Trusted capability verification method and device of machine learning model

Abstract

One or more embodiments of the invention provide a credibility verification method and device for a machine learning model, and the method is applied to a proving party, and comprises the steps: obtaining a first verification data set; inputting the first verification data set into a machine learning model, and performing reasoning calculation on the first verification data set by the machine learning model to obtain a first calculation result; based on a proof generation algorithm in the zero-knowledge proof scheme, generating first proof data for proving that the first calculation result is a calculation result of the machine learning model for the first verification data set; and sending the first proof data to a verification party, so that the verification party performs zero-knowledge verification on the first proof data based on a proof verification algorithm in the zero-knowledge proof scheme, and when the zero-knowledge verification is passed, determining that the first calculation result is a calculation result of the machine learning model on the first verification data set, and obtaining a data index which is obtained by performing data analysis on the first calculation result and is used for indicating the credibility of the machine learning model.

Description

Technical Field

[0001] One or more embodiments of the present application relate to the field of artificial intelligence technology, and in particular, to a method and device for verifying the trustworthiness of a machine learning model. Background Art

[0002] The trustworthiness of machine learning models usually refers to factors such as the reliability, explainability, fairness, and security of machine learning models. With the widespread application of machine learning in various fields, it is becoming increasingly important to ensure that machine learning models can be trusted. Therefore, it is crucial to verify the trustworthiness of machine learning models. Verifying the trustworthiness of machine learning models can not only improve the quality and user experience of products based on machine learning models, but also help organizations avoid potential legal risks, ethical disputes, and business losses. Summary of the invention

[0003] One or more embodiments of the present application provide the following technical solutions:

[0004] The present application provides a method for verifying the trustworthiness of a machine learning model, which is applied to a proving party, and the method comprises:

[0005] Obtaining a first validation data set for model validation;

[0006] Inputting the first verification data set into a machine learning model to be verified, and having the machine learning model perform inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set;

[0007] Based on a proof generation algorithm in a preset zero-knowledge proof scheme, generate first proof data corresponding to the first calculation result; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set;

[0008] The first proof data is sent to the verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, the first calculation result is determined to be the calculation result obtained by the machine learning model performing inference calculation on the first verification data set, and a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result is obtained.

[0009] The present application also provides a method for verifying the trustworthiness of a machine learning model, which is applied to a verification party, and the method includes:

[0010] Obtaining first proof data; wherein the first proof data is proof data corresponding to the first calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the first calculation result is the calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation on the first verification data set by the machine learning model to be verified; the first proof data is used to prove that the first calculation result is the calculation result obtained by the machine learning model through reasoning calculation on the first verification data set;

[0011] Based on the proof verification algorithm in the zero-knowledge proof scheme, performing zero-knowledge verification on the first proof data;

[0012] When the zero-knowledge verification passes, it is determined that the first calculation result is the calculation result obtained by the machine learning model through inference calculation on the first verification data set, and a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result is obtained.

[0013] The present application also provides a trusted capability verification device for a machine learning model, which is applied to a proving party, and the device includes:

[0014] An acquisition module is used to acquire a first validation data set for model validation;

[0015] A computing module, inputting the first verification data set into a machine learning model to be verified, and having the machine learning model perform inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set;

[0016] A generation module, based on a proof generation algorithm in a preset zero-knowledge proof scheme, generates first proof data corresponding to the first calculation result; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model performing inference calculation on the first verification data set;

[0017] A verification module sends the first proof data to a verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme, and when the zero-knowledge verification passes, determines that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set, and obtains a data indicator for indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0018] The present application also provides a trusted capability verification device for a machine learning model, which is applied to a verification party, and the device includes:

[0019] An acquisition module is configured to acquire first proof data; wherein the first proof data is proof data corresponding to a first calculation result generated by a prover based on a proof generation algorithm in a preset zero-knowledge proof scheme; the first calculation result is a calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation of a first verification data set by a machine learning model to be verified; the first proof data is used to prove that the first calculation result is a calculation result obtained by reasoning calculation of the machine learning model on the first verification data set;

[0020] A verification module, which performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme;

[0021] The determination module determines, when the zero-knowledge verification passes, that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set, and obtains a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0022] The present application also provides an electronic device, including:

[0023] processor;

[0024] a memory for storing processor-executable instructions;

[0025] The processor implements the steps of any of the above methods by running the executable instructions.

[0026] The present application also provides a computer-readable storage medium having computer instructions stored thereon, which implement the steps of any of the above methods when executed by a processor.

