Method and device for compiling plaintext processing program into ciphertext processing program

Abstract

The embodiment of the invention provides a method and device for compiling a plaintext processing program into a ciphertext processing program. The method comprises the following steps: acquiring a plaintext processing program, wherein the plaintext processing program comprises a plurality of operators; converting each operator in the plurality of operators into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein when any operator belongs to a linear operator, the operator is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, determining a corresponding target polynomial in a polynomial fitting mode, and converting the operator into homomorphic operation corresponding to the target polynomial; and traversing each homomorphic operation in the homomorphic operation sequence, and calling a fully homomorphic encryption function corresponding to the homomorphic operation to obtain a ciphertext processing program. The development efficiency of a ciphertext processing program can be improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computers, and more particularly, to a method and apparatus for compiling a plaintext processing program into a ciphertext processing program. Background Art

[0002] Homomorphic encryption means encrypting the plaintext data first, performing addition and multiplication operations on the encrypted ciphertext, and the decrypted result is equivalent to the result of performing the same addition and multiplication operations directly on the plaintext data. Homomorphic encryption technology enables data analysis and processing without leaking the original data from the data provider, ensuring that the data is "available but invisible" during circulation and integration, and can be widely used in various industries and scenarios that require privacy protection.

[0003] Calculations on ciphertext require ciphertext processing programs, which are very difficult to develop. Developers not only need to have sufficient business knowledge, but also need to learn the theoretical basis of homomorphic encryption, understand the algorithm implementation of various processing solutions, and master the details of encryption solutions, which leads to low development efficiency. Summary of the invention

[0004] One or more embodiments of the present specification describe a method and apparatus for compiling a plaintext processing program into a ciphertext processing program, which can improve the development efficiency of the ciphertext processing program.

[0005] In a first aspect, a method for compiling a plaintext processing program into a ciphertext processing program is provided, the method comprising:

[0006] Obtaining a plaintext processing program, wherein the plaintext processing program includes a plurality of operators;

[0007] Each operator in the plurality of operators is converted into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial;

[0008] Traverse each homomorphic operation in the homomorphic operation sequence, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

[0009] In one possible implementation, the plaintext processing program is a model processing program of a pre-trained neural network model, which is used to obtain a plaintext inference result for a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, which is used to obtain a ciphertext inference result for a ciphertext input.

[0010] Furthermore, the plaintext input is held by the user end, and the ciphertext processing program is held by the server end.

[0011] In a possible implementation, the linear operator includes a convolution operator, a pooling operator or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation or a fully homomorphic rotation operation.

[0012] In a possible implementation, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0013] In a possible implementation, determining the corresponding target polynomial by polynomial fitting includes:

[0014] The fitting interval, polynomial degree and coefficient of the polynomial fitting are determined according to the operator, user prompt or runtime feedback to obtain the target polynomial.

[0015] In a possible implementation, calling a fully homomorphic encryption function corresponding to a homomorphic operation to obtain a ciphertext processing program includes:

[0016] Determine homomorphic encryption parameters, including target multiplication depth;

[0017] Inserting a bootstrap operation at a target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position is such that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth;

[0018] Each operation in the update operation sequence is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation are called according to the homomorphic encryption parameters to obtain a ciphertext processing program.

[0019] Furthermore, the target multiplication depth is determined in the following manner:

[0020] Analyzing the total multiplication depth required by the plaintext processing program;

[0021] If the total multiplication depth is less than or equal to 2 times the multiplication depth required for the bootstrap operation, then selecting the total multiplication depth as the target multiplication depth;

[0022] If the total multiplication depth is greater than the multiplication depth required by the 2-times bootstrap operation, the multiplication depth required by the 2-times bootstrap operation is selected as the target multiplication depth.

[0023] Further, the homomorphic encryption parameters include a target dimension of the polynomial ring;

[0024] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0025] Initializing a fully homomorphic encryption function corresponding to the homomorphic operation according to the target dimension of the polynomial ring;

[0026] Call the initialized fully homomorphic encryption function.

