannot access the original input data. The ECN framework ensures the privacy of the user's input data. In addition, the QNN in the ECN framework is trained on encrypted data. It can only learn the knowledge of encrypted data and predict encrypted data with high accuracy, but cannot accurately predict the original data. The quantum cloud server and third-party attackers cannot directly use the ECN-based QNN model to accurately predict the original data without the client's trained encryptor. Therefore, the framework can also unexpectedly protect the privacy of the QNN model.

[0032] Another object of the present invention is to provide a system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data. The system comprises:

[0033] The training module is connected to the framework setup module. In ECN, the classic client first trains a simple classical neural network (as the encryptor En) to encrypt the original input data and then sends the encrypted data to the quantum cloud server for QNN training. The two models are trained together.

[0034] In the testing module, when both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

[0035] Another object of the present invention is to provide a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0036] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0037] Another object of the present invention is to provide an information data processing terminal, characterized in that the information data processing terminal is used to implement the system that allows quantum neural networks to be trained and tested on encrypted classical data.

[0038] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0039] First, this invention applies encrypted network technology to privacy protection for quantum neural networks in a cloud environment for the first time, designing a new method that allows quantum neural networks to be trained and tested on encrypted classical data. In this method, clients simultaneously train a simple classical neural network for encrypted data and a quantum neural network for predicting data.

[0040] This method only requires classical clients to have the classical computing power to run simple classical neural networks, resolving the issues of quantum homomorphic encryption and blind quantum computing requiring clients to possess certain quantum capabilities, and the high classical computing costs or limited testing on encrypted classical data associated with encryption network technologies. Furthermore, in the method of the present invention, the encryption network is not only trained to generate ciphertext data that is completely different from the plaintext data to protect data privacy, but the generated ciphertext data is no more difficult for the QNN to learn than the plaintext data, thus resolving the issue of reduced model performance associated with existing encryption network technologies.

[0041] Because the QNN based on the method of the present invention is trained on encrypted data, it can only learn knowledge about the encrypted data and predict it with high accuracy, but cannot accurately predict the original data. Without the client's trained encrypted neural network, the quantum cloud server and third-party attackers cannot directly use the trained QNN model on the cloud to accurately predict the original data. Therefore, although the QNN model is not completely private to the quantum cloud server, its prediction function is protected, and there is no need to increase the large amount of communication overhead required to keep the quantum computing on the cloud private, as in blind quantum computing technology.

[0042] The method disclosed herein allows for the training and testing of quantum neural networks on encrypted classical data, enabling secure, delegated quantum neural networks in a cloud environment. This provides a method for protecting the privacy of user input data and models when training and testing quantum neural network models on a quantum cloud server. Compared to previous methods, this method does not require quantum capabilities and does not impose additional communication overhead beyond training and testing. This method protects data and model privacy without degrading quantum neural network performance and is applicable to a variety of QNN models. Furthermore, it does not significantly increase computational costs.

[0043] Second, this invention proposes a method that allows quantum neural networks to be trained and tested on encrypted classical data in a cloud environment. This method allows clients without quantum capabilities to use quantum cloud services to train a quantum neural network model, whose performance is not degraded by encryption, while protecting the privacy of their data and models, and to use it for subsequent testing. This method also avoids unnecessary communication overhead, improving the efficiency of quantum neural network training and testing while protecting model privacy. The additional computational cost of this method is limited to training a simple classical encrypted neural network, making it user-friendly for classical clients.

[0044] The technical solution of this invention fills a technological gap in the industry, both domestically and internationally. Existing research on privacy protection for quantum neural networks based on cloud computing primarily focuses on the application of quantum homomorphic encryption and blind quantum computing. While encryption network technology can already protect the privacy of classical neural networks in cloud environments, this technology has yet to be applied to the privacy of quantum neural networks. This invention is the first to apply encryption network technology to the privacy protection of quantum neural network data and models in cloud environments. The applied encryption network technology is also innovative, resolving issues with existing encryption network technology. This provides a new direction for research on privacy protection in quantum neural networks.