[0027] In the above technical scheme, the prover can perform inference calculations on the verification data set used for model verification based on the machine learning model to be verified, obtain the calculation result corresponding to the verification data set, and generate proof data for proving that the calculation result is the calculation result obtained by the machine learning model performing inference calculations on the verification data set based on the proof generation algorithm in the preset zero-knowledge proof scheme. The verifier can perform zero-knowledge verification on the proof data based on the proof verification algorithm in the zero-knowledge proof scheme after obtaining the proof data. If the zero-knowledge verification passes, it can be determined that the calculation result is indeed the calculation result obtained by the machine learning model performing inference calculations on the verification data set, and obtain data indicators indicating the trustworthiness of the machine learning model obtained by data analysis of the calculation result.

[0028] By adopting the above method, since the verification results such as data indicators indicating the trustworthy capabilities of the machine learning model obtained by the verifier are obtained based on the calculation results of the verified machine learning model for the verification data set, the verifier can confirm that the obtained test results are obtained by testing the machine learning model to be verified, and can confirm that these test results are obtained by testing the machine learning model on the actual data set, thereby avoiding the problem that the prover falsifies the calculation results of the machine learning model for the verification data set, making the test results of the machine learning model look more in line with expectations, thereby improving the credibility of the verification of the trustworthy capabilities of the machine learning model. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The following is a description of the accompanying drawings required for describing the exemplary embodiments, wherein:

[0030] Figure 1 It is a flowchart of a method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application;

[0031] Figure 2 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application;

[0032] Figure 3 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application;

[0033] Figure 4 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application;

[0034] Figure 5 is a schematic diagram of a structure of a device shown in an exemplary embodiment of the present application;

[0035] Figure 6 It is a block diagram of a trusted capability verification device for a machine learning model shown in an exemplary embodiment of the present application;

[0036] Figure 7 It is a block diagram of another device for verifying the trustworthiness of a machine learning model as shown in an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0037] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description relates to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of the present application. On the contrary, they are only examples consistent with some aspects of one or more embodiments of the present application.

[0038] It should be noted that in other embodiments, the steps of the corresponding method are not necessarily performed in the order shown and described in this application. In some other embodiments, the steps included in the method may be more or less than those described in this application. In addition, a single step described in this application may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this application may also be combined into a single step for description in other embodiments.

[0039] The trustworthiness of machine learning models can generally include the following aspects: reliability, interpretability, fairness, security, generalization, sustainability, and compliance.

[0040] Reliability can be further divided into stability and robustness. Stability means that the performance of the model on different data sets should be consistent. Robustness means that the model is insensitive to small changes in the input data and can handle noise and outliers. Interpretability means understanding how the model makes decisions, and the model should be as simple as possible, easy to understand and verify. Fairness means that the model should not discriminate against specific groups, and for similar situations, the model should give similar results. Security can further include defense against adversarial attacks and privacy protection. Defense against adversarial attacks means that the model needs to resist inputs that are deliberately designed to mislead it. Privacy protection means protecting user privacy when the model processes data. Generalization ability refers to the overfitting and underfitting of the model, requiring that the model should be neither too complex nor too simple to ensure good performance on new data. Sustainability can further include resource efficiency and maintenance and updating. Resource efficiency means that the computing resources and energy consumed during model training and operation should be as small as possible. Maintenance and updating means that the model needs to be updated regularly to adapt to new data and environmental changes. Compliance means ensuring that the use of the model complies with relevant regulatory requirements and follows ethical standards recognized by the industry and society.

[0041] Building a trustworthy machine learning model usually requires comprehensive consideration of all the above aspects, and continuous iterative optimization in practice. For example, before deploying the machine learning model, conduct exhaustive testing, use technical means such as ensemble learning or rule extraction to improve the interpretability of the model, and adopt methods such as differential privacy to enable the model to achieve privacy protection. For another example, conduct trustworthy capability verification for the deployed machine learning model, especially robustness verification, to prove the reliability of the model.

[0042] In practical applications, the party that performs specific verification tasks on the machine learning model can be called the proving party, and the party that understands the trustworthiness of the machine learning model through the verification results of the machine learning model can be called the verifying party.

[0043] In the related art, a method for verifying the trustworthiness of a machine learning model is that the prover sets a verification data set by itself and verifies the machine learning model to be verified on the verification data set, that is, the machine learning model performs inference calculations on the verification data set to obtain a calculation result corresponding to the verification data set. Subsequently, the prover can issue a model verification report based on the calculation result corresponding to the verification data set, and declare the model effect, stability, and robustness test results of the machine learning model in the model verification report. This allows the verifier to understand the trustworthiness of the machine learning model through the model verification report issued by the prover.

[0044] In practical applications, the test results of machine learning models can be displayed through indicators such as KS (Kolmogorov-Smirnov) or PSI (Population Stability Index). The KS indicator is a statistic used to evaluate the discrimination ability of classification models. It measures the maximum difference in the cumulative distribution function between positive samples and negative samples. The higher the KS statistic, the stronger the model's ability to distinguish between positive and negative samples. The PSI indicator is an indicator used to evaluate the stability of a model. It is used to measure the degree of change of the target group (usually new data or future data) relative to the original group (baseline data) used when the model was built. The closer the PSI value is to 0, the more similar the distribution between the new data and the original data is, and the more stable the model is.

