Inference verification system and inference verification method

Abstract

An estimation device (400) represents a decimal value, which is data to be subjected to estimation processing, by using an integer value, processes the integer value as a parameter of a convolutional neural network, and executes an estimation model to obtain an estimation result. A certification device (500) receives a certification by executing a certification generation algorithm using the estimation result as an input. The verification device (600) obtains a verification result by executing a verification algorithm using the proof as an input.

Description

Technical Field

[0001] The present disclosure relates to the verification of inference models based on zero-knowledge proofs. Background Art

[0002] AI inference technology based on neural networks has achieved great success in machine learning tasks such as data classification. AI is the abbreviation for artificial intelligence.

[0003] In order to perform data analysis based on neural networks, it is necessary to learn the inference model using a large amount of learning data in advance. At this time, due to the difficulty of preparing learning data and the limitation of computing resources, it is sometimes difficult for users to build inference models in their own environment.

[0004] Based on this view, in recent years, there is a service (MLaaS) that provides data analysis based on neural networks on the cloud. Through this service, the client uploads the data that it wants to analyze to the cloud, thereby being able to perform inference based on the provided inference model. Therefore, the client does not need to spend money on the construction of the inference model.

[0005] MLaaS is the abbreviation of Machine Learning as a Service.

[0006] In MLaaS, when a client sends data that it wishes to analyze to the provider of an inference model to entrust the provider with inference processing, the service provider needs to prove to the client that the inference result is actually the result of analysis using the inference model.

[0007] The simplest solution strategy is for the service provider to expose the inference model itself. However, the inference model is the intellectual property of the service provider, so it is difficult to expose the inference model to the client.

[0008] Non-Patent Document 1 proposes a method that can prove, using zero-knowledge proof, that an inference process based on an inference model has actually been executed.

[0009] Through this method, the service provider can prove to the client that the inference result is obtained through analysis and processing based on the inference model.

[0010] Prior art literature

[0011] Non-patent literature

[0012] Non-patent literature 1: zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and Accuracy. Tianyi Liu, Xiang Xie, and Yupeng Zhang. 2021. Summary of the invention

[0013] Problems to be solved by the invention

[0014] In the method of Non-Patent Document 1, due to the constraints of the zero-knowledge proof protocol used, only integer values ​​can be processed as parameters of the inference model.

[0015] The purpose of the present disclosure is to enable verification of inference models with decimal parameters.

[0016] Means for solving problems

[0017] The inference verification system disclosed in the present invention comprises: an inference unit, which uses an integer value to represent a decimal value of data that becomes an inference processing object, processes the integer value as a parameter of a convolutional neural network, executes an inference model to obtain an inference result; a proof unit, which uses the inference result as input, executes a proof generation algorithm to obtain a proof; and a verification unit, which uses the proof as input, executes a verification algorithm to obtain a verification result.

[0018] Effects of the Invention

[0019] According to the present disclosure, it is possible to verify an inference model whose parameters are decimals. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a configuration diagram of the estimation verification system 100 in the first embodiment.

[0021] Figure 2 This is a diagram showing the structure of parameter generating device 200 in Embodiment 1.

[0022] Figure 3 This is a diagram showing the structure of the key generation device 300 in the first embodiment.

[0023] Figure 4 This is a configuration diagram of the estimation device 400 in the first embodiment.

[0024] Figure 5 This is a structural diagram of the certification device 500 in the first embodiment.

[0025] Figure 6 This is a diagram showing the structure of the verification device 600 in the first embodiment.

[0026] Figure 7 This is a flowchart of the inference verification method (parameter generation) in the first embodiment.

[0027] Figure 8 This is a flowchart of the inference verification method (key generation) in the first embodiment.

[0028] Fig. 9 This is a flowchart of the inference verification method (inference) in Implementation Example 1.

[0029] Fig.10 This is a flowchart of the inference verification method (proof) in Implementation Example 1.

[0030] Fig.11 This is a flowchart of the inference verification method (verification) in the first embodiment.

[0031] Fig.12 This is a hardware configuration diagram of the parameter generating device 200 in the first embodiment.

[0032] Fig.13 This is a hardware configuration diagram of the key generation device 300 in the first embodiment.

[0033] Fig.14 This is a hardware configuration diagram of the estimation device 400 in the first embodiment.

[0034] Fig.15 This is a hardware configuration diagram of the certification device 500 in the first embodiment.

[0035] Fig.16 This is a hardware configuration diagram of the verification device 600 in the first embodiment. DETAILED DESCRIPTION

[0036] In the embodiments and the drawings, the same reference numerals are used to denote the same elements or corresponding elements. The description of elements denoted by the same reference numerals as those already described is appropriately omitted or simplified. The arrows in the drawings mainly indicate data flows or process flows.

[0037] Implementation Method 1

[0038] according to Figures 1 to 16 The estimation verification system 100 will be described.

[0039] The inference verification system 100 is a system capable of verifying an inference process.

[0040] ***Description of the structure***

[0041] according to Figure 1 The configuration of the estimation verification system 100 will be described.

[0042] The inference verification system 100 includes devices such as a parameter generation device 200 , a key generation device 300 , an inference device 400 , a certification device 500 , and a verification device 600 .

[0043] These devices communicate with each other via a network. A specific example of a network is the Internet.

[0044] according to Figure 2 The structure of the parameter generating device 200 will be described.

[0045] The parameter generating device 200 is a computer having hardware such as a processor 201, a memory 202, an auxiliary storage device 203, a communication device 204, and an input / output interface 205. These hardware are connected to each other via signal lines.

[0046] The processor 201 is a processor of the parameter generating device 200 .

[0047] A processor is an IC that performs calculations and controls other hardware. For example, a processor is a CPU.

[0048] IC is the abbreviation of Integrated Circuit.

[0049] CPU is the abbreviation of Central Processing Unit.

[0050] The memory 202 is a memory of the parameter generating device 200 .

[0051] A memory is a volatile or non-volatile storage device. A memory is also referred to as a main storage device or a main memory. For example, a memory is a RAM.

[0052] The data stored in the memory 202 is stored in the auxiliary storage device 203 as necessary.

[0053] RAM is the abbreviation of Random Access Memory.

[0054] The auxiliary storage device 203 is an auxiliary storage device of the parameter generating device 200 .

[0055] The auxiliary storage device is a non-volatile storage device. For example, the auxiliary storage device is a ROM, a HDD, a flash memory, or a combination thereof.

[0056] The data stored in the auxiliary storage device 203 is loaded into the memory 202 as needed.

[0057] ROM is the abbreviation of Read Only Memory.

[0058] HDD is the abbreviation of Hard Disk Drive.

[0059] The communication device 204 is a communication device of the parameter generating device 200 .

[0060] The communication device is a receiver and a transmitter. For example, the communication device is a communication chip or a NIC.

[0061] The communication of the parameter generating device 200 is performed using the communication device 204 .

[0062] NIC is the abbreviation of Network Interface Card.

[0063] The input / output interface 205 is an input / output interface of the parameter generating device 200 .

[0064] The input / output interface is a port to which an input device and an output device are connected. For example, the input / output interface is a USB terminal, the input device is a keyboard and a mouse, and the output device is a display.