[0027] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0028] Analyze the size of the batch data processed by the operator to obtain the minimum dimension of the required polynomial ring;

[0029] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0030] Further, the homomorphic encryption parameters include a target rotation key;

[0031] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0032] When the homomorphic operation is a fully homomorphic rotation operation, initializing a fully homomorphic encryption function corresponding to the rotation operation according to the target rotation key;

[0033] Call the initialized fully homomorphic encryption function.

[0034] Furthermore, the target rotation key is determined in the following manner:

[0035] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain offsets corresponding to each fully homomorphic rotation operation;

[0036] The target rotation key is generated according to each offset.

[0037] Further, the homomorphic encryption parameters include target moduli of each variable;

[0038] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0039] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target modulus of each variable;

[0040] Call the initialized fully homomorphic encryption function.

[0041] Furthermore, the target modulus of each variable is determined in the following manner:

[0042] Determining a target modulus of each variable according to the target multiplication depth and the target dimension of the polynomial ring; or,

[0043] According to user instructions, the target modulus of each variable is determined.

[0044] In a second aspect, a device for compiling a plaintext processing program into a ciphertext processing program is provided, the device comprising:

[0045] An acquisition unit, used for acquiring a plaintext processing program, wherein the plaintext processing program includes a plurality of operators;

[0046] A conversion unit, used to convert each of the multiple operators obtained by the acquisition unit into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial;

[0047] The calling unit is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the conversion unit, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain a ciphertext processing program.

[0048] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0049] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.

[0050] Through the method and device provided in the embodiment of this specification, first obtain a plaintext processing program, the plaintext processing program includes multiple operators; then each of the multiple operators is converted into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; finally, traverse each homomorphic operation in the homomorphic operation sequence, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program. As can be seen from the above, in the embodiment of this specification, the ciphertext processing program is automatically generated by the plaintext processing program, wherein, for nonlinear operators, the conversion to the corresponding homomorphic operation is supported by polynomial fitting. Developers do not have to directly develop ciphertext processing programs, but can only develop plaintext processing programs, and subsequent plaintext processing programs can be automatically converted into ciphertext processing programs, which greatly reduces the development difficulty, thereby improving the development efficiency of ciphertext processing programs. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0052] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0053] Figure 2 A flowchart of a method for compiling a plaintext processing program into a ciphertext processing program according to one embodiment is shown;

[0054] Figure 3 A flowchart of a method for compiling a neural network model into a homomorphic encryption computing program according to one embodiment is shown;

[0055] Figure 4 A flow chart of a method for determining homomorphic encryption parameters according to one embodiment is shown;

[0056] Figure 5 A schematic block diagram of an apparatus for compiling a plaintext processing program into a ciphertext processing program according to an embodiment is shown. DETAILED DESCRIPTION

[0057] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0058] Figure 1 This is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. This implementation scenario involves compiling a plaintext processing program into a ciphertext processing program. It can be understood that the input of the plaintext processing program is plaintext data, and the output is a plaintext result. The input of the ciphertext processing program is ciphertext data, and the output is a ciphertext result. The ciphertext data is obtained by encrypting the plaintext data, and the ciphertext result can be decrypted to obtain the plaintext result. Figure 1 A typical scenario is the machine learning reasoning application scenario. In this scenario, the neural network model is deployed in the cloud, and the model parameters are plain text, which does not require encryption protection. The user end encrypts the plaintext data to be inferred into ciphertext data using fully homomorphic encryption, and then uploads it to the cloud. The cloud uses the ciphertext processing program corresponding to the neural network model to perform reasoning to obtain the ciphertext result, and returns the ciphertext result to the user end. The user end decrypts the ciphertext result to obtain the plaintext result. During the reasoning process in the cloud, the plaintext data held by the user end remains in an encrypted state, avoiding the possibility of sensitive data leakage. Among them, the above-mentioned ciphertext processing program is obtained by directly compiling the plaintext processing program corresponding to the neural network model, which can improve development efficiency. It is deployed in the cloud to realize privacy-protected machine learning reasoning applications.

[0059] In the embodiments of this specification, the neural network model can be any machine learning model, for example, a pre-trained model. A pre-trained model is a machine learning model that has been trained on a large data set and can be fine-tuned for a specific task. The pre-trained model also includes a model structure and model parameters.