[0045] Another way to verify the trustworthiness of a machine learning model is for the verifier to provide a verification data set to the prover, who then verifies the machine learning model to be verified on the verification data set and returns the calculation results corresponding to the verification data set to the verifier. The verifier then further calculates indicators such as KS or PSI based on the calculation results corresponding to the verification data set to understand the trustworthiness of the machine learning model through these indicators.

[0046] However, in the first method mentioned above, the verifier can only see the model verification report issued by the certifier, which makes it impossible for the verifier to confirm whether the test results such as the model effect, stability and robustness of the machine learning model declared in the model verification report are obtained by testing the machine learning model to be verified on the actual data set.

[0047] In the second method mentioned above, although the verifier can confirm that the test results such as the model effect, stability and robustness of the machine learning model are obtained by testing on the actual data set, it still cannot confirm that these test results are obtained by testing the machine learning model that needs to be verified.

[0048] Therefore, in both of the above methods, there is a problem that the prover may forge the calculation results calculated by the machine learning model corresponding to the verification data set, so that the verification results of the machine learning model appear to be more in line with expectations, resulting in a lower credibility of the trusted capability verification of the machine learning model.

[0049] One or more embodiments of the present application provide a technical solution for verifying the trusted capability of a machine learning model. In this technical solution, a prover can perform inference calculations on a verification data set used for model verification based on the machine learning model to be verified, obtain a calculation result corresponding to the verification data set, and generate proof data for proving that the calculation result is a calculation result obtained by the machine learning model performing inference calculations on the verification data set based on a proof generation algorithm in a preset zero-knowledge proof scheme. The verifier can, upon obtaining the proof data, perform zero-knowledge verification on the proof data based on the proof verification algorithm in the zero-knowledge proof scheme. If the zero-knowledge verification passes, it can be determined that the calculation result is indeed a calculation result obtained by the machine learning model performing inference calculations on the verification data set, and obtain data indicators indicating the trusted capability of the machine learning model obtained by performing data analysis on the calculation result.

[0050] By adopting the above method, since the verification results such as data indicators indicating the trustworthy capabilities of the machine learning model obtained by the verifier are obtained based on the calculation results of the verified machine learning model for the verification data set, the verifier can confirm that the obtained test results are obtained by testing the machine learning model to be verified, and can confirm that these test results are obtained by testing the machine learning model on the actual data set, thereby avoiding the problem that the prover falsifies the calculation results of the machine learning model for the verification data set, making the test results of the machine learning model look more in line with expectations, thereby improving the credibility of the verification of the trustworthy capabilities of the machine learning model.

[0051] For ease of understanding, the following is a brief description of the zero-knowledge proof scheme and blockchain technology involved in the technical solution provided by this application.

[0052] (1) Zero-knowledge proof scheme

[0053] Zero-Knowledge Proof (ZKP) is a cryptographic technique that allows one party (called a “prover” or “Prover”) to prove to another party (called a “verifier” or “Verifier”) that a statement is true without revealing any information about the statement except the truth of the statement itself.

[0054] Zero-knowledge proof schemes are usually divided into a proof generation algorithm (Proving Algorithm) and a proof verification algorithm (Verification Algorithm). These two algorithms together constitute the core part of the zero-knowledge proof system. Among them, the proof generation algorithm is executed by the prover to generate a proof to prove the authenticity of a statement. The proof generation algorithm can usually include the following steps: convert the statement to be proved into a mathematical form suitable for the zero-knowledge proof protocol, such as Boolean circuits or arithmetic circuits; perform calculations based on the statement and evidence to generate a proof, which may involve polynomial calculations, elliptic curve operations, etc.; finally generate a proof that contains enough information for the verifier to believe the authenticity of the statement, but does not disclose any additional information. The proof verification algorithm is executed by the verifier to verify the validity of the proof to ensure the authenticity of the statement. The proof verification algorithm can usually include the following steps: perform a series of mathematical operations to verify the validity of the proof; if the verification is successful, the verifier accepts the proof; otherwise, the verifier rejects the proof.

[0055] (2) Blockchain technology

[0056] Blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus protocols, and encryption algorithms. In the blockchain system, data blocks are combined into a chain data structure in a sequential manner according to time order, and a distributed ledger that cannot be tampered with or forged is guaranteed by cryptography. Due to the characteristics of decentralization, information cannot be tampered with, and autonomy, the application of blockchain is becoming more and more extensive.

[0057] Blockchain is generally divided into three types: public blockchain, private blockchain and consortium blockchain. In addition, there can be a combination of the above types, such as the combination of private blockchain and consortium blockchain, the combination of consortium blockchain and public blockchain, etc.