[0065] The input and output of the parameter generating device 200 are performed using the input and output interface 205 .

[0066] USB is the abbreviation of Universal Serial Bus.

[0067] The parameter generating device 200 includes elements such as a receiving unit 210, a generating unit 220, and an output unit 230. These elements are realized by software.

[0068] The auxiliary storage device 203 stores a parameter generation program for causing the computer to function as the receiving unit 210, the generating unit 220, and the output unit 230. The parameter generation program is loaded into the memory 202 and executed by the processor 201.

[0069] The OS is also stored in the auxiliary storage device 203. At least a part of the OS is loaded into the memory and executed by the processor.

[0070] The processor 201 executes the parameter generation program while executing the OS.

[0071] OS is the abbreviation of Operating System.

[0072] The input and output data of the parameter generation program are stored in the storage unit 290 .

[0073] The memory 202 functions as the storage unit 290 . However, a storage device such as the auxiliary storage device 203 , a register in the processor 201 , or a cache memory in the processor 201 may function as the storage unit 290 instead of or together with the memory 202 .

[0074] The parameter generating device 200 may include a plurality of processors instead of the processor 201 .

[0075] according to Figure 3 The structure of the key generation device 300 will be described.

[0076] The key generation device 300 is a computer having hardware such as a processor 301, a memory 302, an auxiliary storage device 303, a communication device 304, and an input / output interface 305. These hardware are connected to each other via a signal line.

[0077] The processor 301 is a processor of the key generating device 300 .

[0078] The memory 302 is a memory of the key generating device 300 .

[0079] The auxiliary storage device 303 is an auxiliary storage device of the key generation device 300 .

[0080] The communication device 304 is a communication device of the key generation device 300 .

[0081] The input / output interface 305 is an input / output interface of the key generation device 300 .

[0082] The key generation device 300 includes elements such as a reception unit 310, a generation unit 320, and an output unit 330. These elements are implemented by software.

[0083] The auxiliary storage device 303 stores a key generation program for causing the computer to function as the receiving unit 310, the generating unit 320, and the output unit 330. The key generation program is loaded into the memory 302 and executed by the processor 301.

[0084] The key generation device 300 also stores an OS.

[0085] The processor 301 executes the key generation program while executing the OS.

[0086] Input and output data of the key generation program are stored in the storage unit 390 .

[0087] The memory 302 functions as the storage unit 390 . However, a storage device such as the auxiliary storage device 303 , a register in the processor 301 , or a cache memory in the processor 301 may function as the storage unit 390 instead of or together with the memory 302 .

[0088] The key generation device 300 may include a plurality of processors instead of the processor 301 .

[0089] according to Figure 4 The structure of the estimation device 400 will be described.

[0090] The estimation device 400 is a computer having hardware such as a processor 401, a memory 402, an auxiliary storage device 403, a communication device 404, and an input / output interface 405. These hardware are connected to each other via signal lines.

[0091] Processor 401 is a processor of inference device 400 .

[0092] The memory 402 is a memory of the inference device 400 .

[0093] The auxiliary storage device 403 is an auxiliary storage device of the inference device 400 .

[0094] The communication device 404 is a communication device of the inference device 400 .

[0095] The input / output interface 405 is an input / output interface of the inference device 400 .

[0096] The estimation device 400 includes elements such as a receiving unit 410, an estimation unit 420, and an output unit 430. These elements are realized by software.

[0097] The auxiliary storage device 403 stores an inference program for causing the computer to function as the receiving unit 410, the inference unit 420, and the output unit 430. The inference program is loaded into the memory 402 and executed by the processor 401.

[0098] The estimation device 400 also stores an OS.

[0099] The processor 401 executes the inference program while executing the OS.

[0100] The input and output data of the inference program are stored in the storage unit 490 .

[0101] The memory 402 functions as the storage unit 490 . However, a storage device such as the auxiliary storage device 403 , a register in the processor 401 , or a cache memory in the processor 401 may function as the storage unit 490 instead of or together with the memory 402 .

[0102] The inference device 400 may include a plurality of processors instead of the processor 401 .

[0103] according to Figure 5 The structure of the certification device 500 is described.

[0104] The certification apparatus 500 is a computer having hardware such as a processor 501, a memory 502, an auxiliary storage device 503, a communication device 504, and an input / output interface 505. These hardware are connected to each other via signal lines.

[0105] Processor 501 is a processor of certification device 500 .

[0106] Memory 502 is the memory of the certification device 500.

[0107] The auxiliary storage device 503 is an auxiliary storage device of the certification device 500 .

[0108] The communication device 504 is a communication device of the certification device 500 .

[0109] The input / output interface 505 is an input / output interface of the certification device 500 .

[0110] The certification device 500 includes elements such as a receiving unit 510, a storage unit 520, a certification unit 530, and an output unit 540. The storage unit 520 includes a key storage unit 521 and an estimation result storage unit 522. These elements are realized by software.

[0111] The auxiliary storage device 503 stores a certification program for causing the computer to function as the receiving unit 510, the storage unit 520, the certification unit 530, and the output unit 540. The certification program is loaded into the memory 502 and executed by the processor 501.

[0112] The certification device 500 also stores an OS.

[0113] The processor 501 executes the certification program while executing the OS.

[0114] The input and output data of the certification program are stored in the storage unit 590 .

[0115] The memory 502 functions as the storage unit 590 . However, a storage device such as the auxiliary storage device 503 , a register in the processor 501 , or a cache memory in the processor 501 may function as the storage unit 590 instead of or together with the memory 502 .

[0116] The certification device 500 may include a plurality of processors instead of the processor 501 .

[0117] according to Figure 6 The structure of the verification device 600 is described.

[0118] The verification device 600 is a computer having hardware such as a processor 601, a memory 602, an auxiliary storage device 603, a communication device 604, and an input / output interface 605. These hardware are connected to each other via signal lines.

[0119] The processor 601 is a processor of the verification device 600 .

[0120] The memory 602 is a memory of the verification device 600 .

[0121] The auxiliary storage device 603 is an auxiliary storage device of the verification device 600 .

[0122] The communication device 604 is a communication device of the verification device 600 .

[0123] The input / output interface 605 is an input / output interface of the verification device 600 .

[0124] The verification device 600 includes elements such as a receiving unit 610, a storage unit 620, a verification unit 630, and an output unit 640. The storage unit 620 includes a key storage unit 621 and a certificate storage unit 622. These elements are realized by software.

[0125] The auxiliary storage device 603 stores a verification program for causing the computer to function as the receiving unit 610, the storage unit 620, the verification unit 630, and the output unit 640. The verification program is loaded into the memory 602 and executed by the processor 601.

[0126] The verification device 600 also stores an OS.

[0127] The processor 601 executes the verification program while executing the OS.

[0128] The input and output data of the verification program are stored in the storage unit 690 .

[0129] The memory 602 functions as the storage unit 690 . However, a storage device such as the auxiliary storage device 603 , a register in the processor 601 , or a cache memory in the processor 601 may function as the storage unit 690 instead of or together with the memory 602 .

