Method and apparatus for compiling a plaintext processing program into a ciphertext processing program

Abstract

This specification provides a method and apparatus for compiling a plaintext processing program into a ciphertext processing program. The method includes: obtaining a plaintext processing program, which includes multiple operators; converting each operator in the multiple operators into a corresponding homomorphic operation to obtain a sequence of homomorphic operations; wherein, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator is a nonlinear operator, a target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; traversing each homomorphic operation in the sequence of homomorphic operations, and calling the fully homomorphic encryption function corresponding to the homomorphic operation to obtain the ciphertext processing program. This method can improve the development efficiency of ciphertext processing programs.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of computers, and more particularly to methods and apparatus for compiling plaintext processing programs into ciphertext processing programs. Background Technology

[0002] Homomorphic encryption refers to encrypting plaintext data, performing addition and multiplication operations on the encrypted ciphertext, and decrypting the result to obtain an equivalent result to performing the same addition and multiplication operations directly on the plaintext data. Homomorphic encryption technology enables data analysis and processing without disclosing the original data to the data provider, ensuring that data is "usable but not visible" during circulation and integration. It can be widely used in various industries and scenarios requiring privacy protection.

[0003] Performing operations on ciphertext requires ciphertext processing programs, which are very difficult to develop. Developers not only need sufficient business knowledge, but also need to learn the theoretical foundations of homomorphic encryption, understand the algorithmic implementation of various processing schemes, and master the details of encryption schemes, resulting in low development efficiency. Summary of the Invention

[0004] This specification describes one or more embodiments of a method and apparatus for compiling a plaintext processing program into a ciphertext processing program, which can improve the development efficiency of ciphertext processing programs.

[0005] Firstly, a method for compiling a plaintext processing program into a ciphertext processing program is provided, the method comprising:

[0006] Obtain a plaintext processing program, wherein the plaintext processing program includes multiple operators;

[0007] Each of the plurality of operators is transformed into its corresponding homomorphic operation to obtain a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly transformed into its corresponding homomorphic operation. When the operator is a nonlinear operator, the target polynomial is determined by polynomial fitting, and the operator is transformed into the homomorphic operation corresponding to the target polynomial.

[0008] By traversing each homomorphic operation in the homomorphic operation sequence and calling the fully homomorphic encryption function corresponding to the homomorphic operation, the ciphertext processing program is obtained.

[0009] In one possible implementation, the plaintext processing program is a model processing program of a pre-trained neural network model, used to obtain a plaintext inference result from a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, used to obtain a ciphertext inference result from a ciphertext input.

[0010] Furthermore, the plaintext input is held by the user terminal, while the ciphertext processing program is held by the server terminal.

[0011] In one possible implementation, the linear operator includes a convolution operator, a pooling operator, or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation, or a fully homomorphic rotation operation.

[0012] In one possible implementation, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0013] In one possible implementation, determining the corresponding target polynomial through polynomial fitting includes:

[0014] The fitting interval, polynomial degree, and coefficients of the polynomial fitting are determined based on the operator, user prompts, or runtime feedback, and the target polynomial is obtained.

[0015] In one possible implementation, the fully homomorphic encryption function corresponding to the homomorphic operation is called to obtain the ciphertext processing procedure, including:

[0016] Determine the homomorphic encryption parameters, including the target multiplication depth;

[0017] A bootstrap operation is inserted at the target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position ensures that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth.

[0018] By traversing each operation in the update operation sequence, and calling the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation according to the homomorphic encryption parameters, the ciphertext processing program is obtained.

[0019] Furthermore, the target multiplication depth is determined in the following manner:

[0020] Analyze the total multiplication depth required by the plaintext processing procedure.

[0021] If the total multiplication depth is less than or equal to twice the multiplication depth required for the bootstrap operation, then the total multiplication depth is selected as the target multiplication depth.

[0022] If the total multiplication depth is greater than twice the multiplication depth required for the bootstrap operation, then the target multiplication depth is selected as twice the multiplication depth required for the bootstrap operation.

[0023] Furthermore, the homomorphic encryption parameters include the target dimension of the polynomial ring;

[0024] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0025] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target dimension of the polynomial ring.

[0026] Call the initialized fully homomorphic encryption function.

[0027] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0028] The size of the batch data processed by the analysis operator is used to obtain the minimum dimension of the required polynomial ring;

[0029] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0030] Furthermore, the homomorphic encryption parameters include the target rotation key;

[0031] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0032] When the homomorphic operation is a fully homomorphic rotation operation, the fully homomorphic encryption function corresponding to the rotation operation is initialized according to the target rotation key;

[0033] Call the initialized fully homomorphic encryption function.