[0058] Among the three types of blockchains mentioned above, the public chain is the most decentralized. Participants who join the public chain (also called nodes in the blockchain) can read data records on the chain, participate in transactions, compete for the right to record new blocks, etc. Moreover, each node can freely join or exit the network and perform related operations.

[0059] On the contrary, the private chain has a network write permission controlled by a certain organization or institution, and the data read permission is regulated by the organization. In other words, the private chain can be regarded as a weakly centralized system with strict restrictions on nodes and a small number of nodes. This type of blockchain is more suitable for internal use within a specific institution.

[0060] The alliance chain is between the public chain and the private chain, and can achieve "partial decentralization". Each node in the alliance chain usually has a corresponding entity or organization; the nodes join the network through authorization and form a stakeholder alliance to jointly maintain the operation of the blockchain.

[0061] Based on the basic characteristics of blockchain, blockchain is usually composed of several blocks. In each of these blocks, a timestamp corresponding to the creation time of the block is recorded. All blocks strictly follow the timestamp recorded in the block to form a data chain that is ordered in time.

[0062] For data generated outside the blockchain, these data can be constructed into a standard transaction format supported by the blockchain, and then published to the blockchain. The nodes participating in the consensus in the blockchain system will reach a consensus on the transaction and execute the transaction after the consensus is reached, so that the transaction and the execution results can be persistently stored in the blockchain.

[0063] In a blockchain system, different participants can establish a distributed blockchain network through deployed nodes. Among them, the decentralized (or multi-centralized) distributed ledger constructed by the chain block structure is stored on each node (or most nodes, such as consensus nodes) in the distributed blockchain network. This type of blockchain system needs to solve the problem of consistency and correctness of the ledger data on multiple decentralized (or multi-centralized) nodes. Blockchain programs are running on each node in the blockchain system. Under certain fault tolerance requirements, the consensus protocol is used to ensure that all loyal nodes have the same transactions, thereby ensuring that all loyal nodes have consistent execution results for the same transactions, and the transactions and execution results are packaged to generate blocks.

[0064] Specifically, all consensus nodes in the blockchain system can reach consensus on the transactions contained in the new block to be connected to the chain block structure based on the consensus protocol to ensure that each consensus node agrees on the content and order of the transactions contained in the block. After the consensus is completed, each consensus node can execute the transactions contained in the block in order, and complete the finalization of the block after confirming that the transaction execution results of each consensus node are consistent. Among them, finalization means that the execution of the transactions contained in the block is completed and the transaction execution results are recognized by all consensus nodes (or a certain number of consensus nodes, such as two-thirds of the consensus nodes).

[0065] Please refer to Figure 1 , Figure 1 It is a flowchart of a method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application.

[0066] As mentioned above, in the process of verifying the trustworthiness of a machine learning model, the party that performs specific verification tasks on the machine learning model can be called the proving party, and the party that understands the trustworthiness of the machine learning model through the verification results of the machine learning model can be called the verifying party.

[0067] The trustworthiness verification method of the above-mentioned machine learning model can be applied to the above-mentioned proving party; Figure 1 As shown, the method may include the following steps:

[0068] Step 102: Obtain a first validation data set for model validation.

[0069] In this embodiment, the above-mentioned prover can first obtain a verification data set for model verification (which may be referred to as a first verification data set), and then use the first verification data set to verify the trustworthiness of the machine learning model to be verified.

[0070] It should be noted that the above-mentioned first verification data set can be a verification data set set by the certifying party itself, or a verification data set provided by the verifying party to the certifying party, and this application does not impose any special restrictions on this.

[0071] In some embodiments, in order to ensure the data security and reliability of the first verification data set, the certifier can publish the first verification data set to a pre-established blockchain for storage by utilizing the characteristics of blockchain such as immutability, transparency, and security. In this case, when the certifier needs to use the first verification data set to verify the trustworthiness of the machine learning model to be verified, the first verification data set can be obtained from the blockchain.

[0072] Step 104: Input the first verification data set into the machine learning model to be verified, and the machine learning model performs inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set.

[0073] In this embodiment, the prover may perform inference calculation on the first verification data set based on the machine learning model to be verified. That is, the first verification data set may be input into the machine learning model to be verified, and the machine learning model may perform inference calculation on the first verification data set. In this case, the inference calculation result of the machine learning model on the first verification data set may be used as the calculation result corresponding to the first verification data set (which may be referred to as the first calculation result).

[0074] For example, assuming that the machine learning model to be verified is a classification model, the machine learning model performs inference calculations on the above-mentioned first verification data set, that is, the machine learning model predicts the category to which each verification data in the first verification data set belongs. At this time, the category to which each verification data in the first verification data set predicted by the machine learning model belongs is the first calculation result corresponding to each verification data in the first verification data set.