[0130] The verification device 600 may include a plurality of processors instead of the processor 601 .

[0131] ***Writing instructions***

[0132] This shows how to write it in the following description.

[0133] When “A” is a distribution, “y←A” means randomly selecting y from A according to the distribution.

[0134] When “A” is a set, “y←A” means selecting y uniformly from “A” for input x.

[0135] "p" is any prime number.

[0136] "G" is a group of p digits.

[0137] "m" and "n" are arbitrary natural numbers.

[0138] "e" is the base of natural logarithms.

[0139] "H" is the hash function.

[0140] “D” is the set of input data for the inference model.

[0141] "x" is input data to be processed by the inference.

[0142] "M" is the inference model.

[0143] When "n" is a natural number, [n] is the set {1, ..., n}.

[0144] "Z" is the set of integers.

[0145] "R" is the set of real numbers.

[0146] ***Description of the action***

[0147] The steps of the operation of the inference verification system 100 correspond to the inference verification method. In addition, the steps of the operation of the inference verification system 100 correspond to the steps of the processing based on the inference verification program.

[0148] The inference and verification procedure includes a parameter generation procedure, a key generation procedure, an inference procedure, a proof procedure and a verification procedure.

[0149] Each parameter creation program can be recorded (stored) in a computer-readable form on a nonvolatile recording medium such as an optical disk or a flash memory.

[0150] according to Figure 7 The operation of the parameter generation device 200 in the estimation and verification method will be described.

[0151] In step S210 , the receiving unit 210 receives the parameters (λ, D) input to the parameter generating device 200 .

[0152] For example, the parameters (λ, D) are input to the parameter generating device 200 by a manager.

[0153] In step S220 , the generation unit 220 executes a setting algorithm using the parameters (λ, D) as input.

[0154] Thereby, the public parameter pp is generated.

[0155] The setting algorithm is an algorithm for generating the public parameters pp.

[0156] For example, the setup algorithm (Setup) is expressed as follows.

[0157]

Mathematical formula 1

[0158] Setup(1 λ ,D):

[0159]

[0160] pp:=(g1,…,g n )

[0161] In step S230 , the output unit 230 outputs the public parameter pp.

[0162] Specifically, the output unit 230 transmits the public parameter pp to the key generation device 300 .

[0163] according to Figure 8 The operation of the key generation device 300 in the inference verification method will be described.

[0164] In step S310 , the accepting unit 310 accepts the public parameter pp input to the key generation device 300 .

[0165] Specifically, the receiving unit 310 receives the public parameter pp from the parameter generating device 200 .

[0166] In step S320 , the generation unit 320 executes a key generation algorithm using the public parameter pp as an input.

[0167] Thereby, a public key pk and a secret key sk are generated.

[0168] The key generation algorithm is an algorithm for generating a public key pk and a secret key sk.

[0169] For example, the key generation algorithm (Kg) is represented as follows.

[0170]

Mathematical formula 2

[0171] Kg(pp):

[0172]

[0173] s j ←Z p

[0174] pk:=(g1,…,g n , h1,…,h m )

[0175] sk:=(s1,…,s l )

[0176] In step S330 , the output unit 330 outputs the public key pk and the secret key sk.

[0177] Specifically, the output unit 330 transmits the public key pk and the secret key sk to the certification device 500. Furthermore, the output unit 330 transmits the public key pk to the verification device 600.

[0178] according to Figure 4 The operation of the estimation device 400 in the estimation verification method will be described.

[0179] In step S410 , the accepting unit 410 accepts the parameter (M, x) input to the estimation device 400 .

[0180] For example, the inference model M is input to the inference device 400 by a provider of the inference model M. In addition, data x is sent to the inference device 400 by a client.

[0181] The inference model M is a model used in the inference process.

[0182] The data x is data to be processed for estimation.

[0183] In step S420 , the inference unit 420 executes an inference processing algorithm using the inference model M and the data x as input.

[0184] Thus, an inference result c is generated.

[0185] The inference processing algorithm is an algorithm for generating the inference result c.

[0186] For example, the inference processing algorithm (Classify) is represented as follows.

[0187] CNN is a convolutional neural network implemented by the inference model M.

[0188]

Mathematical formula 3

[0189] Classify(M,x):

[0190] c:=CNN(x)

[0191] In step S430 , the output unit 430 outputs the inference result c.

[0192] Specifically, the output unit 430 sends the inference result c to the certification device 500 .

[0193] according to Fig.10 The operation of the proving device 500 in the inference verification method will be described.

[0194] In step S510 , the accepting unit 510 accepts the public key pk, the secret key sk, and the estimation result c.

[0195] Specifically, the receiving unit 510 receives the public key pk and the secret key sk from the key generation device 300 . In addition, the receiving unit 510 receives the estimation result c from the estimation device 400 .

[0196] In step S520, the key storage unit 521 stores the public key pk and the secret key sk.

[0197] Furthermore, the estimation result storage unit 522 stores the estimation result c.

[0198] For example, the public key pk, the secret key sk, and the inference result c are stored in the auxiliary storage device 503 .

[0199] In step S530 , the certification unit 530 executes a certification generation algorithm using the public key pk, the secret key sk, and the inference result c as inputs.

[0200] Thus, proof P is generated.

[0201] A proof generation algorithm is an algorithm for generating a proof P.

[0202] Next, the proof generation algorithm (Prov e ) is used as an example to illustrate.

[0203] The estimation result c is expressed as follows. ci is the calculation result of the i-th layer of CNN.

[0204] c ＝ c1,…,c n

[0205] Prove i It is used to calculate the result c i Generate proof P i The algorithm.

[0206] For example, the proof generation algorithm (Prov e ) is expressed as follows.

[0207]

Mathematical formula 4

[0208] Prove(pk,sk,c):

[0209] P1:=Prove1(pk,sk,c1),...,P n :=Prove n (pk, sk, c n )

[0210] P:=(P1,...,P n )

[0211] Prove i Types (P a ~P f ) as follows.

[0212] (P a ) In the case where the i-th layer of CNN is a ReLU activation layer, Prove i The type is Prove ReLU .

[0213] (P b ) In the case where the i-th layer of CNN is an Affine layer, Prove i The type is Prove Affine .

[0214] (P c ) In the case where the i-th layer of CNN is a convolutional layer, Prove i The type is Prove Conv .

[0215] (P d ) In the case where the i-th layer of CNN is the Average Pooling layer, Prove i The type is Prove AP .

[0216] (P e ) In the case where the i-th layer of CNN is the Max Pooling layer, Prove i The type is Prove MP .

[0217] (P f ) In the case where the i-th layer of CNN is a Soft Max layer, Prove i The type is Prove SoftMax .

[0218] Prove i Various types (P a ~P f ) will be described later.

[0219] In step S540, the output unit 540 outputs the proof P.

[0220] Specifically, the output unit 540 sends the certificate P to the verification device 600 .

[0221] according to Fig.11 The operation of the verification device 600 in the inference verification method will be described.

[0222] In step S610 , the receiving unit 610 receives the public key pk and the certificate P.