[0034] Furthermore, the target rotation key is determined in the following manner:

[0035] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain the offset corresponding to each fully homomorphic rotation operation;

[0036] The target rotation key is generated based on each offset.

[0037] Furthermore, the homomorphic encryption parameters include the target modulus of each variable;

[0038] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0039] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target modulus of each variable;

[0040] Call the initialized fully homomorphic encryption function.

[0041] Furthermore, the target modulus of each variable is determined in the following manner:

[0042] Determine the target modulus of each variable based on the target multiplication depth and the target dimension of the polynomial ring; or,

[0043] Determine the target modulus of each variable based on user instructions.

[0044] Secondly, an apparatus is provided for compiling a plaintext processing program into a ciphertext processing program, the apparatus comprising:

[0045] An acquisition unit is used to acquire a plaintext processing program, wherein the plaintext processing program includes multiple operators;

[0046] The transformation unit is used to transform each operator among the multiple operators acquired by the acquisition unit into a corresponding homomorphic operation to obtain a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly transformed into a corresponding homomorphic operation. When the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is transformed into a homomorphic operation corresponding to the target polynomial.

[0047] The calling unit is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the transformation unit, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

[0048] Thirdly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0049] Fourthly, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to implement the method of the first aspect.

[0050] The method and apparatus provided in the embodiments of this specification first obtain a plaintext processing program, which includes multiple operators; then, each operator in the multiple operators is converted into a corresponding homomorphic operation to obtain a sequence of homomorphic operations; wherein, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; finally, each homomorphic operation in the sequence of homomorphic operations is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation is called to obtain a ciphertext processing program. As can be seen from the above, in the embodiments of this specification, a ciphertext processing program is automatically generated from a plaintext processing program, wherein, for nonlinear operators, polynomial fitting is used to support their conversion into corresponding homomorphic operations. Developers do not need to directly develop a ciphertext processing program, but can only develop a plaintext processing program, which can then be automatically converted into a ciphertext processing program, significantly reducing development difficulty and thus improving the development efficiency of the ciphertext processing program. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification;

[0053] Figure 2 A flowchart illustrating a method for compiling a plaintext processor into a ciphertext processor according to one embodiment is shown.

[0054] Figure 3 A flowchart illustrating a method for compiling a neural network model into a homomorphic cryptographic computation program according to one embodiment is shown.

[0055] Figure 4 A flowchart illustrating a method for determining homomorphic encryption parameters according to one embodiment is shown.

[0056] Figure 5 A schematic block diagram of an apparatus for compiling a plaintext processor into a ciphertext processor according to one embodiment is shown. Detailed Implementation

[0057] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0058] Figure 1 This is a schematic diagram illustrating an implementation scenario of one embodiment disclosed in this specification. This implementation scenario involves compiling a plaintext processing program into a ciphertext processing program. It can be understood that the input to the plaintext processing program is plaintext data, and the output is a plaintext result; the input to the ciphertext processing program is ciphertext data, and the output is a ciphertext result. The ciphertext data is obtained by encrypting the plaintext data, and the plaintext result can be obtained by decrypting the ciphertext result. (Refer to...) Figure 1 A typical scenario is machine learning inference applications. In this scenario, the neural network model is deployed in the cloud, and the model parameters are in plaintext, requiring no encryption protection. The user client encrypts the plaintext data to be inferred into ciphertext using fully homomorphic encryption and uploads it to the cloud. The cloud uses the ciphertext processing program corresponding to the neural network model to perform inference, obtains the ciphertext result, and returns it to the user client. The user client decrypts the ciphertext result to obtain the plaintext result. During the inference process in the cloud, the plaintext data held by the user client remains encrypted, avoiding the possibility of sensitive data leakage. The aforementioned ciphertext processing program is obtained by directly compiling the plaintext processing program corresponding to the neural network model, which improves development efficiency. Deploying it in the cloud enables privacy-preserving machine learning inference applications.

[0059] In the embodiments described in this specification, the neural network model described above can be any type of machine learning model, such as a pre-trained model. A pre-trained model is a machine learning model that has been trained on a large dataset and can be fine-tuned for a specific task. A pre-trained model includes both the model structure and model parameters.