[0060] Fully homomorphic encryption: It can satisfy both addition homomorphism and multiplication homomorphism at the same time. After encrypting the plaintext data, it performs homomorphic addition and multiplication operations and then decrypts it. The result is the same as the result obtained by directly performing addition and multiplication operations on the plaintext. Since the calculation process is performed in an encrypted state, the leakage of private data contained in the plaintext is avoided. Fully homomorphic encryption uses bootstrapping technology to achieve infinite depth of multiplication operations. Among them, Enc, Dec, Add and Mu l represent encryption, decryption, addition and multiplication operations respectively. Fully homomorphic encryption can be expressed as the following two sets of equations:

[0061] Dec(Add(Enc(x),Enc(y)))==Add(x,y);

[0062] Dec(Mu l(Enc(x),Enc(y)))==Mu l(x,y).

[0063] There are many fully homomorphic encryption schemes, and the corresponding fully homomorphic encryption scheme can be flexibly selected according to the specific application scenario. Among them, the CKKS scheme is more typical. CKKS scheme: It is an approximate computational homomorphic encryption scheme that supports fixed-point addition and multiplication operations in the complex field proposed by the four authors Cheon-Kim-Kim-Song at ASIACRYPT'17. The CKKS scheme does not pursue strict consistency between the decryption result and the plaintext calculation, but only retains a part of the valid digits. Compared with other homomorphic encryption schemes, the details of the CKKS scheme are greatly simplified, and the computational efficiency is greatly improved. It is suitable for application scenarios such as machine learning reasoning.

[0064] Inference: The process of using a trained and deployed machine learning model to make predictions on new real-world data.

[0065] It should be noted that machine learning reasoning is only a typical application scenario of the embodiments of this specification, and the scenarios to which the embodiments of this specification are applicable are not limited thereto. The above plain text processing program may include any operation or operator, such as addition, subtraction, multiplication, division, exponential operation, etc., which are not listed here. The purpose of the above plain text processing program may be for reasoning, or it may be used only to output the calculation results for the input data, etc.

[0066] Figure 2 A flowchart of a method for compiling a plaintext processing program into a ciphertext processing program according to an embodiment is shown. The method can be based on Figure 1 The implementation scenario shown in Figure 1 is as follows. Figure 2 As shown, the method for compiling a plaintext processing program into a ciphertext processing program in this embodiment includes the following steps: Step 21, obtaining a plaintext processing program, wherein the plaintext processing program includes multiple operators; Step 22, converting each of the multiple operators into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; Step 23, traversing each homomorphic operation in the homomorphic operation sequence, calling the fully homomorphic encryption function corresponding to the homomorphic operation, and obtaining the ciphertext processing program. The specific execution method of each of the above steps is described below.

[0067] First, in step 21, a plaintext processing program is obtained, and the plaintext processing program includes multiple operators. It can be understood that an operator is a mapping from a function space to a function space, and the mapping form is not limited, depending on the specific application scenario.

[0068] In one example, the plaintext processing program is a model processing program of a pre-trained neural network model, which is used to obtain a plaintext inference result for a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, which is used to obtain a ciphertext inference result for a ciphertext input.

[0069] In this example, developers only need to focus on the above model processing program without having to understand the details related to fully homomorphic encryption, which significantly improves the development efficiency of the fully homomorphic encryption processing program.

[0070] Furthermore, the plaintext input is held by the user end, and the ciphertext processing program is held by the server end.

[0071] In this example, the server does not need to obtain plaintext input, but only ciphertext input, uses the ciphertext processing program to obtain the ciphertext inference result, transmits the ciphertext inference result to the user end, and the user end decrypts the ciphertext inference result to obtain the plaintext inference result, which can protect the plaintext input from being leaked to the server end. When the server end is set on a cloud computing platform, the server end can also be called a cloud.

[0072] Then in step 22, each of the multiple operators is converted into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial. It can be understood that only some pre-set basic operators have corresponding homomorphic operations, while some complex operators do not have corresponding homomorphic operations. Linear operators can be converted into a combination of several homomorphic operations, and nonlinear operators can first determine the corresponding target polynomial and then be converted into a combination of several homomorphic operations.