[0223] Specifically, the receiving unit 610 receives the public key pk from the key generation device 300 . In addition, the receiving unit 610 receives the certificate P from the certification device 500 .

[0224] In step S620 , the key storage unit 621 stores the public key pk.

[0225] In addition, the certificate storage unit 622 stores the certificate P.

[0226] For example, the public key pk and the certificate P are stored in the auxiliary storage device 603 .

[0227] In step S630 , the verification unit 630 executes a verification algorithm using the public key pk and the certificate P as input.

[0228] Thus, a verification result V is generated.

[0229] The verification algorithm is an algorithm for generating the verification result V.

[0230] Next, an example of the verification algorithm (Verify) is described.

[0231] Verify i It is used to verify the proof P i The algorithm.

[0232] For example, the verification algorithm (Verify) is expressed as follows.

[0233]

Mathematical formula 5

[0234] Verify(pk,P):

[0235] V1:=Verify1(pk,P1),...,Verify n (pk,P n )

[0236] if(V1∧…∧V n =true)

[0237] V: =c

[0238] if(V1∧…∧V n =false)

[0239] V: =⊥

[0240] Verify i Types (V a ~V f ) as follows.

[0241] (V a ) In the case where the i-th layer of CNN is a ReLU activation layer, Verify i The type is Verify ReLU .

[0242] (V b ) In the case where the i-th layer of CNN is an Affine layer, Verify i The type is Verify Affine .

[0243] (V c ) In the case where the i-th layer of CNN is a convolutional layer, Verify i The type is Verify Conv .

[0244] (V d ) In the case where the i-th layer of CNN is the Average Pooling layer, Verify i The type is Verify AP .

[0245] (V e ) In the case where the i-th layer of CNN is the Max Pooling layer, Verify i The type is Verify MP .

[0246] (V f ) In the case where the i-th layer of CNN is the SoftMax layer, Verify i The type is Verify SoftMax .

[0247] Verify i Various types (V a ~V f ) will be described later.

[0248] In step S640 , the output unit 640 outputs the verification result V.

[0249] For example, the output unit 640 displays the verification result V on a display.

[0250] ***Explanation of the protocol and integer value display***

[0251] The following protocol will be described regarding the zero-knowledge proof protocol used in Embodiment 1. In addition, the integer value display of a decimal in Embodiment 1 will be described.

[0252] (1) Schnorr Protocol

[0253] (2) Schnorr Protocol for Multiple Indices

[0254] (3) Generalizing Schnorr’s Protocol

[0255] (4) OR Proof Protocol

[0256] (5)nOR Proof Protocol

[0257] (6) Displaying the integer value of a decimal

[0258] (7) Range Proofs Protocol

[0259] (8)Multiplication Proofs Protocol

[0260] (9) The ReLU Layer Protocol a , V a ]

[0261] (10) The Affine Layer Protocol b , V b ]

[0262] (11) The Convolution Layer Protocol c , V c ]

[0263] (12) The Average Pooling Layer Protocol d , V d ]

[0264] (13) The Max Pooling Layer Protocol e , V e ]

[0265] (14) The SoftMax Layer Protocol [P f , V f ]

[0266] (1) Explain the Schnorr protocol.

[0267] "g" is the source of G. At this time, for x∈Z p , y = gx Established.

[0268] The Schnorr protocol is used to allow the prover to prove that he knows y = g without providing the verifier with any information about x. x The protocol of x in .

[0269] The Schnorr protocol is based on the proof generation algorithm Prove Schnorr And verification algorithmVerify Schnorr constitute.

[0270] Prove Schnorr Output proof P.

[0271]

Mathematical formula 11

[0272] Prove Schnorr (g,y,x):

[0273] r←Z p

[0274] R: =g r

[0275] C: =H(g, y, R)

[0276] s:=r+Cx

[0277] P=(g,y,C,s)

[0278] Verify Schnorr Outputs true or false.

[0279]

Mathematical formula 12

[0280] Verify schnorr (g,y,C,s):

[0281] HV:=H(g,y,g s / y C )

[0282] if(C=HV)true

[0283] if(C≠HV)false

[0284] (2) The Schnorr protocol for multiple indices is described. The Schnorr protocol for multiple indices is a generalization of the Schnorr protocol (1).

[0285] g1,…,g n is the source of G. At this time, for x1∈Z p , …, x n ∈Z p, formula (2A) holds.

[0286]

Mathematical formula 13

[0287]

[0288] The Schnorr protocol for multiple indices is used to implement the multi-index protocol without providing the verifier with n ) in the formula (2A). n ) agreement.

[0289] The Schnorr protocol for multiple indices is made by the proof-making algorithm Prove MultiSchnorr And verification algorithmVerify MultiSchnorr constitute.

[0290] Prove MultiSchnorr Output proof P.

[0291]

Mathematical formula 14

[0292] Prove MultiSchnorr (g1,…,g n ,y,x1,…,x n ):

[0293] r i ←Z p (i∈{0,…,n})

[0294]

[0295] C:=H(g1,…,g n ,y,R)

[0296] s i :=r i +Cx i (i∈{0,...,n})

[0297] P=(g1,...,g n ,y,C,s1,…,s n )

[0298] Verify MultiSchnorr Outputs true or false.

[0299]

Mathematical formula 15

[0300] Verify MultiSchnorr (g1,…,g n ,y,C,s1,…,s n ):

[0301]

[0302] if(C=HV)true

[0303] if(C≠HV)false

[0304] (3) The generalized Schnorr protocol is described. The generalized Schnorr protocol is obtained by generalizing the Shnorr protocol for multiple indices in (2).

[0305] g 1,1 , …, g 1,n , g 2,1 , …, g m,n is the mn generation source of G. At this time, for x1∈Z p , …, x n ∈Z p , formula (3A) holds.

[0306]

Mathematical formula 16

[0307]

[0308] The generalized Schnorr protocol is used to implement the protocol without providing the verifier with the same n ) in the formula (3A). n ) agreement.

[0309] The generalized Schnorr protocol is made by the proof-making algorithm Prove GenSchnorr And verification algorithmVerify GenSchnorr constitute.

[0310] Prove GenSchnorr Output proof P.

[0311]

Mathematical formula 17

[0312] Prove GenSchnorr ((g j，i ) j∈[m],i∈[n] , (y j ) j∈[m] ,(x i ) i∈[n] ):

[0313] r1,…,r n ←Z p

[0314]

[0315] C:=H((g j，i ) j∈[m]，i∈[n], (y j ) j∈[m] , (R j ) j∈[m] )

[0316] s1:=r1+Cx1,…,s n :=r n +Cx n

[0317] P:=((g j，i ) j∈[m],i∈[n] , (y j ) j∈[m] , C, s1, ..., s n )

[0318] Verify GenSchnorr Outputs true or false.

[0319]

Mathematical formula 18

[0320] Verify GenSchnorr ((g j，i ) j∈[m]，i∈[n] , (y j ) j∈[m] , C,s1,...,s n ):

[0321]

[0322] if(C=HV)true

[0323] if(C≠HV)false

[0324] (4) Explain the ORProof protocol.

[0325] g 1,1 , …, g 1,n , g 2,1 , …, g m,n is the mn generation sources of G. At this time, for x=(x1, ..., x n ), formula (4A) holds.

