Model distributed identity auditing method based on zero-knowledge proof

Abstract

The invention relates to a model distributed identity auditing method based on zero knowledge proof, and belongs to the technical field of deep neural network model ownership protection. The implementation method comprises the following steps that: 1, a model owner initializes a public parameter and generates a public and private key pair; 2, training a deep learning model by a model owner by using a local data set, storing a model weight parameter as a weight intermediate check point every several rounds of iteration, and generating a model distributed identity record IR; 3, the model owner generates an internal zero-knowledge proof and an external zero-knowledge proof of a model distributed identity record IR, and submits the external zero-knowledge proof and a public key to the block chain; and 4, a verifier on the block chain verifies the external zero-knowledge proof of the distributed identity record of the model through a public key, verification succeeds, the distributed identity record of the model is valid, and a model owner stores the IR on the block chain. Compared with the prior art, the method has the advantages of non-interactivity, good privacy protection and universality.

Description

Technical Field

[0001] The present invention relates to a model distributed identity auditing method based on zero-knowledge proof, and belongs to the technical field of deep neural network model ownership protection. Background Art

[0002] Deep learning can process complex large-scale data and extract high-level abstract representations from it, providing powerful tools and methods for solving tasks such as image recognition, natural language processing, and intelligent decision-making. Implementing high-performance deep learning models usually incurs huge costs and also involves the use of large-scale labeled data sets and a large amount of computing resources. Therefore, model commercialization can become a lucrative new market, allowing users to license or sell the use rights of their deep neural network models on third-party service platforms. Unfortunately, once deep neural network models are sold or the final parameters of the model are released, they can be easily redistributed or stolen by adversaries.

[0003] Existing copyright protection methods for deep neural network models achieve model ownership verification through identity auditing, which can be mainly divided into three categories. The first one includes model watermarking and fingerprinting to uniquely identify and recognize deep neural network models. Model watermarking technology usually uses some covert methods to embed secret watermarks into deep neural network models, such as modifying the model's weights, activation functions, or network structures. These are unique and stable enough to verify the model identity for small changes in the model structure, but will affect the model performance. Compared with modifying deep neural network models, model fingerprinting technology based on model feature extraction of a unique identification code provides practicality. However, the adversary can invalidate the original fingerprint through model distillation or model extraction attacks and forge the fingerprint to claim ownership. Another method is the training set inference method, which distinguishes the stolen model on the training set of the victim model by exposing the model owner's private knowledge area of ​​the dataset and decision boundary. The practical application of this method is greatly limited because valuable and sensitive data checkpoints may be disclosed. In addition, the computation-based model ownership verification scheme has a high probability of ensuring the computational integrity of the model owner during the training process by replaying the training history by the verifier. However, this method cannot resist the "adversarial sample" attack, and there is a possibility of forged proof. That is to say, one of the key challenges of model ownership verification is to find a more efficient and lightweight model identity auditing solution that does not leak the private knowledge of the model owner during the model training process.

[0004] As a trusted identity auditing tool, blockchain-based distributed digital identity of models provides a new perspective for verifying model ownership and commercialization. Specifically, effective distributed identity of deep neural network models involves two properties: (1) the model owner has spent energy and computing resources to perform the training task; (2) the training task has been calculated correctly, indicating that the owner has maintained the computational integrity.

[0005] Therefore, how to prevent adversaries from stealing and forging proof of ownership in existing identity auditing and ownership protection models has become an urgent problem to be solved. Summary of the invention

[0006] The purpose of the present invention is to solve the technical problem of preventing adversaries from stealing and forging ownership certificates in existing model identity auditing and ownership protection, and to propose a model distributed identity auditing method based on zero-knowledge proof.

[0007] The objective of the present invention is achieved through the following technical solutions:

[0008] A model distributed identity auditing method based on zero-knowledge proof of the present invention comprises the following steps:

[0009] Step 1: The model owner initializes public parameters and generates a public-private key pair;

[0010] Step 1.1: The model owner initializes the public parameters (ppC, ppZK) of the zero-knowledge proof using the method shown in equations (1) and (2);

[0011] ppC←ComPPGen(λ)(1)

[0012] ppZK←ZKPPGen(λ)(2)

[0013] Among them, λ is the security parameter, ppH is the public parameter of the hash function, ppC is the public parameter of the commitment scheme and ppZK is the public parameter of the zero-knowledge proof system.

[0014] Step 1.2: The model owner generates a public-private key pair (IRPK, IRSK) using the method shown in formula (3) to identify and verify the model owner and the model distributed identity;

[0015] (IRPK,IRSK)←KeyGen(ppC,skPR;crkp)(3)

[0016] Among them, IRPK is the public key, IRSK is the private key, skPR is the secret key of the pseudo-random function, and crkp is the random number used to generate the commitment scheme.

[0017] Step 2: The model owner uses the local dataset to train the deep learning model, and saves the model weight parameters as intermediate weight checkpoints every several iterations, and generates the model distributed identity record IR using formula (4);

[0018] IR=(IRPK,WCS,Φbirth,CP; crkp) (4)

[0019] Among them, WCS is the weighted intermediate checkpoint, CP is the commitment of IR, and Φbirth is the birth predicate of IR, which indicates the generation of the model distributed identity record IR.