[0073] In one example, the linear operator includes a convolution operator, a pooling operator, or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation, or a fully homomorphic rotation operation.

[0074] For example, the convolution operator can be transformed into a combination of a fully homomorphic addition operation, a fully homomorphic multiplication operation, and a fully homomorphic rotation operation.

[0075] In one example, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0076] For example, activation functions include ReLU function, Sigmoid function, etc., which can be converted into a combination of fully homomorphic addition operation and fully homomorphic multiplication operation.

[0077] Taking the CKKS scheme as an example, it supports complex numbers, real numbers, batch processing and bootstrapping schemes, and the basic operations include homomorphic addition, multiplication, rotation and ciphertext bootstrapping.

[0078] The CKKS scheme is a batch processing scheme, and its supported operation primitives are as follows:

[0079] Encryption: CT = Encrypt(a0, a1, ..., a n-1 );

[0080] Decryption: (c0,c1,…,c n-1 )=Decrypt(CT).

[0081] Due to the existence of approximation error, ai ≠c i but That is to say, a i and c i Not strictly equal, but the error is less than a certain value.

[0082] Addition: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0083] CT2=Encrypt(b0,b1,…,b n-1 );

[0084] CT3 = Add(CT1, CT2);

[0085] (c0,c1,…,c n-1 ) = Decrypt(CT3);

[0086] For each item of the result: That is, c i and a i +b i Not strictly equal, but the error is less than a certain value.

[0087] Multiplication: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0088] CT2=Encrypt(b0,b1,…,b n-1 );

[0089] CT3 = Mu l (CT1, CT2);

[0090] (c0,c1,…,c n-1 ) = Decrypt(CT3);

[0091] For each item of the result: That is, c i and a i *b i Not strictly equal, but the error is less than a certain value.

[0092] Rotation: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0093] CT2 = Rotate(CT1, k);

[0094] (c0,c1,…,c n-1 ) = Decrypt(CT2);

[0095] For each item of the result: That is, c i and a (i+k) %n is not strictly equal, but the error is less than a certain value.

[0096] Combinations of the above operations can realize arbitrary operators.

[0097] In one example, determining the corresponding target polynomial by polynomial fitting includes:

[0098] The fitting interval, polynomial degree and coefficient of the polynomial fitting are determined according to the operator, user prompt or runtime feedback to obtain the target polynomial.

[0099] In this example, the operator, user prompt or runtime feedback can be used alone or in combination. For example, the above fitting interval can also be called the independent variable range. The independent variable range of the polynomial fitting can be determined based on the operator; or, the independent variable range of the polynomial fitting can be determined based on the user prompt, that is, the user directly specifies the independent variable range; or, the independent variable range of the polynomial fitting can be determined based on runtime feedback, that is, the independent variable range of these operators is collected while the model is inferred using plain text as input.

[0100] Finally, in step 23, each homomorphic operation in the homomorphic operation sequence is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation is called to obtain the ciphertext processing program. It can be understood that a fully homomorphic encryption function library is established in advance, which includes fully homomorphic encryption functions corresponding to each homomorphic operation. After determining the homomorphic operation sequence, the fully homomorphic encryption functions corresponding to each homomorphic operation are called in sequence.

[0101] In one example, the fully homomorphic encryption function corresponding to the homomorphic operation is called to obtain the ciphertext processing program, including:

[0102] Determine homomorphic encryption parameters, including target multiplication depth;

[0103] Inserting a bootstrap operation at a target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position is such that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth;

[0104] Each operation in the update operation sequence is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation are called according to the homomorphic encryption parameters to obtain a ciphertext processing program.

[0105] In this example, the homomorphic operation sequence is analyzed, the main homomorphic encryption parameters are automatically determined, and bootstrap operations are automatically inserted into the homomorphic operation sequence, thereby supporting homomorphic calculations of arbitrary multiplication depth and without restrictions on plaintext processing programs. For example, when the plaintext processing program corresponds to a neural network model, there are no restrictions on the scale and number of layers of the neural network model.