[0326]

Mathematical formula 19

[0327]

[0328] Furthermore, for i=1, 2, the following equation holds.

[0329] x (i) =(x1 (i) , …, x n (i) )∈(Z p )n

[0330] y (i) =f(x (i) )

[0331] The ORProof protocol is used to (1) and x (2) All relevant information allows the prover to prove that he knows y (1) =f(x (1) ) (1) or (2) =f(x (2) ) (2) agreement.

[0332] The OR Proof protocol is based on the proof-making algorithm Prove OR And verification algorithmVerify OR constitute.

[0333] Prove OR Output proof P.

[0334]

Mathematical formula 20

[0335] Prove OR ((g j，i ) j∈[m]，i∈[n] , (y (i) , x (i) ) i＝1，2 ):

[0336] j: =3-i (i=1 or 2)

[0337] s (j) ←(Z p ) n

[0338] C (j) ←Z p

[0339]

[0340] r (i) ←(Z p ) n

[0341] R (i) :=f(r (i) )

[0342] C: =H(y (1) ,y (2) , R (1) , R (2) )

[0343] C (i) :=CC (j)

[0344] s (i) :=r (i) +C (i) x (i)

[0345] P:=((g j，i ) j∈[m]，i∈[n] ,y (1) ,y (2) , C (1) , C (2) ,s (1) ,s (2) )

[0346] Verify OR Outputs true or false.

[0347]

Mathematical formula 21

[0348] Verify OR ((g j，i ) j∈[m],i∈[n] ,y (1) ,y (2) , C (1) , C (2) ,s (1) ,s (2) ):

[0349]

[0350] if(C (1) +C (2) =HV)true

[0351] if(C (1) +C (2) ≠HV)false

[0352] (5) The nOR Proof protocol is described. The nOR Proof protocol is a generalization of the OR Proof protocol (4).

[0353] g 1,1 , …, g 1,n , g 2,1 , …, g m，n is the mn generation sources of G. At this time, for x=(x1, ..., x n ), equation (5A) holds.

[0354]

Mathematical formula 22

[0355]

[0356] Furthermore, for i∈[n], the following equation holds.

[0357] x (i) =(x1 (i) , …, x n (i) )∈(Z p ) n

[0358] y (i) =f(x (i) )

[0359] The nOR Proof protocol is used to verify the authenticity of the (i) All relevant information allows the prover to prove that he knows y (i) =f(x (i) ) (i) an agreement by at least one party.

[0360] The nOR Proof protocol is based on the Proven OR Verifyn OR constitute.

[0361] Proven OR For all j∈[n]\{i}, calculate the three equations s(j), C(j) and R(j) and output proof P.

[0362]

Mathematical formula 23

[0363] Prove nOR ((g j，i ) j∈[m],i∈[n] , (y (i) ,x (i) ) i∈[n] ):

[0364] s (j) ←(Z p ) n

[0365] C (j) ←Z p

[0366]

[0367] r (i) ←(Z p ) n

[0368] R (i) :=f(r (i) )

[0369] C:=H((y (i) , R (i) ) i∈[n] )

[0370] C (i) :=C-Σ j∈[n]\{i} C (j)

[0371] s (i) :=r (i) +C (i) x (i)

[0372] P:=((g j，i ) j∈[m],i∈[n] , (y (i) ,C (i) ,s (i) ) i∈[n] )

[0373] Verify nOR Outputs true or false.

[0374]

Mathematical formula 24

[0375] Verify nOR ((g j，i ) j∈[m],i∈[n] , (y (i) ,C (i) ,s (i) ) i∈[n] ):

[0376]

[0377] if(C (1) +…+C (n) =HV)true

[0378] if(C (1) +…+C (n) ≠HV)false

[0379] (6) Explain how to display the integer value of a decimal number.

[0380] "l" and "d" are positive integers, and formula (6A) holds.

[0381]

Mathematical formula 25

[0382] 2 2(l+d)+1 +2 d ≤(p-1) / 2 (6A)

[0383] At this time, the fixed point of the decimal x is displayed using the integer <x>To show.

[0384]

Mathematical formula 26

[0385] x=x0+x12 -d (x0∈{-2 l , ..., 2 l -1},x1∈{0,...,2 d -1})

[0386] <x>=x02 d +x1∈Z p

[0387] This makes it possible to process the model parameters of the convolutional neural network, which are usually expressed using real numbers, as integer values.

[0388] (7) Explain the Range Proofs protocol.

[0389] "g" and "h" are the generating sources of G.

[0390] "t" is an integer.

[0391] The Range Proofs protocol is used to allow the prover to prove that an integer t is greater than 0 and less than 2 without providing the verifier with information about the integer t. m The protocol for an integer.

[0392] The Range Proofs protocol is based on the Proof Making Algorithm Prove Range And verification algorithmVerify Range constitute.

[0393] Prove Range Calculate the binary representation of t.

[0394]

Mathematical formula 27

[0395]

[0396] s1←Z p ,…,s m-1 ←Z p

[0397]

[0398] Then, Prove Range Use (3) to generalize the Prove in the Schnorr protocol GenSchnorr , calculate proof P for the following 4 equations.

[0399]

Mathematical formula 28

[0400] Prove Range (g,h,t):

[0401] A=g s h t

[0402]

[0403] VerifyRange outputs the verification result V.

[0404]

Mathematical formula 29

[0405] Verify Range (P):

[0406] V:=Verify GenSchnorr (P)

[0407] (8) Explain the Multiplication Proofs protocol.

[0408] "g" and "h" are the generation sources of G. At this time, for integers x, y, and z, the following equation holds.

[0409] <x>=x0+x1 2d

[0410] <y>=y0+y1 2d

[0411] <z>=z0+z1 2d

[0412] The Multiplication Proofs protocol is used to allow the prover to prove that for integers x, y, z, the <z> ＝ <xy>An agreement that holds true in all relationships except for abandonment.

[0413] The Multiplication Proofs protocol is based on the Prove Mult And verification algorithmVerify Mult constitute.

[0414] In Prove Mult In the figure, the meanings of the various symbols are as follows.

[0415]

Mathematical formula 30

[0416] r x , r y ,r z ←Z p

[0417] w: =x1y1mod 2 d

[0418] r w ←Z p

[0419]

[0420] Prove Mult Using (3) the generalized Schnorr protocol and (7) the Range Proofs protocol, calculate proof P for the following nine equations.

[0421]

Mathematical formula 31

[0422] Prove Mult (g,h,x,y,z):

[0423]

[0424] <x> ∈{-2 l+d ,...,2 l+d -1}

[0425] <y> ∈{-2 l+d ,...,2 l+d -1}

[0426]

[0427] <z> ∈{-2 l+d ,...,2 l+d -1}

[0428]

[0429] <w>∈{-2 l+d ,...,2 l+d -1}

[0430]

[0431] Verify Mult Output verification result V.

[0432]

Mathematical formula 32

[0433] Verify Mult (P):

[0434] V:=Verify GenSchnorr (P)

[0435] (9) Explain the ReLU Rayer protocol.