[0075] In some embodiments, in order to ensure the data security and reliability of the first calculation result, the tamper-proof, transparency and security characteristics of the blockchain can be utilized, and the first calculation result can be published by the proving party on a pre-established blockchain for storage. In this case, when the verifying party needs to use the first calculation result to verify the trustworthiness of the machine learning model to be verified, the first calculation result can be obtained from the blockchain.

[0076] Step 106: Based on the proof generation algorithm in the preset zero-knowledge proof scheme, generate first proof data corresponding to the first calculation result; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model performing inference calculation on the first verification data set.

[0077] In this embodiment, zero-knowledge proof technology can be used to verify the trustworthiness of the above-mentioned machine learning model.

[0078] It should be noted that in zero-knowledge proof technology, the statement to be proved refers to a claim or statement that needs to be verified by zero-knowledge proof technology. When using zero-knowledge proof technology to verify machine learning models, the statement to be proved can be a description of a certain property or behavior of the machine learning model; for example, the statement can be used to prove: the accuracy of the model on a given data set reaches a certain threshold; the model's prediction results for specific inputs; the model is trained on a given data set and follows a certain training process; the model's decision-making process is fair and does not produce bias against a specific group; the model's training process and prediction process do not leak the data involved in the training; certain parameters of the model are within a certain range; the complexity of the model (such as the number of layers, the number of neurons) does not exceed a certain upper limit; multiple models give consistent outputs under the same input; and so on.

[0079] For the above-mentioned machine learning model, a true statement that needs to be proved (which may be called the first statement) may be prepared for the machine learning model. At this time, the content of the first statement may specifically be the above-mentioned first calculation result, which is the calculation result obtained by the above-mentioned machine learning model through inference calculation on the above-mentioned first verification data set.

[0080] In this case, the above-mentioned prover can generate proof data (i.e., Proof, which can be called first proof data) corresponding to the above-mentioned first calculation result based on the proof generation algorithm in the pre-set zero-knowledge proof scheme; for example, the first proof data can be generated based on the above-mentioned first verification data set, the above-mentioned first calculation result, and the intermediate data generated in the reasoning calculation process.

[0081] In practical applications, in order to enhance the correlation between the first proof data and the machine learning model, the first proof data may be generated based on the first verification data set, the first calculation result and the model data of the machine learning model. The model data of the machine learning model may be the code data of the machine learning model itself, or data representing the calculation logic and calculation parameters of the machine learning model.

[0082] Furthermore, in order to ensure the data security, integrity and non-repudiation of the model data of the machine learning model when generating the first proof data, commitment data corresponding to the model data of the machine learning model can be generated based on a preset commitment scheme, and the first proof data can be generated based on the first verification data set, the first calculation result and the commitment data. Specifically, the commitment data corresponding to the model data of the machine learning model can be generated by calculating the hash value of the machine learning model, for example: directly using the hash value of the machine learning model as the commitment data corresponding to the model data of the machine learning model.

[0083] A commitment scheme is a technology that allows one party (the committer) to lock a value and reveal it at some point in the future without being tampered with. This process ensures that a third party cannot change the value even before it is revealed, thereby ensuring the integrity and non-repudiation of the data. In addition, the verifier cannot infer the original data from the committed data, thus ensuring the security of the data.

[0084] For example, let A represent the first verification data set, R represent the first calculation result, model represent the commitment data corresponding to the model data of the machine learning model, and function P(x) represent the proof generation algorithm in the zero-knowledge proof scheme, then the first proof data can be expressed as P=P(A, R, model).

[0085] In some embodiments, in order to ensure the data security and reliability of the first proof data, the tamper-proof, transparency and security characteristics of the blockchain can be utilized, and the first proof data can be published by the proving party on a pre-established blockchain for storage. In this case, when the verifying party needs to use the first proof data to verify the trustworthiness of the machine learning model to be verified, the first proof data can be obtained from the blockchain.

[0086] Similarly, the certifier may publish the commitment data corresponding to the model data of the machine learning model to the blockchain for storage. In this case, when the verifier needs to use the commitment data to verify the trustworthiness of the machine learning model, the commitment data can be obtained from the blockchain.

[0087] Step 108: Send the first proof data to the verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, determine that the first calculation result is the calculation result obtained by the machine learning model performing inference calculation on the first verification data set, and obtain data indicators for indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0088] In this embodiment, in order to enable the above-mentioned verification party to perform trustworthy capability verification on the above-mentioned machine learning model, the above-mentioned proof party may send the above-mentioned first proof data to the verification party.