[0045] Third, the innovative method provided by this invention allows quantum neural networks to be trained and tested on encrypted classical data, and its significant technical advancements are reflected in the following aspects:

[0046] 1. Synergy between encryption and computing:

[0047] This method closely combines encryption with the computing process of quantum neural networks, encrypting the original input data through the encryptor En trained by the classical client to ensure the security of the data during transmission.

[0048] This collaborative training method not only ensures data privacy, but also enables quantum cloud servers to train quantum neural networks without direct access to the original data, thus resolving the contradiction between data privacy and computing needs.

[0049] 2. Efficient use of quantum computing resources:

[0050] By sending encrypted data to a quantum cloud server for quantum neural network (QNN) training, this method can efficiently utilize quantum computing resources and avoid expensive quantum computing locally.

[0051] This approach lowers the threshold for quantum computing, enabling more research institutions and companies to take advantage of quantum computing and promoting the popularization and application of quantum computing technology.

[0052] 3. Maintain forecast accuracy:

[0053] Although the data is encrypted before transmission, the method ensures that the QNN prediction results obtained after testing are almost equivalent to the prediction results obtained by training directly on the plaintext data by jointly training the encryptor En and the quantum neural network QNN.

[0054] This maintenance of prediction accuracy is crucial for practical applications, allowing this method to protect data privacy without sacrificing model performance.

[0055] 4. Flexibility and versatility:

[0056] This method does not rely on a specific encryption algorithm or quantum neural network structure, so it has high flexibility and versatility.

[0057] Different encryptors and quantum neural networks can be selected and adjusted according to specific needs to adapt to different application scenarios and data types.

[0058] By combining encryption technology and quantum computing, this invention achieves efficient quantum neural network training and testing while protecting data privacy, which is a significant technological advancement and innovation. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a flow chart of a method for allowing quantum neural networks to be trained and tested on encrypted classical data, provided by an embodiment of the present invention;

[0060] Figure 2 This is a schematic diagram of the principle of a classical client training a QNN using a local classical computer and a quantum cloud server, as provided by an embodiment of the present invention;

[0061] Figure 3 This is the process provided by the embodiment of the present invention whereby the classical client uses a local classical computer and a quantum cloud server to run a QNN to test data;

[0062] Figure 4 This is a schematic diagram of the principle of a classical client, provided by an embodiment of the present invention, using a local classical computer and a quantum cloud server to train a QNN based on an ECN framework on encrypted data;

[0063] Figure 5 This is the process provided by the embodiment of the present invention whereby a classical client uses a local classical computer and a quantum cloud server to run a QNN based on the ECN framework to test encrypted data;

[0064] Figure 6 This is a 4-qubit VQC used in constructing the QCCNN provided by an embodiment of the present invention; the number of dashed boxes (variable layers of the VQC) and the number of specifically measured qubits can be adjusted in different learning tasks;

[0065] Figure 7 The original training images and the ciphertext images generated before and after the training convergence of the encryptor provided in the embodiment of the present invention are: (1) four types of training images, (2) ciphertext images obtained by the untrained encryptor En, (3) ciphertext images generated by En after the training convergence;

[0066] Figure 8The encrypted test image predicted by QCCNN_ECN provided by the embodiment of the present invention is (1) the original image and its label (2) the ciphertext image and its label and predicted category;

[0067] Figure 9 This is a comparison of the training prediction loss Lpre and training accuracy of QCCNN_ECN and QCCNN in image classification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0069] like Figure 1 As shown, an embodiment of the present invention provides a method for allowing quantum neural networks to be trained and tested on encrypted classical data, the method comprising:

[0070] S1: Set up the overall framework called Crypto Collaborative Network (ECN). The framework ECN includes two entities: the classical client and the quantum cloud server, and two models: the encryptor En and the predictor QNN;

[0071] S2: In ECN, the classic client first trains a simple classical neural network (as the encryptor En) to encrypt the original input data and then sends the encrypted data to the quantum cloud server for QNN training. The two models are trained together. When both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server for testing using QNN.