[0436] The ReLU function is the function used in the activation layer of convolutional neural networks.

[0437]

Mathematical formula 33

[0438]

[0439] The ReLU Rayer protocol is a protocol for allowing a prover to prove that the relationship y=ReLU(x) holds for integers x and y without providing information about integers x and y to a verifier.

[0440] The ReLU Rayer protocol is composed of (P a )Prove ReLU and (V a )Verify algorithm ReLU constitute.

[0441] In Prove ReLU In the figure, the meanings of the various symbols are as follows.

[0442]

Mathematical formula 34

[0443] a:=0

[0444] r x , r y ,r a ,r neg ←Z p

[0445]

[0446] Prove ReLU Using (4) OR proof protocol, (7) Range Proof protocol, and (8) Multiplication Proofs protocol, calculate proof P for the following formula.

[0447]

Mathematical formula 35

[0448] Prove ReLU (g, h, x, y):

[0449]

[0450] <x> ∈{-2 l+d ，...，2 l+d -1}

[0451]

[0452] <y> ∈{-2 l+d ，...，2 l+d -1}

[0453]

[0454] ∈{-2 l+d ，...，2 l+d -1}

[0455] <ax> ＝< / ax> <x>

[0456] Prove PProve which of the following two equations is true.

[0457]

Mathematical formula 36

[0458] <x>∈{-2 l+d ,...,2 l+d -1}∧C neg / C y =g δ

[0459] <x>∈{0,...,2 l+d -1}∧C x / C y =g δ

[0460] Verify ReLU Output verification result V.

[0461]

Mathematical formula 37

[0462] Verify ReLU (P):

[0463] V:=Verify OR (P)

[0464] (10) Explain the Affine Layer protocol.

[0465] The Affine Layer protocol is used to allow the prover to prove that A∈R without providing the verifier with information about x, y, A, and b. n×n , b∈R n ,x,y∈R n The agreement that y=Ax+b holds.

[0466] A, b, x, and y are as follows.

[0467]

Mathematical formula 38

[0468]

[0469] b=(b1,...,b n ), x=(x1,…,x n ), y=(y1,…,y n )

[0470] The Affine Layer Protocol is developed by (P b )Prove Affine and (V b )Verify algorithm Affine constitute.

[0471] In Prove Affine In the figure, the meanings of the various symbols are as follows.

[0472]

Mathematical formula 39

[0473]

[0474] Prove Affine Using (3) the generalized Shnorr protocol, (7) the Range Proofs protocol, and (8) the Multiplication Proofs protocol, calculate proof P for the following formula.

[0475]

Mathematical formula 40

[0476] Prove Affine (g,h,x,y,b,A):

[0477]

[0478] i，j >∈{-2 l+d , ..., 2 l+d -1}((i,j)∈[n]×[n]),

[0479]

[0480] i >∈{-2 l+d , ..., 2 l+d -1}(i∈[n]),

[0481]

[0482] <x i >∈{-2 l+d , ..., 2 l+d -1}(i∈[n]),

[0483]

[0484] <y i >∈{-2 l+d , ..., 2 l+d -1}(i∈[n]),

[0485] i,j x i >=〈a i,j > <x i >((i,j)∈[n]×[n]),

[0486]

[0487] Verify Affine Output verification result V.

[0488]

Mathematical formula 41

[0489] Verify ReLU (P):

[0490] V:=Verify​​​ GenShnorr (P)

[0491] (11) Explain the Convolution Layer protocol.

[0492] The Convolution Layer protocol is used to allow the prover to prove that x, y∈R without providing the verifier with information about x, y, Conv. mm’ For y=Conv(x), the protocol holds.

[0493] Conv is the operation performed on the input data x in the convolutional layer of a convolutional neural network.

[0494] The Convolution Layer protocol is composed of (P c )Proof Generation Algorithm ProveC onv and (V c )Verify algorithm Conv constitute.

[0495] (a i,j ) is the weight parameter of Conv. At this time, for input x=(x 1,1 , …, x 1,m’ , …, x m,1 , …, x m,m’ ) and output y = (y 1,1， …, y 1,m ', ..., y m,1 , …, y m,m’ ), y i,j It is expressed using the following formula.

[0496]

Mathematical formula 42

[0497]

[0498] (1≤i≤m-s+1,1≤j≤m'-t+1)

[0499] Therefore, the proof P and verification result V can be generated using the same method as (10) The Affine Layer protocol.

[0500]

Mathematical formula 43

[0501] Prove Conv (g,h,x,y,b,A):

[0502] P:=Prove Affinev (g,h,x,y,b,A)

[0503] Verify Conv (P):

[0504] V:=Verify Affine (P)

[0505] (12) Explain the Average Pooling Layer protocol.

[0506] The Average Pooling Layer protocol is used to enable the prover to prove that x, y∈R without providing the verifier with information about x, y, and AP. m×m For y=AP(x), the protocol holds.

[0507] AP is the operation performed on the input data x in the Average Pooling layer of the convolutional neural network.

[0508] The Average Pooling Layer protocol is composed of (P d )Prove AP and (V d )Verify algorithm AP constitute.

[0509] For y and x, the following relationship holds.

[0510] "l" is the row and column size of the AP filter and the stride.

[0511]

Mathematical formula 44

[0512]

[0513] Thus, y is expressed in the form of a linear transformation of x.

[0514] Therefore, the proof P and verification result V can be generated using the same method as (10) The Affine Layer protocol.

[0515]

Mathematical formula 45

[0516] Prove AP (g,h,x,y,l):

[0517] P:=Prove Affinev (g,h,x,y,l)

[0518] Verify AP (P):

[0519] V:=Verify Affine (P)

[0520] (13) Explain the Max Pooling Layer protocol.

[0521] The Max Pooling Layer protocol is used to allow the prover to prove that x∈R without providing the verifier with information about x, y, and MP. km×km , y∈R m×m For y=MP(x), the protocol holds.

[0522] MP is the operation performed on the input data x in the Max Pooling layer of a convolutional neural network.

[0523] The MaxPooling Layer protocol is composed of (P e )Prove MP and (V e )Verify algorithm MP constitute.

[0524] For y and x, the following relationship holds.

[0525] "k" is the row and column size of the MP filter and is the stride.

[0526]

Mathematical formula 46

[0527]

[0528] y i，j =max{x k(i-1)+s,k(j-1)+t |s,t∈[1,k]}.

[0529] To prove that this relationship holds, prove the following equation.

[0530]

Mathematical formula 47

[0531]

[0532] Prove MP The following calculation is performed for all (i, j)∈[m]×[m].

[0533]

Mathematical formula 48

[0534] Prove MP (g,h,x,y,k):

[0535] r k(i-1)+s,k(j-1)+t ←Z p (s,t)∈[k]×[k]

[0536] r′ i，j ←Z p

[0537]

[0538] ProveMP uses the (7) Range Proofs protocol and the nOR Proof protocol to calculate proof P for the following formula.