[0060] Fully homomorphic encryption (FCI) satisfies both additive and multiplicative homomorphism. After encrypting plaintext data, performing homomorphic addition and multiplication operations, and then decrypting, the result is identical to the result of directly performing addition and multiplication on the plaintext. Because the computation is performed in an encrypted state, it avoids the leakage of private data contained in the plaintext. FCI uses bootstrapping technology to achieve infinitely deep multiplication operations. Here, Enc, Dec, Add, and Mul represent encryption, decryption, addition, and multiplication operations, respectively. FCI can be represented by the following two sets of equations:

[0061] Dec(Add(Enc(x),Enc(y)))==Add(x,y);

[0062] Dec(Mu l(Enc(x),Enc(y)))==Mu l(x,y).

[0063] There are various fully homomorphic encryption schemes, and the appropriate scheme can be flexibly selected according to the specific application scenario. A typical example is the CKKS scheme. The CKKS scheme, proposed by Cheon, Kim, and Song at ASIACRYPT'17, is an approximate computational homomorphic encryption scheme that supports fixed-point addition and multiplication operations in the complex field. The CKKS scheme does not strive for strict consistency between the decryption result and the plaintext calculation, but only retains a portion of the significant digits. Compared to other homomorphic encryption schemes, the CKKS scheme has significantly simplified details and greatly improved computational efficiency, making it suitable for applications such as machine learning inference.

[0064] Inference: The process of using pre-trained and deployed machine learning models to make predictions about new real-world data.

[0065] It should be noted that machine learning inference is only one typical application scenario of the embodiments in this specification, and the applicable scenarios of the embodiments in this specification are not limited to this. The above plaintext processing program can contain any operation or operator, such as addition, subtraction, multiplication, division, exponentiation, etc., which will not be listed here. The purpose of the above plaintext processing program can be for inference, or it can simply be used to output the calculation results for the input data.

[0066] Figure 2 This diagram illustrates a method flowchart for compiling a plaintext processor into a ciphertext processor according to one embodiment, the method being based on... Figure 1 The implementation scenario is shown. For example... Figure 2 As shown, the method for compiling a plaintext processing program into a ciphertext processing program in this embodiment includes the following steps: Step 21, obtaining a plaintext processing program, which includes multiple operators; Step 22, converting each operator in the multiple operators into a corresponding homomorphic operation to obtain a sequence of homomorphic operations; wherein, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial; Step 23, traversing each homomorphic operation in the sequence of homomorphic operations, calling the fully homomorphic encryption function corresponding to the homomorphic operation, to obtain the ciphertext processing program. The specific execution method of each of the above steps is described below.

[0067] First, in step 21, a plaintext processing program is obtained, which includes multiple operators. It is understood that each operator is a mapping from one function space to another, and the mapping form is not limited, depending on the specific application scenario.

[0068] In one example, the plaintext processing program is a model processing program of a pre-trained neural network model, used to obtain a plaintext inference result from a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, used to obtain a ciphertext inference result from a ciphertext input.

[0069] In this example, developers only need to focus on the model processing procedure mentioned above, without needing to understand the details related to fully homomorphic encryption, thus significantly improving the development efficiency of the fully homomorphic encryption processing procedure.

[0070] Furthermore, the plaintext input is held by the user terminal, while the ciphertext processing program is held by the server terminal.

[0071] In this example, the server does not need to receive plaintext input, only ciphertext input. It uses a ciphertext processing program to obtain a ciphertext deduction result, which is then transmitted to the user terminal. The user terminal decrypts the ciphertext deduction result to obtain the plaintext deduction result, thus protecting the plaintext input from being leaked to the server. When the server is located on a cloud computing platform, it can also be referred to as the cloud.

[0072] Then, in step 22, each of the plurality of operators is transformed into its corresponding homomorphic operation, resulting in a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly transformed into its corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined through polynomial fitting, and the operator is then transformed into the homomorphic operation corresponding to the target polynomial. It is understood that only some pre-defined basic operators have corresponding homomorphic operations, while some complex operators do not. Linear operators can be transformed into combinations of several homomorphic operations, and nonlinear operators can first determine their corresponding target polynomial and then transform them into combinations of several homomorphic operations.

[0073] In one example, the linear operator includes a convolution operator, a pooling operator, or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation, or a fully homomorphic rotation operation.

[0074] For example, a convolution operator can be transformed into a combination of fully homomorphic addition, fully homomorphic multiplication, and fully homomorphic rotation operations.

[0075] In one example, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0076] For example, activation functions, including ReLU and Sigmoid, can be transformed into a combination of fully homomorphic addition and fully homomorphic multiplication operations.