[0020] Step 3: The model owner will generate an internal zero-knowledge proof and an external zero-knowledge proof of the model's distributed identity record IR, and submit the external zero-knowledge proof and public key to the blockchain;

[0021] Step 3.1: The model owner uses the model distributed identity to record IR and commitment CP, and generates an internal zero-knowledge proof using the method shown in formula (5);

[0022] πin←InnerZKProve(ppZK,IR,CP)(5)

[0023] Where πin represents the internal zero-knowledge proof;

[0024] Step 3.2: The model owner uses the internal zero-knowledge proof and commitment to generate an external zero-knowledge proof using the method shown in formula (6);

[0025] πout←OuterZKProve(ppZK,IRSK,CP,πin)(6)

[0026] Step 3.3: The model owner submits the external zero-knowledge proof πout and the public key IRPK to the blockchain;

[0027] Step 4: The verifier on the blockchain verifies the external zero-knowledge proof of the model distributed identity record through the public key. Successful verification indicates that the model distributed identity record is valid, and the model owner stores the model distributed identity record IR on the blockchain.

[0028] Beneficial effects:

[0029] Compared with the prior art, the present invention has the following effects:

[0030] 1. The method is non-interactive. In the verification process, the present invention uses zero-knowledge proof technology to reduce the interaction cost between the verifier and the prover;

[0031] 2. The method has good privacy protection. The present invention ensures that the model owner has zero knowledge of the model training process and data set through internal zero-knowledge proof and external zero-knowledge proof, thereby achieving privacy protection while ensuring that the model can be accurately audited;

[0032] 3. The method has good universality. The present invention uses the model distributed identity record as the smallest unit of model identity operation, which can represent the incremental changes of all model weight checkpoints. By storing the model distributed identity record on the blockchain, it ensures that the optimization work of the model owner on the final model can be accurately audited. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the distributed identity auditing method of the present invention;

[0034] Figure 2 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0035] In order to better illustrate the purpose and advantages of the present invention, the invention is further described below in conjunction with the accompanying drawings and examples. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the protection scope of the present invention.

[0036] In this embodiment, the hospital acts as the model owner and the government acts as the verifier on the blockchain to illustrate the model distributed identity audit method based on zero-knowledge proof.

[0037] Example

[0038] like Figure 1 As shown, a model distributed identity audit method based on zero-knowledge proof in this embodiment is specifically implemented as follows:

[0039] Step 1: The model owner initializes public parameters and generates a public-private key pair;

[0040] Step 1.1: The model owner initializes the public parameters (ppC, ppZK) of the zero-knowledge proof using the method shown in equations (1) and (2);

[0041] ppC←ComPPGen(λ)(1)

[0042] ppZK←ZKPPGen(λ)(2)

[0043] Among them, λ is the security parameter, ppH is the public parameter of the hash function, ppC is the public parameter of the commitment scheme and ppZK is the public parameter of the zero-knowledge proof system.

[0044] Step 1.2: The model owner generates a public-private key pair (IRPK, IRSK) using the method shown in formula (3) to identify and verify the model owner and the model distributed identity;

[0045] (IRPK,IRSK)←KeyGen(ppC,skPR;crkp)(3)

[0046] Among them, IRPK is the public key, IRSK is the private key, skPR is the secret key of the pseudo-random function, and crkp is the random number used to generate the commitment scheme.

[0047] In the embodiment, the hospital initializes public parameters and generates a public-private key pair. The hospital initializes public parameters (ppC, ppZK) for zero-knowledge proof using the method shown in formula (1) and formula (2). The hospital generates a public-private key pair (IRPK, IRSK) using the method shown in formula (3) for identifying and verifying the hospital identity and model distributed identity.

[0048] Step 2: The model owner uses the local dataset to train the deep learning model, and saves the model weight parameters as intermediate weight checkpoints every several iterations, and generates the model distributed identity record IR using formula (4);

[0049] IR=(IRPK,WCS,Φbirth,CP; crkp) (4)

[0050] Among them, WCS is the weighted intermediate checkpoint, CP is the commitment of IR, and Φbirth is the birth predicate of IR, which indicates the generation of the model distributed identity record IR.

[0051] In the embodiment, the hospital uses the medical data set to train the deep learning model, and saves the model weight parameters as the intermediate weight checkpoints every several iterations, and uses formula (4) to generate the model distributed identity record IR;

[0052] Step 3: The model owner will generate an internal zero-knowledge proof and an external zero-knowledge proof of the model's distributed identity record IR, and submit the external zero-knowledge proof and public key to the blockchain;

[0053] Step 3.1: The model owner uses the model distributed identity to record IR and commitment CP, and generates an internal zero-knowledge proof using the method shown in formula (5);

[0054] πin←InnerZKProve(ppZK,IR,CP)(5)

[0055] Where πin represents the internal zero-knowledge proof;

[0056] Step 3.2: The model owner uses the internal zero-knowledge proof and commitment to generate an external zero-knowledge proof using the method shown in formula (6);