[0539]

Mathematical formula 49

[0540] <y i，j >- <x k(i-1)+s,k(j-1)+t >∈{0,...,2 l+d+1 -1} (s,t)∈[k]×[k]

[0541] ∨ (s,t)∈[k]×[k] C k(i-1)+s,k(j-1)+t / C′ i，j

[0542] C′ i，j =δs,t(δ s，t =r k(i-1)+s,k(j-1)+t -r′ i，j )

[0543] Verify MP Using Verify nOR Generate a verification result V.

[0544]

Mathematical formula 50

[0545] Verify MP (P):

[0546] V:=Verify nOR (P)

[0547] (14) Explain the SoftMax Layer protocol.

[0548] The SoftMax Layer protocol is used to enable the prover to prove x, y∈R without providing the verifier with information about x and y. n For y=SoftMax(x), the agreement holds.

[0549] SoftMax is the operation performed on the input data x in the SoftMax layer of a convolutional neural network.

[0550] For x=(x1,…,x n )、y=(y1,…,y n ), y i It is expressed using formula (13A).

[0551]

Mathematical formula 51

[0552]

[0553] The SoftMax Layer Protocol replaces the input x with x'=log2e x to perform the calculation.

[0554] Therefore, the proof for equation (13A) can be constructed as follows. Constructing the proof For x', y'∈R, y'=2 x’ By combining this protocol with the (8) Multiplication Proofs protocol, a proof can be formed.

[0555] Prove that y' = 2 x’ The established protocol is generated by the proof algorithm Prove exp Verify and verify the result generation algorithm exp constitute.

[0556] <x’> =x0'2 d +x1' holds. This protocol uses the 8th-order polynomial (13C) to calculate formula (13D) instead of formula (13B).

[0557]

Mathematical formula 52

[0558]

[0559] P 1045 (X) = c8X 8 +…+c0 (13C)

[0560]

[0561] Among them, c0 to c8 are as follows.

[0562]

Mathematical formula 53

[0563] c0=0.100000000000077443021686·10 1

[0564] c1=0.693147180426163827795756·10 0

[0565] c2=0.240226510710170646053840·10 0

[0566] c3=0.555040686204663791577440·10 -1

[0567] c4=0.961834122588046237497700·10 -2

[0568] c5=0.133273035928143781932900·10 -2

[0569] c6=0.155107460590052573978000·10 -3

[0570] c7=0.141978473997656067110000·10 -4

[0571] c8=0.186334772413796707600000·10 -5

[0572] Next, we describe the proof generation algorithm Prove exp .

[0573] x0'[i] is the i-th bit of x0'.

[0574]

Mathematical formula 54

[0575] Prove exp (g, h, x′):

[0576]

[0577] d: = <P 1045 (x′1)>,

[0578]

[0579] Prove exp Using (7) Range Proofs protocol, (8) Multiplication Proofs protocol, and (3) Generalized Schnorr protocol, create proof P for the following formula.

[0580]

Mathematical formula 55

[0581]

[0582] <x′0> ∈{2 d ,...,2 d+l-1 },<x′1> ∈{0,...,2 d -1},<x′> =<x′0> +<x′1> ,

[0583]

[0584] from i =from i-1 ·<x′1> ,z1=<x′0> i∈{2,...,8},

[0585] d=c8·z8+…+c0= <P 1045 (x′0)>,

[0586] <y> ＝ · <d>.

[0587] Next, we describe the verification algorithm Verify exp .

[0588]

Mathematical formula 56

[0589] Verify exp (P):

[0590] V:=Verify GenShnorr (P)

[0591] The SoftMax Layer protocol is composed of (P f )Prove SoftMax and (V f )Verify algorithm SoftMax constitute.

[0592] Prove SoftMax Use Prove exp 、Prove Mult , calculate the proof P for the following formula.

[0593]

Mathematical formula 57

[0594] Prove SoftMax (g,h,x,y):

[0595]

[0596] Verify SoftMax Output verification result V.

[0597]

Mathematical formula 58

[0598] Verify SoftMax (P):

[0599] V:=Verify GenShnorr (P)

[0600] *** Features of Embodiment 1 ***

[0601] Embodiment 1 has the following features.

[0602] In the first embodiment, the model parameters of the inference model are converted into integer values, and the inference model is verified.

[0603] The algorithm of the zero-knowledge proof protocol of each layer is a feature of the first implementation method.

[0604] The verification method of the inference model is achieved by combining the integerization of weight parameters (model parameters) and the zero-knowledge proof protocol.

[0605] The reference numerals in parentheses indicate the features of the first embodiment.

[0606] The inference device (400) uses an integer value to represent a decimal value of data (x) that is an inference processing object, processes the integer value as a parameter of a convolutional neural network, executes an inference model (M), and obtains an inference result (c).

[0607] The proof device (500) takes the inference result as input, executes a proof generation algorithm and obtains a proof (P).

[0608] The verification device (600) takes the certificate as input, executes the verification algorithm and obtains a verification result (V).

[0609] The inference result includes the calculation results of each layer of the convolutional neural network.

[0610] The proof device (500) takes the calculation result of each layer of the convolutional neural network as input and executes the proof generation algorithm of the protocol corresponding to the type of the layer.

[0611] The proof includes the execution results of the proof generation algorithm for each layer of the convolutional neural network.

[0612] The verification device (600) takes the execution result of each layer of the convolutional neural network as input and executes the verification algorithm of the protocol corresponding to the type of the layer.

[0613] The verification result includes the execution result of the verification algorithm for each layer of the convolutional neural network.

[0614] ***Effects of Implementation Method 1***

[0615] Embodiment 1 uses an integer value to display a fixed decimal point of a decimal, thereby realizing a protocol for zero-knowledge proof of parameters that can handle decimals.

[0616] This makes it possible to verify an inference model whose parameters are decimals.

[0617] Embodiment 1 produces the following effects, for example.

[0618] The data is analyzed by a third party, who is the one providing the inference service based on the machine learning model.

[0619] According to the first embodiment, without disclosing information related to the inference model, it is possible to prove that the inference result of the analyzed data is the result obtained by actually using the machine learning model to infer the data.

[0620] The method of implementation mode 1 uses a fixed decimal point display for displaying decimals using integer values, and uses a zero-knowledge proof that uses the difficulty of the discrete logarithm problem. Thus, a zero-knowledge proof protocol that can handle decimal parameters is implemented. Furthermore, an inference model whose parameters are decimals can be verified.

[0621] ***Supplement to Implementation Method 1***

[0622] The parameter generation device 200, key generation device 300, inference device 400 and certification device 500 may be combined with each other. That is, the inference verification system 100 may include one or more computers that function as the parameter generation device 200, key generation device 300, inference device 400 and certification device 500.

[0623] The generator 220 of the parameter generating device 200 may have a random number generating function or the like to generate the public parameter pp.

[0624] The generation unit 320 of the key generation device 300 may have a random number generation function or the like to generate the public key pk and the secret key sk.

[0625] according to< / d> < / y> < / x> < / x> < / x> Fig.12 The hardware configuration of the parameter generating device 200 will be described.

[0626] The parameter generating device 200 includes a processing circuit 209 .

[0627] The processing circuit 209 is a processing circuit that realizes the receiving unit 210 , the generating unit 220 , and the output unit 230 .