[0077] Taking the CKKS scheme as an example, it supports complex numbers, real numbers, batch processing, and bootstrapping schemes. Basic operations include homomorphic addition, multiplication, rotation, and ciphertext bootstrapping.

[0078] The CKKS scheme is a batch processing scheme, and its supported operation metastates are as follows:

[0079] Encryption: CT = Encrypt(a0, a1, ..., a n-1 );

[0080] Decryption: (c0,c1,…,c n-1 =Decrypt(CT).

[0081] Due to the existence of approximation error, ai ≠c i but In other words, a i and c i They are not strictly equal, but the error is less than a certain specific value.

[0082] Addition: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0083] CT2 = Encrypt(b0, b1, ..., b n-1 );

[0084] CT3 = Add(CT1, CT2);

[0085] (c0,c1,…,c n-1 =Decrypt(CT3);

[0086] For each item in the result: In other words, c i and a i +b i They are not strictly equal, but the error is less than a certain specific value.

[0087] Multiplication: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0088] CT2 = Encrypt(b0, b1, ..., b n-1 );

[0089] CT3 = Mu l(CT1,CT2);

[0090] (c0,c1,…,c n-1 =Decrypt(CT3);

[0091] For each item in the result: In other words, c i and a i *b i They are not strictly equal, but the error is less than a certain specific value.

[0092] Rotation: CT1 = Encrypt(a0, a1, ..., a n-1 );

[0093] CT2 = Rotate(CT1,k);

[0094] (c0,c1,…,c n-1 =Decrypt(CT2);

[0095] For each item in the result: In other words, c i and a (i+k) %n are not strictly equal, but the error is less than a certain specific value.

[0096] The combination of the above operations can implement any operator.

[0097] In one example, determining the corresponding target polynomial through polynomial fitting includes:

[0098] The fitting interval, polynomial degree, and coefficients of the polynomial fitting are determined based on the operator, user prompts, or runtime feedback, and the target polynomial is obtained.

[0099] In this example, the operator, user prompt, or runtime feedback can be used individually or in combination. For example, the fitting interval mentioned above can also be called the range of independent variables. The range of independent variables for polynomial fitting can be determined based on the operator; or, the range of independent variables for polynomial fitting can be determined based on user prompts, that is, the user directly specifies the range of independent variables; or, the range of independent variables for polynomial fitting can be determined based on runtime feedback, that is, when inference is performed on the model using plaintext as input, the range of independent variables for these operators is collected during runtime.

[0100] Finally, in step 23, each homomorphic operation in the homomorphic operation sequence is traversed, and the corresponding fully homomorphic encryption function is called to obtain the ciphertext processing program. It can be understood that a fully homomorphic encryption function library is pre-established, including the fully homomorphic encryption function corresponding to each homomorphic operation. After determining the homomorphic operation sequence, the fully homomorphic encryption function corresponding to each homomorphic operation is called sequentially.

[0101] In one example, calling the fully homomorphic encryption function corresponding to the homomorphic operation yields a ciphertext processing procedure, including:

[0102] Determine the homomorphic encryption parameters, including the target multiplication depth;

[0103] A bootstrap operation is inserted at the target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position ensures that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth.

[0104] By traversing each operation in the update operation sequence, and calling the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation according to the homomorphic encryption parameters, the ciphertext processing program is obtained.

[0105] In this example, the homomorphic operation sequence is analyzed to automatically determine the main homomorphic encryption parameters and automatically insert bootstrap operations into the homomorphic operation sequence, thereby supporting homomorphic computation of arbitrary multiplication depth. There are no restrictions on the plaintext processing program. For example, when the plaintext processing program corresponds to a neural network model, there are no restrictions on the size and number of layers of the neural network model.

[0106] As is understandable, homomorphic encryption ensures security by adding noise to the original plaintext data. Homomorphic multiplication significantly increases the noise level, and after performing multiplication at a certain depth, the noise may overwhelm the plaintext message, leading to decryption failure. By introducing a bootstrap operation, a ciphertext containing high noise is refreshed to a ciphertext containing low noise, thus enabling multiplication operations of arbitrary depth.

[0107] Furthermore, the target multiplication depth is determined in the following manner:

[0108] Analyze the total multiplication depth required by the plaintext processing procedure.

[0109] If the total multiplication depth is less than or equal to twice the multiplication depth required for the bootstrap operation, then the total multiplication depth is selected as the target multiplication depth.