[0057] πout←OuterZKProve(ppZK,IRSK,CP,πin)(6)

[0058] Step 3.3: The model owner submits the external zero-knowledge proof πout and the public key IRPK to the blockchain;

[0059] In the embodiment, the hospital generates an internal zero-knowledge proof and an external zero-knowledge proof of the model distributed identity record IR, and submits the external zero-knowledge proof and the public key to the blockchain; specifically, the hospital uses the model distributed identity record IR and the commitment CP to generate an internal zero-knowledge proof using the method shown in formula (5); the hospital uses the internal zero-knowledge proof and the commitment to generate an external zero-knowledge proof using the method shown in formula (6); the hospital submits the external zero-knowledge proof πout and the public key IRPK to the blockchain.

[0060] Step 4: The verifier on the blockchain verifies the external zero-knowledge proof of the model distributed identity record through the public key. Successful verification indicates that the model distributed identity record is valid, and the model owner stores the model distributed identity record IR on the blockchain.

[0061] In the embodiment, the government on the blockchain verifies the external zero-knowledge proof of the model distributed identity record through the public key. Successful verification indicates that the hospital model distributed identity record is valid, and the hospital stores the model distributed identity record IR on the blockchain.

[0062] To further demonstrate the superiority of the present invention, simulation experiments are used to verify the effect of the present invention. As shown in Table 1, IR is used as the input of blockchain transactions, and we set the number of IRs to [3, 4, 5, 6, 7, 8, 9, 10]. In addition, we use the pairing-based elliptic curve BLS12-381 to support 128-bit security. For blockchain transactions, we use SNARKs of TURBOPLONK and ULTRAPLONK as internal and external circuits, respectively. In addition, we use the pairing-based elliptic curve BLS12-377, which provides a high level of security with 128-bit strength.

[0063] Table 1 Experimental verification based on different IR numbers

[0064]

[0065] Table 1 lists the specific time costs of transaction proofs in different IR number input transaction dimensions. For "system initialization", the model identity audit problem is transformed into a constraint system through the construction of IR and predicates. "Parameter generation" involves the generation of security parameters, namely ppH, ppC and ppZK and other parameters for the proof system. "Key generation" represents the time cost of generating the proof key address IRPK. In addition, we evaluate the performance of the transaction generation phase from three dimensions: "internal zero-knowledge proof constraints", "external zero-knowledge proof constraints" and "transaction execution". As the number of input IRs changes from 2 to 10, the constraints of internal and external circuits and the execution time of transaction proofs all show significant increases. For "proof verification", the verification time cost of the Merkle tree root remains stable between 0.22s and 0.25s, achieving a lightweight verification cost.

[0066] The specific description above further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A model distributed identity auditing method based on zero-knowledge proof, characterized by: The following steps are included: Step 1: The model owner initializes public parameters and generates a public-private key pair; Step 2: The model owner uses the local dataset to train the deep learning model, and saves the model weight parameters as intermediate weight checkpoints every several iterations, and generates the model distributed identity record IR using formula (4); IR=(IRPK,WCS,Φbirth,CP; crkp) (4) Among them, WCS is the weighted intermediate checkpoint, CP is the commitment of IR, Φbirth is the birth predicate of IR, which indicates the generation of the model distributed identity record IR; Step 3: The model owner will generate an internal zero-knowledge proof and an external zero-knowledge proof of the model's distributed identity record IR, and submit the external zero-knowledge proof and public key to the blockchain; Step 3.1: The model owner uses the model distributed identity to record IR and commitment CP, and generates an internal zero-knowledge proof using the method shown in formula (5); πin←InnerZKProve(ppZK,IR,CP)(5)where πin represents the inner zero-knowledge proof; Step 3.2: The model owner uses the internal zero-knowledge proof and commitment to generate an external zero-knowledge proof using the method shown in formula (6); πout←OuterZKProve(ppZK,IRSK,CP,πin)(6)Step 3.3: The model owner submits the external zero-knowledge proof πout and the public key IRPK to the blockchain; Step 4: The verifier on the blockchain verifies the external zero-knowledge proof of the model distributed identity record through the public key. Successful verification indicates that the model distributed identity record is valid, and the model owner stores the model distributed identity record IR on the blockchain.

2. A model-distributed identity auditing method based on zero-knowledge proof as claimed in claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: The model owner initializes the public parameters (ppC, ppZK) of the zero-knowledge proof using the method shown in equations (1) and (2); ppC←ComPPGen(λ)(1)ppZK←ZKPPGen(λ)(2) Where λ is the security parameter, ppH is the public parameter of the hash function, ppC is the public parameter of the commitment scheme, and ppZK is the public parameter of the zero-knowledge proof system; Step 1.2: The model owner generates a public-private key pair (IRPK, IRSK) using the method shown in formula (3) to identify and verify the model owner and the model distributed identity; (IRPK,IRSK)←KeyGen(ppC,skPR;crkp)(3) Among them, IRPK is the public key, IRSK is the private key, skPR is the secret key of the pseudo-random function, and crkp is the random number used to generate the commitment scheme.

Images