[0106] It is understandable that homomorphic encryption ensures encryption security by adding noise to the original plaintext data. Homomorphic multiplication will greatly increase the noise level. After performing a certain depth of multiplication, the noise may overwhelm the plaintext message, resulting in decryption failure. By introducing a bootstrap operation, a ciphertext containing higher noise is refreshed to a ciphertext containing lower noise, so that multiplication operations of arbitrary depth can be performed.

[0107] Furthermore, the target multiplication depth is determined in the following manner:

[0108] Analyzing the total multiplication depth required by the plaintext processing program;

[0109] If the total multiplication depth is less than or equal to 2 times the multiplication depth required for the bootstrap operation, then selecting the total multiplication depth as the target multiplication depth;

[0110] If the total multiplication depth is greater than the multiplication depth required by the 2-times bootstrap operation, the multiplication depth required by the 2-times bootstrap operation is selected as the target multiplication depth.

[0111] In this example, if the total multiplication depth is less than or equal to 2 times the multiplication depth required for the bootstrap operation, there is no need to insert the bootstrap operation, and the total multiplication depth is selected as the target multiplication depth required for the fully homomorphic encryption scheme; otherwise, 2 times the multiplication depth required for the bootstrap operation is selected as the target multiplication depth required for the fully homomorphic encryption scheme.

[0112] The total multiplication depth required by the plaintext processing program can be analyzed by using the define-use relationship. The define-use relationship corresponds to the assignment and use of variables. By analyzing the define-use relationship, the maximum number of multiplications that will be experienced from input to output can be obtained.

[0113] Further, the homomorphic encryption parameters include a target dimension of the polynomial ring;

[0114] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0115] Initializing a fully homomorphic encryption function corresponding to the homomorphic operation according to the target dimension of the polynomial ring;

[0116] Call the initialized fully homomorphic encryption function.

[0117] In this example, the homomorphic operation sequence is analyzed to automatically determine the target dimension of the polynomial ring, which facilitates the subsequent initialization of the fully homomorphic encryption function.

[0118] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0119] Analyze the size of the batch data processed by the operator to obtain the minimum dimension of the required polynomial ring;

[0120] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0121] In this example, the target dimension of the polynomial ring required in the fully homomorphic encryption scheme is comprehensively determined based on the target multiplication depth, homomorphic encryption standard, and the minimum dimension of the polynomial ring. For example, the dimension of the polynomial ring is controlled by two factors: one is the minimum dimension that satisfies the fully homomorphic encryption security standard when a given target multiplication depth is met, and the other is the size of the data set processed by the homomorphic operator batch. The target dimension of the polynomial ring is the larger of these two values.

[0122] Further, the homomorphic encryption parameters include a target rotation key;

[0123] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0124] When the homomorphic operation is a fully homomorphic rotation operation, initializing a fully homomorphic encryption function corresponding to the rotation operation according to the target rotation key;

[0125] Call the initialized fully homomorphic encryption function.

[0126] In this example, the homomorphic operation sequence is analyzed and the target rotation key is automatically determined to facilitate the subsequent initialization of the fully homomorphic encryption function.

[0127] Furthermore, the target rotation key is determined in the following manner:

[0128] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain offsets corresponding to each fully homomorphic rotation operation;

[0129] The target rotation key is generated according to each offset.

[0130] In this example, fully homomorphic rotation operations for different offsets require different rotation keys, and the target rotation key is generated according to each offset. The specific meaning of the offset depends on the application scenario. For example, in batch mode, multiple plaintexts are packaged in a ciphertext for homomorphic operations, and the plaintext data in the ciphertext is cyclically moved. The position difference of a certain element before and after the movement is the offset.

[0131] Further, the homomorphic encryption parameters include target moduli of each variable;

[0132] The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0133] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target modulus of each variable;

[0134] Call the initialized fully homomorphic encryption function.

[0135] In this example, the homomorphic operation sequence is analyzed to automatically determine the target modulus of each variable, which is convenient for the subsequent initialization of the fully homomorphic encryption function. The above variables may include hyperparameters in the fully homomorphic encryption function, such as input scaling factor and output scaling factor. The input and output of the fully homomorphic encryption scheme are floating point numbers, which need to be encoded into the coefficients of the polynomial ring. The coefficients of the polynomial ring are integers. When inputting, they need to be multiplied by the input scaling factor to become integers, and when outputting, they need to be divided by the output scaling factor to become floating point numbers.