[0072] S3: After testing, the prediction result of the QNN is obtained, which is almost equivalent to the prediction result of the QNN trained directly on the plaintext data.

[0073] Given a training dataset in and

[0074] is the feature vector of the i-th data sample and its label, For the jth feature of the i-th sample, and a suitable model F, F can learn the mapping relationship between training data x and its label y that obeys the unknown probability distribution p1 after training and can be used to predict the label of new (non-training) data that obeys the same distribution p1. However, when F is a QNN and ordinary users do not have quantum capabilities, users can send data to the quantum cloud server for QNN (or the quantum part of QNN) calculations. The process of training and testing QNN on plaintext data is as follows Figure 2and Figure 3 As shown in Figure 2, a full quantum neural network consists only of a quantum component, while a hybrid quantum-classical neural network includes both a quantum component (composed of quantum circuits) and a classical component (classical neural network layers). The classical component can be executed by the customer themselves or by a cloud server that integrates quantum and classical computing.

[0075] The method works based on the CryptoCollaborative Network (ECN) framework, which allows quantum neural networks (QNNs) to be trained and tested on encrypted classical data without direct access to the original data. The key to this method is the collaborative training of two models, the classical encryptor (En) and the quantum predictor (QNN), to ensure data privacy without sacrificing the predictive power of the QNN. The following is a detailed working principle:

[0076] S1: Setting up an Encrypted Collaborative Network (ECN)

[0077] Classical client and quantum cloud server: The system consists of two parts. The classical client is responsible for data preprocessing and encryption, while the quantum cloud server is responsible for training and testing quantum neural networks.

[0078] Encryptor En and Predictor QNN: Encryptor En is a simple classical neural network used to encrypt raw data into ciphertext, ensuring data security during transmission and processing. QNN is a quantum neural network on the quantum cloud server, used to train and test encrypted data.

[0079] S2: Collaborative training and data processing

[0080] Encrypting the original data: The classic client first encrypts the original input data using the encryptor En to generate ciphertext data. This step ensures the privacy of the data, preventing it from being maliciously accessed by third parties during network transmission and processing on the quantum server.

[0081] Training QNNs on a quantum cloud server: Encrypted data is sent to a quantum cloud server, where the QNNs on the server are trained on this encrypted data. During training, the QNNs are specially designed to adapt to and learn the distribution of encrypted data without having to decrypt the data.

[0082] Collaborative training: The encryptor En and the predictor QNN are trained together, which means that during the training process, the encryption method of the encryptor En will be adjusted according to the training requirements of the QNN to optimize the learning effect of the QNN.

[0083] S3: Testing and Prediction

[0084] Testing encrypted data: After training is completed, when new input data needs to be predicted, the classic client uses the trained encryptor En to encrypt the data and sends the ciphertext data to the QNN on the quantum cloud server for testing.

[0085] Accuracy of prediction results: Because En and QNN are trained collaboratively, QNN can achieve similar prediction accuracy on encrypted data as on plaintext data. The privacy of the original data is protected because the data remains encrypted during transmission and processing between the classical client and the quantum cloud server.

[0086] In this way, the method effectively solves the challenge of using quantum neural networks to process encrypted data while protecting data privacy. This not only provides a new solution for quantum computing in processing sensitive data, but also opens up new avenues for the practical application of quantum machine learning.

[0087] When a user's data contains sensitive information, they may not want it publicly available, but they still want to access the results of quantum computing performed on the data by a quantum cloud server. Therefore, the user can use an encryption method En to map a training sample x into a very different ciphertext sample En(x), where En(x) follows a new distribution p2. En(x) is then sent to the quantum cloud server, where the QNN directly learns the mapping between En(x) and y, thereby indirectly learning the mapping between x and y. Furthermore, En should make learning the mapping between En(x) and y no more difficult than directly learning the mapping between x and y. For example, in a classification task, similar data from the p1 distribution always have similar features. Therefore, similar data from the p1 distribution should also have similar features when transformed to the p2 distribution. This means that the features of each data item change, but the direction of change is similar. Finally, during the inference phase, the user can directly encrypt the new data using En and send it to the server. The trained QNN can then predict the encrypted data and obtain the inference results.