[0110] If the total multiplication depth is greater than twice the multiplication depth required for the bootstrap operation, then the target multiplication depth is selected as twice the multiplication depth required for the bootstrap operation.

[0111] In this example, if the total multiplication depth is less than or equal to twice the multiplication depth required by the bootstrap operation, then no bootstrap operation needs to be inserted, and the total multiplication depth is selected as the target multiplication depth required by the fully homomorphic encryption scheme; otherwise, the multiplication depth required by twice the bootstrap operation is selected as the target multiplication depth required by the fully homomorphic encryption scheme.

[0112] The definition-use relationship can be used to analyze the total multiplication depth required by the plaintext processing program. The definition-use relationship corresponds to the assignment and use of variables. By analyzing the definition-use relationship, the maximum number of multiplications that will occur from input to output can be obtained.

[0113] Furthermore, the homomorphic encryption parameters include the target dimension of the polynomial ring;

[0114] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0115] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target dimension of the polynomial ring.

[0116] Call the initialized fully homomorphic encryption function.

[0117] In this example, the sequence of homomorphic operations is analyzed to automatically determine the target dimension of the polynomial ring, which facilitates the subsequent initialization of the fully homomorphic encryption function.

[0118] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0119] The size of the batch data processed by the analysis operator is used to obtain the minimum dimension of the required polynomial ring;

[0120] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0121] In this example, the target dimension of the polynomial ring required in the fully homomorphic encryption scheme is determined comprehensively based on the target multiplication depth, the homomorphic encryption standard, and the minimum dimension of the polynomial ring. For example, the dimension of the polynomial ring is controlled by two factors: first, the minimum dimension that satisfies the fully homomorphic encryption security standard for a given target multiplication depth; and second, the size of the dataset processed by the homomorphic operators. The target dimension of the polynomial ring is the larger of these two values.

[0122] Furthermore, the homomorphic encryption parameters include the target rotation key;

[0123] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0124] When the homomorphic operation is a fully homomorphic rotation operation, the fully homomorphic encryption function corresponding to the rotation operation is initialized according to the target rotation key;

[0125] Call the initialized fully homomorphic encryption function.

[0126] In this example, the homomorphic operation sequence is analyzed to automatically determine the target rotation key, which facilitates the subsequent initialization of the fully homomorphic encryption function.

[0127] Furthermore, the target rotation key is determined in the following manner:

[0128] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain the offset corresponding to each fully homomorphic rotation operation;

[0129] The target rotation key is generated based on each offset.

[0130] In this example, different rotation keys are required for fully homomorphic rotation operations with different offsets. A target rotation key is generated based on each offset. The specific meaning of the offset depends on the application scenario. For example, in batch processing mode, multiple plaintexts are packaged into a single ciphertext for homomorphic operations. By cyclically shifting the plaintext data within this ciphertext, the difference in position before and after a certain element's shift is the offset.

[0131] Furthermore, the homomorphic encryption parameters include the target modulus of each variable;

[0132] The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes:

[0133] Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target modulus of each variable;

[0134] Call the initialized fully homomorphic encryption function.

[0135] In this example, the homomorphic operation sequence is analyzed to automatically determine the target modulus of each variable, facilitating the subsequent initialization of the fully homomorphic encryption function. These variables can include hyperparameters of the fully homomorphic encryption function, such as the input scaling factor and the output scaling factor. The input and output of the fully homomorphic encryption scheme are floating-point numbers. These floating-point numbers need to be encoded onto the coefficients of the polynomial ring. The coefficients of the polynomial ring are integers; they need to be multiplied by the input scaling factor to become integers during input and divided by the output scaling factor to return to floating-point numbers during output.

[0136] Furthermore, the target modulus of each variable is determined in the following manner:

[0137] Determine the target modulus of each variable based on the target multiplication depth and the target dimension of the polynomial ring; or,

[0138] Determine the target modulus of each variable based on user instructions.

[0139] In this example, the target modulus of each variable can be determined automatically, or it can be determined according to user instructions; alternatively, the automatically determined target modulus of each variable can be used as a reference value, which the user can then adjust as needed.