[0089] When the above-mentioned verification party obtains the above-mentioned first proof data, it can perform zero-knowledge verification on the first proof data based on the proof verification algorithm in the above-mentioned zero-knowledge proof scheme, that is, verify whether the first proof data is valid in a zero-knowledge manner; for example, it can perform zero-knowledge verification on the first proof data based on the above-mentioned first verification data set, the above-mentioned first calculation result, and the first proof data itself. If the zero-knowledge verification passes, it means that the first proof data is valid, so that the verification party can determine that the above-mentioned first calculation result is indeed the calculation result obtained by the above-mentioned machine learning model to perform inference calculation on the above-mentioned first verification data set. Further, the verification party can obtain data indicators for indicating the trustworthy ability of the machine learning model (for example: model effect) obtained by performing data analysis on the first calculation result, and can confirm that these data indicators are obtained by testing the machine learning model on the actual data set at this time, so the trustworthy ability of the machine learning model indicated by these data indicators is also true.

[0090] For example, if the proof verification algorithm in the above zero-knowledge proof scheme is represented by function V(x), it is necessary to verify that V(A, R, P)? = True, that is, to verify whether the above first verification data set, the above first calculation result and the above first proof data satisfy the mathematical relationship described by function V(x).

[0091] It should be noted that in zero-knowledge proof technology, a circuit can be used to describe the computational process to be proved (in this application, the computational process is the reasoning computational process of the machine learning model to be verified), and then the circuit is converted into a constraint system (CS) to generate a proof. Specifically, the computational logic to be proved can first be represented as a circuit; a circuit is a network composed of logic gates (such as AND, OR, etc.), that is, a logic gate circuit, which can represent any complex computational process. Then, this circuit will be converted into a constraint system; the constraint system is usually a set of mathematical equations, which describe the relationship between the nodes in the circuit and ensure the correct execution of the circuit; the constraint system can be a Boolean constraint system or an arithmetic constraint system. Finally, the constraint system can be further converted into polynomials, and a concise proof can be generated by committing to these polynomials; in implementation, the prover can use these polynomial commitments to construct a proof, which contains information that the prover knows how to correctly execute the circuit, but does not disclose the actual input or other sensitive information. Correspondingly, the verifier can verify the validity of the proof; the verifier does not need to know the prover's input or intermediate calculation steps, but only needs to verify whether the proof is valid.

[0092] In some embodiments, when generating the above-mentioned first proof data based on the proof generation algorithm in the above-mentioned zero-knowledge proof scheme, the size of the logic gate circuit can be specifically pre-set, and then based on the circuit generation algorithm in the zero-knowledge proof scheme, the reasoning logic of the above-mentioned machine learning model can be represented as a logic gate circuit, and the size of the logic gate circuit is the size of the pre-set logic gate circuit, and based on the proof generation algorithm in the zero-knowledge proof scheme, the logic gate circuit is converted into a constraint system. At this time, the mathematical equation contained in the constraint system can be used as a proof function, so that the above-mentioned first verification data set and the above-mentioned first calculation result can be used as input parameters of the proof function and substituted into the proof function for calculation to generate the first proof data.

[0093] When performing zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme, the first verification data set and the first calculation result can be used as input parameters of the verification function included in the proof verification algorithm, and substituted into the verification function for calculation to perform zero-knowledge verification on the first proof data. In this case, it can be determined whether the zero-knowledge verification on the first proof data is passed based on the calculation result of the verification function.

[0094] In practical applications, the above constraint system may adopt R1CS (Rank-1 Constraint System).

[0095] The size of a logic gate circuit refers to the scale of the logic gate circuit, which can include the following aspects: the number of gates, the number of signal lines, the depth and width. Among them, the number of gates refers to the number of basic logic units that make up the circuit; each gate usually represents an arithmetic operation, such as addition or multiplication; the more gates in a circuit, the larger the circuit. Signal lines connect the gates in the circuit, and the number of signal lines can also be used as an indicator to measure the size of the circuit. Depth refers to the number of gates passed on the longest path from input to output; depth reflects the complexity of the calculation. Width refers to the maximum fan-out in the circuit (that is, the maximum number of signal lines participating in the operation at the same time), or the number of gates in the largest layer.

[0096] In some embodiments, the machine learning model may be a tree model. In this case, the size of the logic gate circuit (in this application, the size of the logic gate circuit may be the number of gates in the logic gate circuit) is related to the model scale of the tree model; for example, how many trees there are, how many samples there are, the number of attributes of the samples, the depth of the tree, the maximum number of nodes in the tree, etc.

[0097] Order 2 k (k is a natural number) represents the size of the logic gate circuit, num treeIndicates the number of trees in the machine learning model, num depth represents the depth of the tree in the machine learning model, max node Indicates the maximum number of nodes in the tree of the machine learning model, num sample Indicates the number of samples required for the machine learning model to perform inference calculations; num attr represents the number of attributes of the sample used when the machine learning model performs inference calculations, then the size of the above logic gate circuit should generally meet the following three conditions:

[0098] num tree *num sample *num dept h≤2 k -10

[0099] num sample *num attr ≤2 k -10

[0100] max node ≤(2 k -10) / 130

[0101] In some embodiments, the value of k can be the minimum value that satisfies the above three conditions. Making the value of k as small as possible while satisfying the three inequalities can improve the computational efficiency when generating proofs and reduce the data size of the generated proofs.