[0088] Based on the above ideas, a method was designed to allow quantum neural networks (QNNs) to be trained and tested on encrypted classical data. The method is summarized as follows: The overall framework of this method is called an Encrypted Collaborative Network (ECN). The ECN framework consists of two entities: a classical client and a quantum cloud server, and two models: an encryptor En and a predictor QNN. In the ECN, the classical client first trains a simple classical neural network (serving as the encryptor En) to encrypt the original input data, then sends the encrypted data to the quantum cloud server for QNN training. The two models are trained collaboratively. Once En and the QNN are trained, the classical client can directly use En to encrypt the input data and send it to the quantum cloud server for testing using the QNN. The resulting QNN predictions are nearly identical to those obtained by training the QNN directly on plaintext data. During QNN training and inference, the quantum cloud server can only perform computations on encrypted data and cannot access the original input data. This framework ensures the privacy of the user's input data. Furthermore, the QNN in the ECN framework is trained on encrypted data. It can only learn about the encrypted data and predict it with high accuracy, but cannot accurately predict the original data. Without the client's trained encryptor, quantum cloud servers and third-party attackers cannot directly use the ECN-based QNN model to accurately predict the original data. Therefore, the framework unexpectedly protects the privacy of the QNN model.

[0089] The method that allows quantum neural networks (QNNs) to be trained and tested on encrypted classical data consists of two stages: 1. training the encryptor En and the QNN model based on the ECN framework; 2. testing the QNN model based on the ECN framework.

[0090] 1. Training the Encryptor En and QNN model based on the ECN framework

[0091] The training principles of En and QNN are as follows Figure 4 As shown, and is a feature vector of a customer's training data (sample) containing n features and its label, x j ∈R is the jth feature of the sample. The following is the detailed training process.

[0092] The client first inputs the plaintext sample x into the encryptor En and obtains the output x'=En(x), which is the encrypted sample. The client then calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'. The goal of the encryptor is to make x and x' distinguishable to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc). L enc It can be written as:

[0093] L enc =E x ||x-En(x)|| p (1),

[0094] in, Indicates L p Norm, often used to measure distance. We will minimize (1-L enc ) as the optimization goal of ECN1.

[0095] After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'. Then calculate the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN. The goal of QNN is to indirectly and accurately predict the label of x through x', that is, to make the prediction error of QNN as small as possible. Another goal of the encryptor is to make x' no more difficult to learn by QNN than x. We found that in order to achieve this goal, the encryptor En can move towards making L pre The smallest direction is used to generate x' for x, rather than randomly generating it. In other words, En should cooperate with QNN to generate x'. Therefore, the client should train QNN and En at the same time to minimize L pre We will L pre As the optimization goal of ECN2.

[0096] L pre Different machine learning tasks can have different definitions. For example, in classification tasks, cross entropy is often used. Definition, in regression tasks, it is often represented by the mean square error

[0097] Definition. It can be seen that n*MSE=(L2) 2 , MSE is proportional to the L2 norm, so L enc Can also be defined by MSE.

[0098] The objective function or total loss of the entire ECN network can be written as:

[0099] L=α*(1-L enc )+β*L pre (2)

[0100] Among them, α and β are used to control the importance of each target. Target 1 and Target 2 are optimized alternately. First, En is trained once to optimize Target 1, and then En and QNN are trained once to optimize Target 2, until the total loss is within an acceptable range, that is, less than the expected loss, or the maximum number of training times is reached. Of course, during the training phase, users usually take m training data, that is, a training dataset. To train the model, the loss will take the average of the loss of all training data, that is, or where x (i) is the i-th training data.

[0101] After the training is completed, the customer saves the trained encryptor En, and the quantum cloud server saves the trained QNN model (or its quantum part, the classical part is also saved by the customer).

[0102] 2. Testing of the QNN model based on the ECN framework

[0103] During the testing phase, customers will use the trained QNN model to predict new, unlabeled data. To protect data security, customers first encrypt the new input data x using the trained encryptor En to ciphertext input data x', then send this data to the quantum cloud server to run the trained QNN model. The QNN model ultimately outputs a predicted label y' that is nearly identical to the predictions of the QNN model trained on the plaintext training data. This means that QNN performance is not degraded by data encryption.