[0136] Furthermore, the target modulus of each variable is determined in the following manner:

[0137] Determining a target modulus of each variable according to the target multiplication depth and the target dimension of the polynomial ring; or,

[0138] According to user instructions, the target modulus of each variable is determined.

[0139] In this example, the target modulus of each variable can be determined automatically or according to user instructions; alternatively, the automatically determined target modulus of each variable is used as a reference value, and the user can adjust the reference value as needed.

[0140] Figure 3 A flowchart of a method for compiling a neural network model into a homomorphic encryption computing program according to one embodiment is shown. Figure 3, the method includes: first, in step 31, read in the neural network model; then in step 32, convert the linear operators in the model into homomorphic operations; in step 33, convert the nonlinear operators in the model into homomorphic operations; then in step 34, analyze the generated homomorphic operation sequence and determine the homomorphic encryption parameters; then in step 35, insert the bootstrap operation at the appropriate position of the homomorphic operation sequence; then in step 36, traverse the generated homomorphic operation sequence to generate the fully homomorphic encryption calculation code corresponding to each homomorphic operation; finally in step 37, use the fully homomorphic encryption calculation code to form a fully homomorphic encryption reasoning program. This embodiment takes the neural network model as input, analyzes and processes the neural network model, and realizes the automatic generation of an end-to-end fully homomorphic encryption reasoning program. Among them, the above-mentioned neural network model can be but not limited to a pre-trained model. In steps 35 and 36, the homomorphic encryption parameters determined in step 34 are required.

[0141] Figure 4 A flow chart of a method for determining homomorphic encryption parameters according to one embodiment is shown. Figure 4 , the method includes: first, in step 41, inputting a plaintext processing program; then, in step 42, analyzing the total multiplication depth required by the plaintext processing program; then, in step 43, determining whether a bootstrap operation needs to be inserted; if it is determined that a bootstrap operation does not need to be inserted, outputting a target multiplication depth L as the total multiplication depth; if it is determined that a bootstrap operation needs to be inserted, executing step 44; in step 44, adjusting the total multiplication depth, and outputting the target multiplication depth L as the adjusted total multiplication depth; then, in step 45, according to the target multiplication depth L, calculating the minimum dimension MinN that meets the full homomorphic encryption security standard; in step 46, analyzing the size of the batch data processed by the operator to obtain the required vector width VecLen; finally, in step 47, selecting the larger value between the minimum dimension MinN and 2 times the vector width VecLen, that is, calculating Max(MinN,VecLen*2), as the target dimension N of the polynomial ring. This embodiment provides a processing flow for automatically determining homomorphic encryption parameters, which can meet the requirements of full homomorphic encryption and improve processing efficiency.

[0142] Through the method provided in the embodiment of this specification, first obtain a plaintext processing program, the plaintext processing program includes multiple operators; then each of the multiple operators is converted into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; finally, traverse each homomorphic operation in the homomorphic operation sequence, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program. As can be seen from the above, in the embodiment of this specification, the ciphertext processing program is automatically generated by the plaintext processing program, wherein, for nonlinear operators, the conversion to the corresponding homomorphic operation is supported by polynomial fitting. Developers do not have to directly develop ciphertext processing programs, but can only develop plaintext processing programs, and subsequent plaintext processing programs can be automatically converted into ciphertext processing programs, which greatly reduces the development difficulty, thereby improving the development efficiency of ciphertext processing programs.

[0143] According to another aspect of the embodiment, there is also provided a device for compiling a plaintext processing program into a ciphertext processing program, and the device is used to execute the method provided in the embodiment of this specification. Figure 5 A schematic block diagram of an apparatus for compiling a plaintext processing program into a ciphertext processing program according to an embodiment is shown. Figure 5 As shown, the device 500 includes:

[0144] An acquisition unit 51, configured to acquire a plaintext processing program, wherein the plaintext processing program includes a plurality of operators;

[0145] The conversion unit 52 is used to convert each of the multiple operators obtained by the acquisition unit 51 into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial;

[0146] The calling unit 53 is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the conversion unit 52, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

[0147] Optionally, as an embodiment, the plaintext processing program is a model processing program of a pre-trained neural network model, which is used to obtain a plaintext inference result for a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, which is used to obtain a ciphertext inference result for a ciphertext input.