[0102] and Figure 1 Accordingly, please refer to Figure 2 , Figure 2 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application.

[0103] The above-mentioned machine learning model's trustworthiness verification method can be applied to the above-mentioned verification parties; Figure 2 As shown, the method may include the following steps:

[0104] Step 202: Obtain first proof data; wherein, the first proof data is proof data corresponding to the first calculation result, generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the first calculation result is the calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation of the first verification data set by the machine learning model to be verified; the first proof data is used to prove that the first calculation result is the calculation result obtained by reasoning calculation of the machine learning model on the first verification data set.

[0105] Step 204: Based on the proof verification algorithm in the zero-knowledge proof scheme, perform zero-knowledge verification on the first proof data.

[0106] Step 206: When the zero-knowledge verification passes, determine that the first calculation result is the calculation result obtained by the machine learning model performing inference calculations on the first verification data set, and obtain a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0107] The specific implementation of the above steps 202 to 206 can refer to Figure 1 The embodiments shown in this application will not be described in detail here.

[0108] In the above technical scheme, the prover can perform inference calculations on the verification data set used for model verification based on the machine learning model to be verified, obtain the calculation result corresponding to the verification data set, and generate proof data for proving that the calculation result is the calculation result obtained by the machine learning model performing inference calculations on the verification data set based on the proof generation algorithm in the preset zero-knowledge proof scheme. The verifier can perform zero-knowledge verification on the proof data based on the proof verification algorithm in the zero-knowledge proof scheme after obtaining the proof data. If the zero-knowledge verification passes, it can be determined that the calculation result is indeed the calculation result obtained by the machine learning model performing inference calculations on the verification data set, and obtain data indicators indicating the trustworthiness of the machine learning model obtained by data analysis of the calculation result.

[0109] By adopting the above method, since the verification results such as data indicators indicating the trustworthy capabilities of the machine learning model obtained by the verifier are obtained based on the calculation results of the verified machine learning model for the verification data set, the verifier can confirm that the obtained test results are obtained by testing the machine learning model to be verified, and can confirm that these test results are obtained by testing the machine learning model on the actual data set, thereby avoiding the problem that the prover falsifies the calculation results of the machine learning model for the verification data set, making the test results of the machine learning model look more in line with expectations, thereby improving the credibility of the verification of the trustworthy capabilities of the machine learning model.

[0110] In order to enable the above-mentioned verifier to further understand the trusted capabilities of the above-mentioned machine learning model, such as stability and robustness, specific data processing may be performed on the above-mentioned first verification data set, and based on the machine learning model, inference calculation may be performed on the processed verification data set to obtain a calculation result corresponding to the processed verification data set, so as to determine the trusted capabilities of the machine learning model, such as stability and robustness, by comparing and analyzing the changes between the above-mentioned first calculation result and the calculation result corresponding to the processed verification data set.

[0111] exist Figure 1 Based on Figure 3 , Figure 3 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application.

[0112] and Figure 1 Similarly, the trustworthiness verification method of the above machine learning model can be applied to the above prover; Figure 3 As shown, the method may include the following steps:

[0113] Step 302: Obtain a first validation data set for model validation.

[0114] The specific implementation of the above step 302 can refer to Figure 1 The embodiments shown in this application will not be described in detail here.

[0115] Step 304: Perform sample perturbation processing on the first verification data set to obtain a second verification data set.

[0116] In this embodiment, sample perturbation processing may be performed on the first validation data set, and the obtained processed validation data set may be referred to as a second validation data set.

[0117] Sample perturbation refers to a technique in machine learning and data analysis that studies the stability and robustness of a model by making slight changes or adding noise to the original data samples. In practical applications, sample perturbation methods and their application scenarios may include: adding noise, that is, adding random noise to the feature values ​​in the sample, such as Gaussian noise, uniform noise, etc. This method is often used for data enhancement, feature importance evaluation, and the generation of adversarial attacks; feature scaling, that is, changing the scale of a feature, such as multiplying a feature by a coefficient less than 1, or adding a decimal. This method can be used to evaluate the sensitivity of the model to data of different scales; feature occlusion, that is, temporarily replacing or masking certain feature values ​​and observing the changes in the model prediction results, which can be used to determine which features are most important for the model's decision; feature perturbation, that is, randomly shuffling the feature values ​​in the sample to evaluate whether the model is overfitting a specific data arrangement; data interpolation, that is, generating new samples by interpolating between two or more samples. This method can be used to create more diverse and realistic training data; geometric transformation Transformations, specifically in image processing, new samples can be generated through geometric transformations such as rotation, scaling, and translation. This method is particularly suitable for tasks that require enhanced image data sets; Time Series Perturbation, for time series data, new samples can be created by sliding windows, filling missing values, time offsets, etc.; Text Perturbation, specifically in natural language processing, new text samples can be generated through synonym replacement, sentence insertion or deletion, etc.; Adversarial Perturbation, that is, by adding small perturbations to mislead the model and make the model make wrong predictions. This method is often used to test the robustness of the model; and so on.