[0140] Figure 3 A flowchart illustrating a method for compiling a neural network model into a homomorphic cryptographic computation program according to one embodiment is shown. (Refer to...) Figure 3The method includes: first, in step 31, reading in a neural network model; then, in step 32, converting linear operators in the model into homomorphic operations; in step 33, converting nonlinear operators in the model into homomorphic operations; next, in step 34, analyzing the generated homomorphic operation sequence to determine homomorphic encryption parameters; then, in step 35, inserting bootstrap operations at appropriate positions in the homomorphic operation sequence; then, in step 36, traversing the generated homomorphic operation sequence to generate fully homomorphic encryption computation code corresponding to each homomorphic operation; finally, in step 37, using the fully homomorphic encryption computation code to construct a fully homomorphic encryption inference program. This embodiment uses a neural network model as input, analyzes and processes the neural network model, and achieves automatic generation of an end-to-end fully homomorphic encryption inference program. The aforementioned neural network model can be, but is not limited to, a pre-trained model. In steps 35 and 36, the homomorphic encryption parameters determined in step 34 are required.

[0141] Figure 4 A flowchart illustrating a method for determining homomorphic encryption parameters according to one embodiment is shown. (Refer to...) Figure 4 The method includes: first, in step 41, inputting a plaintext processing program; then, in step 42, analyzing the total multiplication depth required by the plaintext processing program; next, in step 43, determining whether a bootstrap operation needs to be inserted; if it is determined that no bootstrap operation is needed, then outputting the target multiplication depth L as the total multiplication depth; if it is determined that a bootstrap operation needs to be inserted, then executing step 44; in step 44, adjusting the total multiplication depth, and outputting the target multiplication depth L as the adjusted total multiplication depth; then, in step 45, calculating the minimum dimension MinN that satisfies the fully homomorphic encryption security standard based on the target multiplication depth L; in step 46, analyzing the size of the batch data processed by the operator to obtain the required vector width VecLen; finally, in step 47, selecting the larger value between the minimum dimension MinN and twice the vector width VecLen, that is, calculating Max(MinN, VecLen*2), as the target dimension N of the polynomial ring. This embodiment provides a processing flow for automatically determining homomorphic encryption parameters, which can meet the requirements of fully homomorphic encryption and improve processing efficiency.

[0142] The method provided in the embodiments of this specification first obtains a plaintext processing program, which includes multiple operators; then, each operator in the multiple operators is transformed into a corresponding homomorphic operation to obtain a sequence of homomorphic operations; wherein, when any operator is a linear operator, it is directly transformed into a corresponding homomorphic operation; when the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is transformed into a homomorphic operation corresponding to the target polynomial; finally, each homomorphic operation in the sequence of homomorphic operations is traversed, and the fully homomorphic encryption function corresponding to the homomorphic operation is called to obtain the ciphertext processing program. As can be seen from the above, the embodiments of this specification automatically generate a ciphertext processing program from the plaintext processing program, wherein, for nonlinear operators, polynomial fitting is used to support their transformation into corresponding homomorphic operations. Developers do not need to directly develop a ciphertext processing program, but can only develop a plaintext processing program, which can be automatically converted into a ciphertext processing program later, greatly reducing the development difficulty and thus improving the development efficiency of the ciphertext processing program.

[0143] According to another embodiment, an apparatus for compiling a plaintext processing program into a ciphertext processing program is also provided, the apparatus being used to perform the methods provided in the embodiments of this specification. Figure 5 A schematic block diagram of an apparatus for compiling a plaintext processor into a ciphertext processor according to one embodiment is shown. Figure 5 As shown, the device 500 includes:

[0144] The acquisition unit 51 is used to acquire a plaintext processing program, wherein the plaintext processing program includes multiple operators;

[0145] The conversion unit 52 is used to convert each operator among the multiple operators acquired by the acquisition unit 51 into a corresponding homomorphic operation to obtain a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation. When the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial.

[0146] Calling unit 53 is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the transformation unit 52, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

[0147] Optionally, as an embodiment, the plaintext processing program is a model processing program of a pre-trained neural network model, used to obtain a plaintext inference result from a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, used to obtain a ciphertext inference result from a ciphertext input.

[0148] Furthermore, the plaintext input is held by the user terminal, while the ciphertext processing program is held by the server terminal.

[0149] Optionally, as an embodiment, the linear operator includes a convolution operator, a pooling operator, or a matrix multiplication operator, and the corresponding homomorphic operation includes a fully homomorphic addition operation, a fully homomorphic multiplication operation, or a fully homomorphic rotation operation.

[0150] Optionally, as an embodiment, the nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

[0151] Optionally, as an embodiment, the conversion unit 52 is specifically used to determine the fitting interval, polynomial degree, and coefficients of the polynomial fitting based on the operator, user prompts, or runtime feedback, so as to obtain the target polynomial.