[0148] Furthermore, the plaintext input is held by the user end, and the ciphertext processing program is held by the server end.

[0149] Optionally, as an embodiment, the linear operator includes a convolution operator, a pooling operator or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation or a fully homomorphic rotation operation.

[0150] Optionally, as an embodiment, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0151] Optionally, as an embodiment, the conversion unit 52 is specifically used to determine the fitting interval, polynomial degree and coefficients of the polynomial fitting according to the operator, user prompt or runtime feedback to obtain the target polynomial.

[0152] Optionally, as an embodiment, the calling unit 53 includes:

[0153] Determine a subunit for determining homomorphic encryption parameters, including a target multiplication depth;

[0154] an inserting subunit, configured to insert a bootstrap operation at a target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position makes the multiplication depth of any operation result in the update operation sequence not exceed a target multiplication depth determined by the determining subunit;

[0155] A calling subunit is used to traverse each operation in the update operation sequence obtained by the insertion subunit, and call the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation according to the homomorphic encryption parameters to obtain a ciphertext processing program.

[0156] Furthermore, the target multiplication depth is determined in the following manner:

[0157] Analyzing the total multiplication depth required by the plaintext processing program;

[0158] If the total multiplication depth is less than or equal to 2 times the multiplication depth required for the bootstrap operation, then selecting the total multiplication depth as the target multiplication depth;

[0159] If the total multiplication depth is greater than the multiplication depth required by the 2-times bootstrap operation, the multiplication depth required by the 2-times bootstrap operation is selected as the target multiplication depth.

[0160] Further, the homomorphic encryption parameters include a target dimension of the polynomial ring;

[0161] The calling subunit comprises:

[0162] A first initialization module, used to initialize a fully homomorphic encryption function corresponding to the homomorphic operation according to a target dimension of the polynomial ring;

[0163] The first calling module is used to call the fully homomorphic encryption function initialized by the first initialization module.

[0164] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0165] Analyze the size of the batch data processed by the operator to obtain the minimum dimension of the required polynomial ring;

[0166] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0167] Further, the homomorphic encryption parameters include a target rotation key;

[0168] The calling subunit comprises:

[0169] A second initialization module is used to initialize the fully homomorphic encryption function corresponding to the rotation operation according to the target rotation key when the homomorphic operation is a fully homomorphic rotation operation;

[0170] The second calling module is used to call the fully homomorphic encryption function initialized by the second initialization module.

[0171] Furthermore, the target rotation key is determined in the following manner:

[0172] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain offsets corresponding to each fully homomorphic rotation operation;

[0173] The target rotation key is generated according to each offset.

[0174] Further, the homomorphic encryption parameters include target moduli of each variable;

[0175] The calling subunit comprises:

[0176] A third initialization module is used to initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target modulus of each variable;

[0177] The third calling module is used to call the fully homomorphic encryption function initialized by the third initialization module.

[0178] Furthermore, the target modulus of each variable is determined in the following manner:

[0179] Determining a target modulus of each variable according to the target multiplication depth and the target dimension of the polynomial ring; or,

[0180] According to user instructions, the target modulus of each variable is determined.

[0181] Through the device provided by the embodiment of this specification, first, the plaintext processing program is obtained by the acquisition unit 51, and the plaintext processing program includes multiple operators; then the post-conversion unit 52 converts each of the multiple operators into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; finally, the calling unit 53 traverses each homomorphic operation in the homomorphic operation sequence, calls the fully homomorphic encryption function corresponding to the homomorphic operation, and obtains the ciphertext processing program. As can be seen from the above, in the embodiment of this specification, the ciphertext processing program is automatically generated by the plaintext processing program, wherein, for nonlinear operators, the conversion to the corresponding homomorphic operation is supported by polynomial fitting. Developers do not have to directly develop ciphertext processing programs, but can only develop plaintext processing programs, and subsequent plaintext processing programs can be automatically converted into ciphertext processing programs, which greatly reduces the development difficulty, thereby improving the development efficiency of ciphertext processing programs.