[0104] Figure 5 This demonstration demonstrates the process of encrypting data for a privacy-preserving QNN test using the ECN framework. The input data held locally by the classical client is not available to the quantum cloud server, thus protecting data privacy. Furthermore, the trained QNN model available to the cloud server can only accurately predict data encrypted with En, as it does not directly learn the characteristics of the plaintext data. This surprisingly preserves the privacy of the trained QNN model.

[0105] like Figure 4 、 5 The embodiment of the present invention provides a system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data. The system includes:

[0106] The training module is connected to the framework setup module. In ECN, the classic client first trains a simple classical neural network (as the encryptor En) to encrypt the original input data and then sends the encrypted data to the quantum cloud server for QNN training. The two models are trained together.

[0107] In the testing module, when both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

[0108] An embodiment of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0109] An embodiment of the present invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data.

[0110] An embodiment of the present invention provides an information data processing terminal, characterized in that the information data processing terminal is used to implement the system that allows quantum neural networks to be trained and tested on encrypted classical data. Specific embodiment:

[0112] As a specific example, a hybrid quantum-classical convolutional neural network (QCCNN), a quantum neural network commonly used for image classification, is trained and tested on encrypted image data. To distinguish it from the QCCNN trained and tested on raw image data, the QCCNN trained and tested on encrypted image data is referred to as "QCCNN_ECN."

[0113] 1. Introduction to image data and QCCNN model

[0114] Here, we use data from the MNIST dataset for a four-category image classification experiment. The MNIST dataset is a benchmark dataset for image classification, containing 60,000 training images and 10,000 test images. Each image is a 28x28 pixel grayscale image of a handwritten digit, with the label being the corresponding digit. Each pixel, or feature, in each image is an integer between 0 and 255. We preprocess these features into real numbers between 0 and 1 for experimental convenience. For each of the four image categories 1, 3, 7, and 9 in the MNIST dataset, we randomly select 50 training images and 30 test images, resulting in a total of 200 training samples and 120 test samples for this experiment.

[0115] For the four-classification task of MINST, the quantum part of QCCNN_ECN is a quantum convolution layer with a convolution kernel size of 2x2, a step size of 2, and an output channel number of 4 as the input layer to extract image features, where the convolution kernel is as follows: Figure 6 The VQC shown has 3 variational layers and measures the expected value of the observable PauliZ for each qubit as the value of each output channel. The classical part of QCCNN_ECN consists of a max pooling layer with a kernel size of 2 and a stride of 2, a fully connected layer with 64 neurons and a ReLU activation function, and a fully connected layer with 4 neurons. The output value of each neuron in the last layer represents the probability that the sample belongs to the corresponding category. En is the encryptor that matches QCCNN_ECN. Its input layer has 28x28=784 neurons, the hidden layer has 4 neurons and a ReLU activation function, and the output layer has 784 neurons and a Sigmoid activation function. QCCNN has the same structure as QCCNN_ECN, but QCCNN does not have a matching En.

[0116] 2. QCCNN_ECN training and testing on encrypted image data

[0117] 2.1 Training

[0118] The training process is mainly divided into the following four steps:

[0119] (1) The client first uses the encryptor En to encrypt all the original images for training Mapped to an encrypted image, where θ En is the model parameter of En. Then the client calculates the encryption loss L enc , represents the distance between the original image and the encrypted image, that is:

[0120]

[0121] Then, the client uses the classic optimizer 1 to update the parameters of En by gradient descent: where l En is the learning rate of the classic optimizer1.

[0122] (2) The client regenerates the encrypted sample with the updated En parameter Send it to the quantum cloud server, run the QCCNN_ECN model with the help of the server, and get the output of QCCNN_ECN That is, the predicted label, where θ QCCNN_ECN It is the model parameter of QCCNN_ECN. Then calculate the prediction loss Represents the distance between the predicted label and the true label, that is, the prediction error of QCCNN_ECN.