[0152] Optionally, as an embodiment, the calling unit 53 includes:

[0153] Determine the sub-unit to determine the homomorphic encryption parameters, including the target multiplication depth;

[0154] An insertion subunit is used to insert a bootstrap operation at a target position in the homomorphic operation sequence to form an update operation sequence, wherein the target position is such that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth determined by the determining subunit.

[0155] The calling subunit is used to traverse each operation in the update operation sequence obtained by the insertion subunit, and call the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation according to the homomorphic encryption parameters to obtain the ciphertext processing program.

[0156] Furthermore, the target multiplication depth is determined in the following manner:

[0157] Analyze the total multiplication depth required by the plaintext processing procedure.

[0158] If the total multiplication depth is less than or equal to twice the multiplication depth required for the bootstrap operation, then the total multiplication depth is selected as the target multiplication depth.

[0159] If the total multiplication depth is greater than twice the multiplication depth required for the bootstrap operation, then the target multiplication depth is selected as twice the multiplication depth required for the bootstrap operation.

[0160] Furthermore, the homomorphic encryption parameters include the target dimension of the polynomial ring;

[0161] The calling subunit includes:

[0162] The first initialization module is used to initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target dimension of the polynomial ring.

[0163] The first calling module is used to call the fully homomorphic encryption function initialized by the first initialization module.

[0164] Furthermore, the target dimension of the polynomial ring is determined in the following manner:

[0165] The size of the batch data processed by the analysis operator is used to obtain the minimum dimension of the required polynomial ring;

[0166] The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

[0167] Furthermore, the homomorphic encryption parameters include the target rotation key;

[0168] The calling subunit includes:

[0169] The second initialization module is used to initialize the fully homomorphic encryption function corresponding to the rotation operation according to the target rotation key when the homomorphic operation is a fully homomorphic rotation operation.

[0170] The second calling module is used to call the fully homomorphic encryption function initialized by the second initialization module.

[0171] Furthermore, the target rotation key is determined in the following manner:

[0172] Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain the offset corresponding to each fully homomorphic rotation operation;

[0173] The target rotation key is generated based on each offset.

[0174] Furthermore, the homomorphic encryption parameters include the target modulus of each variable;

[0175] The calling subunit includes:

[0176] The third initialization module is used to initialize the fully homomorphic encryption function corresponding to the homomorphic operation according to the target modulus of each variable.

[0177] The third calling module is used to call the fully homomorphic encryption function initialized by the third initialization module.

[0178] Furthermore, the target modulus of each variable is determined in the following manner:

[0179] Determine the target modulus of each variable based on the target multiplication depth and the target dimension of the polynomial ring; or,

[0180] Determine the target modulus of each variable based on user instructions.

[0181] The apparatus provided in this embodiment first obtains a plaintext processing program, which includes multiple operators, using an acquisition unit 51. Then, a conversion unit 52 converts each operator into a corresponding homomorphic operation, resulting in a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly converted into a corresponding homomorphic operation. When the operator is a nonlinear operator, a target polynomial is determined through polynomial fitting, and the operator is converted into a homomorphic operation corresponding to the target polynomial. Finally, a calling unit 53 iterates through each homomorphic operation in the sequence and calls the corresponding fully homomorphic encryption function to obtain the ciphertext processing program. As can be seen, in this embodiment, the ciphertext processing program is automatically generated from the plaintext processing program. For nonlinear operators, polynomial fitting is used to convert them into corresponding homomorphic operations. Developers do not need to directly develop the ciphertext processing program; instead, they can develop only the plaintext processing program, which can then be automatically converted into a ciphertext processing program, significantly reducing development difficulty and improving the development efficiency of the ciphertext processing program.

[0182] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 2 The method described.

[0183] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 2 The method described.

[0184] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0185] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for compiling a plaintext processing program into a ciphertext processing program, the method comprising: Obtain a plaintext processing program, wherein the plaintext processing program includes multiple operators; Each of the plurality of operators is transformed into its corresponding homomorphic operation to obtain a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly transformed into its corresponding homomorphic operation. When the operator is a nonlinear operator, the target polynomial is determined by polynomial fitting, and the operator is transformed into the homomorphic operation corresponding to the target polynomial. By traversing each homomorphic operation in the homomorphic operation sequence and calling the fully homomorphic encryption function corresponding to the homomorphic operation, the ciphertext processing program is obtained.

2. The method as described in claim 1, wherein, The plaintext processing program is a model processing program for a pre-trained neural network model, used to obtain a plaintext inference result from a plaintext input; the ciphertext processing program is a fully homomorphic encryption processing program corresponding to the neural network model, used to obtain a ciphertext inference result from a ciphertext input.