[0182] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0183] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described.

[0184] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0185] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for compiling a plaintext processing program into a ciphertext processing program, the method comprising: Obtaining a plaintext processing program, wherein the plaintext processing program includes a plurality of operators; Each operator in the plurality of operators is converted into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; Traverse each homomorphic operation in the homomorphic operation sequence, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

2. The method of claim 1, wherein: The plaintext processing program is a model processing program of a pre-trained neural network model, which is used to obtain a plaintext inference result for a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, which is used to obtain a ciphertext inference result for a ciphertext input.

3. The method of claim 2, wherein: The plain text input is held by the user end, and the cipher text processing program is held by the server end.

4. The method of claim 1, wherein: The linear operator includes a convolution operator, a pooling operator or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation or a fully homomorphic rotation operation.

5. The method of claim 1, wherein: The nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

6. The method of claim 1, wherein: The determining of the corresponding target polynomial by polynomial fitting includes: The fitting interval, polynomial degree and coefficient of the polynomial fitting are determined according to the operator, user prompt or runtime feedback to obtain the target polynomial.

7. The method of claim 1, wherein: Call the fully homomorphic encryption function corresponding to the homomorphic operation to obtain the ciphertext processing program, including: Determine homomorphic encryption parameters, including target multiplication depth; Inserting a bootstrap operation at a target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position is such that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth; Each operation in the update operation sequence is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation are called according to the homomorphic encryption parameters to obtain a ciphertext processing program.

8. The method of claim 7, wherein: The target multiplication depth is determined as follows: Analyzing the total multiplication depth required by the plaintext processing program; If the total multiplication depth is less than or equal to 2 times the multiplication depth required for the bootstrap operation, then selecting the total multiplication depth as the target multiplication depth; If the total multiplication depth is greater than the multiplication depth required by the 2-times bootstrap operation, the multiplication depth required by the 2-times bootstrap operation is selected as the target multiplication depth.

9. The method of claim 7, wherein: The homomorphic encryption parameters include a target dimension of the polynomial ring; The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes: Initializing a fully homomorphic encryption function corresponding to the homomorphic operation according to the target dimension of the polynomial ring; Call the initialized fully homomorphic encryption function.

10. The method of claim 9, wherein: The target dimension of the polynomial ring is determined as follows: Analyze the size of the batch data processed by the operator to obtain the minimum dimension of the required polynomial ring; The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

11. The method of claim 7, wherein: The homomorphic encryption parameters include a target rotation key; The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes: When the homomorphic operation is a fully homomorphic rotation operation, initializing a fully homomorphic encryption function corresponding to the rotation operation according to the target rotation key; Call the initialized fully homomorphic encryption function.

12. The method of claim 11, wherein: The target rotation key is determined in the following manner: Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain offsets corresponding to each fully homomorphic rotation operation; The target rotation key is generated according to each offset.

13. The method of claim 7, wherein: The homomorphic encryption parameters include target moduli of each variable; The calling of the fully homomorphic encryption function corresponding to the homomorphic operation includes: Initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target modulus of each variable; Call the initialized fully homomorphic encryption function.

14. The method of claim 13, wherein: The target modulus of each variable is determined in the following manner: Determining a target modulus of each variable according to the target multiplication depth and the target dimension of the polynomial ring; or, According to user instructions, the target modulus of each variable is determined.

15. A device for compiling a plaintext processing program into a ciphertext processing program, the device comprising: An acquisition unit, used for acquiring a plaintext processing program, wherein the plaintext processing program includes a plurality of operators; A conversion unit, used to convert each of the multiple operators obtained by the acquisition unit into a corresponding homomorphic operation to obtain a homomorphic operation sequence; wherein, when any operator belongs to a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator belongs to a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; The calling unit is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the conversion unit, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain a ciphertext processing program.

16. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 14.

17. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 14 is implemented.

Images