[0123] (3) The client uses the classic optimizer 2 to update the parameters of QCCNN_ECN by gradient descent method, that is, where l QCCNN_ECN is the learning rate of the classic optimizer 2, and the parameters of En are updated using the gradient descent method of the classic optimizer 1, i.e.

[0124] (4) The client calculates the total objective function L = α*(1-L enc )+β*L pre If L is less than or equal to the expected error el or the number of training iterations has reached the maximum number of training iterations tmax, then continue with step 4, otherwise repeat steps (1) to (3).

[0125] The customer saves the trained encryptor En, the quantum cloud server saves the quantum part of the trained QCCNN_ECN model, and the classical part of QCCNN_ECN is also saved by the customer.

[0126] Figure 7 (1) is the four types of training images we randomly selected, with four samples in each type. We encrypt them using the untrained encryptor En and the trained En after convergence, and the generated ciphertext images are as follows: Figure 7 (2) and Figure 7 (3) shows that both encrypted images can be well distinguished from the plaintext image, completely covering the features of the plaintext image and protecting the privacy of the original image. However, Figure 7 Similar images in (2) do not have obvious similar features and cannot be distinguished by the human eye, which makes it difficult for the model to learn. Figure 7 Images of the same type in (3) will have similar features and can be distinguished from images of different types, making model learning less difficult. Therefore, we found a suitable encryption method for this image classification task, namely En.

[0127] 2.2 Testing

[0128] During the testing phase, when customers want to predict new image data, they can first encrypt it using the trained En, and then send it to the quantum cloud server to run QCCNN_ECN and obtain the prediction results.

[0129] Figure 8 (1) are five randomly selected test images. The customer directly encrypts them using the trained encryptor En, and obtains the following: Figure 8The ciphertext image shown in (2) is then classified using the trained QCCNN_ECN. It can be seen that even without the quantum cloud server having access to the plaintext image, the QCCNN_ECN still gives the correct classification result. Therefore, ECN can enable the commissioned quantum convolutional neural network to be trained and tested on encrypted images without affecting the final prediction accuracy of the model.

[0130] 3. Comparison between QCCNN_ECN and QCCNN

[0131] Figure 9 Table 1 shows a performance comparison of QCCNN_ECN on the encrypted image dataset and QCCNN on the original image dataset. It can be seen that QCCNN_ECN is not affected by encryption, with its converged prediction loss and training accuracy consistent with those of QCCNN. Its training convergence speed is even slightly faster than QCCNN, and its test accuracy is also the same as QCCNN.

[0132] Table 1 Test accuracy of QCCNN_ECN and QCCNN in image classification

[0133]

[0134] 4. Model Privacy of QCCNN_ECN

[0135] Customers typically only expose the quantum portion of QCCNN_ECN to quantum cloud servers, so the complete QCCNN_ECN model itself is secure. Now, assume that the classical portion of QCCNN_ECN is also run by a classical cloud server (or a server that integrates classical and quantum cloud computing). Table 2 compares the classification accuracy of the fully public QCCNN_ECN on encrypted and original datasets. As can be seen, the trained QCCNN_ECN performs well only on data encrypted with En owned by the customer, but performs poorly on plaintext data. Cloud servers and third-party model stealers cannot directly use the QCCNN_ECN model to predict plaintext data. This demonstrates that allowing quantum neural networks to be trained and tested on encrypted classical data can indeed protect the privacy of the QCCNN_ECN model.