3. The method as described in claim 2, wherein, The plaintext input is held by the user terminal, and the ciphertext processing program is held by the server terminal.

4. The method of claim 1, wherein, The linear operators include convolution operators, pooling operators, or matrix multiplication operators, and the corresponding homomorphic operations include fully homomorphic addition operations, fully homomorphic multiplication operations, or fully homomorphic rotation operations.

5. The method of claim 1, wherein, The nonlinear operator includes an activation function, and the homomorphic operation corresponding to the target polynomial includes a fully homomorphic addition operation or a fully homomorphic multiplication operation.

6. The method of claim 1, wherein, The determination of the corresponding target polynomial through polynomial fitting includes: The fitting interval, polynomial degree, and coefficients of the polynomial fitting are determined based on the operator, user prompts, or runtime feedback, and the target polynomial is obtained.

7. The method of claim 1, wherein, Calling the fully homomorphic encryption function corresponding to the homomorphic operation yields the ciphertext processing procedure, including: Determine the homomorphic encryption parameters, including the target multiplication depth; A bootstrap operation is inserted at the target position of the homomorphic operation sequence to form an update operation sequence, wherein the target position ensures that the multiplication depth of any operation result in the update operation sequence does not exceed the target multiplication depth. By traversing each operation in the update operation sequence, and calling the fully homomorphic encryption function corresponding to the homomorphic operation and the function corresponding to the bootstrap operation according to the homomorphic encryption parameters, the ciphertext processing program is obtained.

8. The method of claim 7, wherein, The target multiplication depth is determined in the following way: Analyze the total multiplication depth required by the plaintext processing procedure. If the total multiplication depth is less than or equal to twice the multiplication depth required for the bootstrap operation, then the total multiplication depth is selected as the target multiplication depth. If the total multiplication depth is greater than twice the multiplication depth required for the bootstrap operation, then the target multiplication depth is selected as twice the multiplication depth required for the bootstrap operation.

9. The method of claim 7, wherein, The homomorphic encryption parameters include the target dimension of the polynomial ring; The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes: Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target dimension of the polynomial ring. Call the initialized fully homomorphic encryption function.

10. The method of claim 9, wherein, The target dimension of the polynomial ring is determined in the following manner: The size of the batch data processed by the analysis operator is used to obtain the minimum dimension of the required polynomial ring; The minimum dimension of the polynomial ring is adjusted according to the target multiplication depth and the homomorphic encryption standard to obtain the target dimension of the polynomial ring.

11. The method of claim 7, wherein, The homomorphic encryption parameters include the target rotation key; The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes: When the homomorphic operation is a fully homomorphic rotation operation, the fully homomorphic encryption function corresponding to the rotation operation is initialized according to the target rotation key; Call the initialized fully homomorphic encryption function.

12. The method of claim 11, wherein, The target rotation key is determined in the following manner: Scan all fully homomorphic rotation operations in the homomorphic operation sequence to obtain the offset corresponding to each fully homomorphic rotation operation; The target rotation key is generated based on each offset.

13. The method of claim 7, wherein, The homomorphic encryption parameters include the target modulus of each variable; The invocation of the fully homomorphic encryption function corresponding to the homomorphic operation includes: Initialize the fully homomorphic encryption function corresponding to the homomorphic operation based on the target modulus of each variable; Call the initialized fully homomorphic encryption function.

14. The method of claim 13, wherein, The target modulus of each variable is determined in the following manner: Based on the target multiplication depth and the target dimension of the polynomial ring, determine the target modulus of each variable; or, Determine the target modulus of each variable based on user instructions.

15. An apparatus for compiling a plaintext processing program into a ciphertext processing program, the apparatus comprising: An acquisition unit is used to acquire a plaintext processing program, wherein the plaintext processing program includes multiple operators; The transformation unit is used to transform each operator among the multiple operators acquired by the acquisition unit into a corresponding homomorphic operation to obtain a sequence of homomorphic operations. Specifically, when any operator is a linear operator, it is directly transformed into a corresponding homomorphic operation. When the operator is a nonlinear operator, the corresponding target polynomial is determined by polynomial fitting, and the operator is transformed into a homomorphic operation corresponding to the target polynomial. The calling unit is used to traverse each homomorphic operation in the homomorphic operation sequence obtained by the transformation unit, call the fully homomorphic encryption function corresponding to the homomorphic operation, and obtain the ciphertext processing program.

16. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-14.

17. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-14.

Images