[0628] The processing circuit may be dedicated hardware or a processor that executes a program stored in a memory.

[0629] In the case where the processing circuit is dedicated hardware, the processing circuit is, for example, a single circuit, a complex circuit, a programmed processor, a parallel programmed processor, an ASIC, an FPGA, or a combination thereof.

[0630] ASIC is the abbreviation of Application Specific Integrated Circuit.

[0631] FPGA is the abbreviation of Field Programmable Gate Array.

[0632] The parameter generating device 200 may include a plurality of processing circuits instead of the processing circuit 209 .

[0633] In the processing circuit 209 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0634] In this way, the functions of the parameter generating device 200 can be implemented by hardware, software, firmware or a combination thereof.

[0635] according to Fig.13 The hardware configuration of the key generation device 300 will be described.

[0636] The key generation device 300 includes a processing circuit 309 .

[0637] The processing circuit 309 is a processing circuit that realizes the receiving unit 310 , the generating unit 320 , and the output unit 330 .

[0638] The key generation device 300 may include a plurality of processing circuits instead of the processing circuit 309 .

[0639] In the processing circuit 309 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0640] In this way, the functions of the key generation device 300 can be implemented by hardware, software, firmware, or a combination thereof.

[0641] according to Fig.14 The hardware configuration of the estimation device 400 will be described.

[0642] The inference device 400 includes a processing circuit 409 .

[0643] The processing circuit 409 is a processing circuit that realizes the receiving unit 410 , the estimating unit 420 , and the output unit 430 .

[0644] Inference device 400 may include a plurality of processing circuits instead of processing circuit 409 .

[0645] In the processing circuit 409 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0646] Thus, the functionality of the inference device 400 can be implemented by hardware, software, firmware, or a combination thereof.

[0647] according to Fig.15 The hardware structure of the certification device 500 is described.

[0648] The certification device 500 has a processing circuit 509 .

[0649] The processing circuit 509 is a processing circuit that realizes the receiving unit 510 , the storage unit 520 , the certification unit 530 , and the output unit 540 .

[0650] The certification device 500 may also include a plurality of processing circuits instead of the processing circuit 509 .

[0651] In the processing circuit 509 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0652] In this way, the functionality of the certification device 500 can be implemented through hardware, software, firmware or a combination thereof.

[0653] according to Fig.16 The hardware structure of the verification device 600 is described.

[0654] The verification device 600 has a processing circuit 609 .

[0655] The processing circuit 609 is a processing circuit that realizes the receiving unit 610 , the storage unit 620 , the verification unit 630 , and the output unit 640 .

[0656] The verification device 600 may include a plurality of processing circuits instead of the processing circuit 609 .

[0657] In the processing circuit 609 , part of the functions may be implemented by dedicated hardware, and the remaining functions may be implemented by software or firmware.

[0658] In this way, the functions of the verification device 600 can be implemented by hardware, software, firmware or a combination thereof.

[0659] Embodiment 1 is an example of a preferred embodiment and is not intended to limit the technical scope of the present disclosure. Embodiment 1 may be implemented partially or in combination with other embodiments. The steps described using flowcharts and the like may also be appropriately changed.

[0660] The word “unit” in each element of the inference verification system 100 may be rewritten as “processing”, “step”, “circuit” or “line”.

[0661] Description of symbols

[0662] 100: inference verification system; 200: parameter generation device; 201: processor; 202: memory; 203: auxiliary storage device; 204: communication device; 205: input and output interface; 209: processing circuit; 210: receiving unit; 220: generation unit; 230: output unit; 290: storage unit; 300: key generation device; 301: processor; 302: memory; 303: auxiliary storage device; 304: communication device 305: input / output interface; 309: processing circuit; 310: receiving unit; 320: generating unit; 330: output unit; 390: storage unit; 400: inference device; 401: processor; 402: memory; 403: auxiliary storage device; 404: communication device; 405: input / output interface; 409: processing circuit; 410: receiving unit; 420: inference unit; 430: output unit; 490: storage unit; 500: certificate 501: processor; 502: memory; 503: auxiliary storage device; 504: communication device; 505: input / output interface; 509: processing circuit; 510: receiving unit; 520: storage unit; 521: key storage unit; 522: inference result storage unit; 530: certification unit; 540: output unit; 590: storage unit; 600: verification device; 601: processor; 602: memory; 603: auxiliary storage device device; 604: communication device; 605: input / output interface; 609: processing circuit; 610: receiving unit; 620: storage unit; 621: key storage unit; 622: proof storage unit; 630: verification unit; 640: output unit; 690: storage unit; c: inference result; D: parameter; M: inference model; P: proof; pk: public key; pp: public parameter; sk: secret key; V: verification result; x: data; λ: parameter. < / y> < / x> < / w> < / z> < / y> < / x> < / xy> < / z> < / z> < / y> < / x> < / x> < / x>

Claims

1. An inference verification system, the inference verification system having: An inference unit that uses an integer value to represent a decimal value that is a data subject of inference processing, processes the integer value as a parameter of a convolutional neural network, and executes an inference model to obtain an inference result; a proof unit that takes the inference result as input and executes a proof generation algorithm to obtain a proof; as well as The verification unit takes the certificate as input, executes a verification algorithm, and obtains a verification result.

2. The inference verification system according to claim 1, wherein: The inference result includes the calculation results of each layer of the convolutional neural network, The proof unit, according to each layer of the convolutional neural network, takes the calculation result of the layer as input and executes the proof generation algorithm of the protocol corresponding to the type of the layer, The proof comprises the results of executing the proof generation algorithm for each layer of the convolutional neural network, The verification unit, according to each layer of the convolutional neural network, takes the execution result of the layer as input and executes the verification algorithm of the protocol corresponding to the type of the layer. The verification result includes the execution result of the verification algorithm for each layer of the convolutional neural network.

3. The inference verification system according to claim 2, wherein: The ReLU Layer protocol is the protocol corresponding to the ReLU activation layer of the convolutional neural network.

4. The inference verification system according to claim 2 or 3, wherein: The Affine Layer protocol is the protocol corresponding to the Affine layer of the convolutional neural network.

5. The inference verification system according to any one of claims 2 to 4, wherein: The Convolution Layer protocol is the protocol corresponding to the convolution layer of the convolutional neural network.

6. The inference verification system according to any one of claims 2 to 5, wherein: The Average PoolingLayer protocol is the protocol corresponding to the Average Pooling layer of the convolutional neural network.

7. The inference verification system according to any one of claims 2 to 6, wherein: The Max Pooling Layer protocol is the protocol corresponding to the MaxPooling layer of the convolutional neural network.

8. The inference verification system according to any one of claims 2 to 7, wherein: The SoftMax Layer protocol is the protocol corresponding to the SoftMax layer of the convolutional neural network.

9. An inference verification method, wherein: A decimal value that is the data to be processed for inference is expressed as an integer value, the integer value is processed as a parameter of a convolutional neural network, and an inference model is executed to obtain an inference result. The inference result is used as input, and a proof generation algorithm is executed to obtain a proof. The proof is used as input, and a verification algorithm is executed to obtain a verification result.

Images