[0136] Table 2 Training accuracy and test accuracy of QCCNN_ECN on the original dataset and encrypted dataset respectively

[0137]

[0138] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on a carrier medium such as a disk, CD or DVDROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., or can be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0139] The method provided by the embodiments of the present invention, which allows quantum neural networks to be trained and tested on encrypted classical data, is a newly designed encryption network technology for privacy protection. A comparison of this technology with other privacy protection technologies is shown in Table 3. The quantum homomorphic encryption technology and blind quantum computing technology in the table only represent these two mainstream technologies. First, from the perspective of the technical implementation function, the technology of the present invention has the advantage over quantum homomorphic encryption technology in that it not only protects the data privacy of the quantum neural network but also the privacy of the model. Second, from the perspective of customer capability requirements and computing costs, the biggest advantage of encryption network technology over the other two technologies is that it does not require customers to have quantum capabilities, and the computing cost is not very high, which is very friendly to classical customers. Finally, from the perspective of additional communication overhead, the advantage of encryption network technology over the other two technologies is that during the operation of the quantum neural network (or its quantum part), the customer does not need to communicate with the quantum cloud server, which improves the efficiency of quantum neural network training and testing.

[0140] Table 3 Comparison of privacy protection technologies for quantum neural networks

[0141]

[0142] Based on the working principle of the above-mentioned Encrypted Collaborative Network (ECN) framework, two specific embodiments are listed below to demonstrate the practicality and effectiveness of this method in different application scenarios.

[0143] Example 1: Medical Data Analysis

[0144] In the medical field, protecting patients' privacy data is crucial. Using this method, we can conduct in-depth analysis of medical data without leaking patients' sensitive information.

[0145] 1. Classic Client Preparation Phase: As a classic client, the hospital has a large number of patient medical records that need to be analyzed. The hospital uses a simple classical neural network as an encryptor (En) to encrypt the patient's original medical records, such as medical records and test results, and convert them into ciphertext data.

[0146] 2. Quantum cloud server training phase: The encrypted medical data is sent to the quantum cloud server, where the quantum neural network (QNN) is trained to learn and predict the development trend of the disease or the patient's recovery probability.

[0147] 3. Testing and Application Phase: When new patient data needs to be analyzed, the hospital encrypts it again using Encryptor and sends it to the quantum cloud server. The QNN is tested on the encrypted data, and the predicted results help doctors make more accurate diagnoses and treatment decisions.

[0148] Example 2: Financial Fraud Detection

[0149] In the financial industry, using machine learning models to detect fraud is a common application scenario. However, this involves a large amount of sensitive personal and transaction data, and protecting data privacy is particularly critical.

[0150] 1. Classic Client Preparation Stage: A bank, acting as a classic client, holds a large amount of transaction data. The bank uses a simple classic neural network encryptor (En) to encrypt the transaction data, converting personal information and transaction amounts into ciphertext to ensure data security and privacy during processing.

[0151] 2. Quantum cloud server training phase: Encrypted transaction data is sent to the quantum cloud server, where the quantum neural network (QNN) is trained specifically to identify potential fraudulent behavior patterns.

[0152] 3. Testing and Application Phase: In actual operations, banks encrypt new transaction data and send it to the quantum cloud server. The QNN on the quantum server performs tests on the encrypted data, promptly detecting and issuing warnings about potential fraud, helping banks reduce losses and improve service security.

[0153] These two examples demonstrate how to apply the Encrypted Collaborative Network (ECN) framework to scenarios where sensitive data is processed, which not only protects data privacy but also leverages the advantages of quantum computing to improve the efficiency and accuracy of data processing and analysis.

[0154] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method allowing quantum neural networks to be trained and tested on encrypted classical data, characterized in that The method includes: Set up an encryption collaboration network framework, including a classical client and a quantum cloud server, as well as two models: the encryptor En and the quantum predictor QNN. The QNN model includes both quantum and classical parts. In the encrypted collaborative network ECN, the classic client uses the encryptor En to encrypt the original input data, generate ciphertext data and send it to the quantum cloud server; The quantum cloud server receives the encrypted data and trains it using the quantum predictor QNN; The encryptor En and the quantum predictor QNN are trained collaboratively to optimize the learning effect of QNN on encrypted data; After the training is completed, the classic client uses the encryptor En to encrypt the new input data and sends it to the quantum cloud server for testing; The quantum predictor QNN is tested on the encrypted data and outputs a prediction that is almost identical to the prediction of the QNN trained on the plaintext data. The collaborative training of the encryptor En and the quantum predictor QNN includes: The encryptor En adjusts the encryption method according to the training requirements of the quantum predictor QNN to optimize the learning effect of QNN on the encrypted data; The quantum predictor QNN adapts and learns the distribution of encrypted data during training, and can be trained and tested without decrypting the data; Through the iterative training process, the encryption method of the encryptor En and the prediction ability of the quantum predictor QNN are continuously optimized until the predetermined training goal is achieved; The specific training process of the encryptor En and the predictor QNN is as follows: The client first inputs the plaintext sample x into the encryptor En and obtains the output x'=En(x), which is the encrypted sample; then the client calculates the encryption loss L enc , represents the distance between the plaintext sample x and the encrypted sample x'; the goal of the encryptor is to make x and x' distinguishable to a large extent, that is, the client needs to train the encryptor to maximize L enc , or minimize (1-L enc );L enc It can be written as: L enc =E x ||x-En(x)|| p (1), in, Indicates L p Norm, often used to measure distance; minimize (1-L enc ) as the optimization goal 1 of ECN; After optimizing target 1, the client sends the encrypted sample x' regenerated by the updated parameter En to the quantum cloud server, runs the QNN model with the help of the server, and obtains the QNN output QNN(x'), that is, the predicted label y'; then calculates the prediction loss L pre , represents the distance between the predicted label y' and the true label y, that is, the prediction error of QNN; The client trains QNN and En simultaneously to minimize L pre ; L pre As the optimization goal of ECN2; The objective function or total loss of the entire ECN network can be written as: L=α*(1-L enc )+β*L pre (2) Among them, α and β are used to control the importance of each objective; Objective 1 and Objective 2 are optimized alternately, first training En once to optimize Objective 1, then training En and QNN once to optimize Objective 2, until the total loss is within an acceptable range, that is, less than the expected loss or the maximum number of training times is reached; After the training is completed, the client saves the trained encryptor En, and the quantum cloud server saves the trained QNN model, or its quantum part. The classical part is also saved by the client.

2. The method of claim 1, wherein: The goal of the QNN is to indirectly and accurately predict the label of x through x', that is, to minimize the prediction error of the QNN; The goal of En is to make x' less difficult to learn by QNN than x; to achieve this goal, the encryptor En can move towards making L pre The smallest direction is used to generate x' for x, rather than generating it randomly; that is, En should cooperate with QNN to generate x'.

3. The method of claim 1, wherein: The L pre Different machine learning tasks can have different definitions. In classification tasks, it is defined by cross entropy. Definition, in the regression task by the mean square error Definition: In the training phase, the user uses m training data, i.e. a training data set To train the model, the loss will take the average of the loss of all training data, that is, or where x (i) is the i-th training data.

4. The method of claim 1, wherein: The test of the QNN model is as follows: During the testing phase, the trained QNN model will be used to predict new data without labeled labels. To protect data security, the new input data x is first encrypted into ciphertext input data x' using the trained encryptor En, and then sent to the quantum cloud server to run the trained QNN model. Finally, the QNN model outputs a predicted label y' that is almost identical to the prediction result of the QNN model trained on the plaintext training data.

5. The method of claim 1, wherein: During the training and inference process of the QNN, the quantum cloud server can only perform calculations on encrypted data and cannot access the original input data. This framework ensures the privacy of the user's input data.

6. A system for allowing quantum neural networks to be trained and tested on encrypted classical data, which implements the method for allowing quantum neural networks to be trained and tested on encrypted classical data as described in any one of claims 1 to 5, characterized in that: The system includes: In the training module, in ECN, the classic client first trains a simple classical neural network as an encryptor En to encrypt the original input data and then sends the ciphertext data to the quantum cloud server for QNN training. The classical neural network and QNN are trained together; In the testing module, when both En and QNN are trained, the classic client can directly use En to encrypt the input data and then send it to the quantum cloud server to use QNN for testing; after the test, the prediction result of QNN is obtained, which is almost equivalent to the prediction result of QNN obtained by directly training on plaintext data.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor performs the steps of the method for allowing quantum neural networks to be trained and tested on encrypted classical data as described in any one of claims 1 to 5.

Images