[0118] In some embodiments, in order to ensure the data security and reliability of the second verification data set, the certifier can publish the second verification data set to a pre-established blockchain for storage by utilizing the characteristics of blockchain such as immutability, transparency, and security. In this case, when the certifier needs to use the second verification data set to verify the trustworthiness of the machine learning model to be verified, the second verification data set can be obtained from the blockchain.

[0119] Step 306: Input the first verification data set and the second verification data set into the machine learning model, and the machine learning model performs inference calculations on the first verification data set and the second verification data set respectively to obtain a first calculation result corresponding to the first verification data set and a second calculation result corresponding to the second verification data set.

[0120] In this embodiment, on the one hand, the above-mentioned prover can input the above-mentioned first verification data set into the machine learning model to be verified, and the machine learning model performs inference calculation on the first verification data set to obtain the above-mentioned first calculation result corresponding to the first verification data set.

[0121] On the other hand, the prover may perform inference calculations on the second verification data set based on the machine learning model to be verified. That is, the second verification data set may be input into the machine learning model to be verified, and the machine learning model may perform inference calculations on the second verification data set. In this case, the inference calculation result of the machine learning model on the second verification data set may be used as the calculation result corresponding to the second verification data set (which may be referred to as the second calculation result).

[0122] In some embodiments, in order to ensure the data security and reliability of the first calculation result and the second calculation result, the tamper-proof, transparency and security characteristics of the blockchain can be utilized, and the first calculation result and the second calculation result can be published by the proving party on a pre-established blockchain for storage. In this case, when the later verification party needs to use the first calculation result and the second calculation result to verify the trustworthiness of the machine learning model to be verified, the first calculation result and the second calculation result can be obtained from the blockchain.

[0123] Step 308: Based on the proof generation algorithm in the preset zero-knowledge proof scheme, generate first proof data corresponding to the first calculation result and second proof data corresponding to the second calculation result respectively; wherein the first proof data is used to prove that the first calculation result is the calculation result obtained by the machine learning model through inference calculation on the first verification data set; and the second proof data is used to prove that the second calculation result is the calculation result obtained by the machine learning model through inference calculation on the second verification data set.

[0124] In this embodiment, zero-knowledge proof technology can be used to verify the trustworthiness of the above-mentioned machine learning model. For the above-mentioned machine learning model, the above-mentioned first statement can be prepared for the machine learning model, and another true statement (which can be called the second statement) that needs to be proved can be prepared. At this time, the content of the second statement can specifically be the above-mentioned second calculation result, which is the calculation result obtained by the above-mentioned machine learning model through reasoning calculation on the above-mentioned second verification data set.

[0125] In this case, the proving party may generate first proof data corresponding to the first calculation result based on a proof generation algorithm in a pre-set zero-knowledge proof scheme, and generate proof data corresponding to the second calculation result (i.e., Proof, which may be referred to as second proof data); for example, the second proof data may be generated based on the second verification data set, the second calculation result, and the intermediate data generated during the reasoning calculation process.

[0126] Similar to the aforementioned step 106, in order to enhance the correlation between the second proof data and the machine learning model, the second proof data can be generated based on the second verification data set, the second calculation result and the model data of the machine learning model.

[0127] Furthermore, in order to ensure the data security, integrity and non-repudiation of the machine learning model when generating the second proof data, commitment data corresponding to the model data of the machine learning model can be generated based on a preset commitment scheme, and the second proof data can be generated based on the second verification data set, the second calculation result and the commitment data. Specifically, the commitment data corresponding to the model data of the machine learning model can be generated by calculating the hash value of the machine learning model, for example: the hash value of the machine learning model is directly used as the commitment data corresponding to the model data of the machine learning model.

[0128] For example, let A represent the first verification data set, R represent the first calculation result, A' represent the second verification set, R' represent the second calculation result, model represent the commitment data corresponding to the model data of the machine learning model, and function P(x) represent the proof generation algorithm in the zero-knowledge proof scheme, then the first proof data can be represented as P(A, R, model), and the second proof data can be represented as P'(A', R', model).

[0129] In some embodiments, in order to ensure the data security and reliability of the first proof data and the second proof data, the tamper-proof, transparency and security characteristics of the blockchain can be utilized, and the first proof data and the second proof data can be published by the certifier on a pre-established blockchain for storage. In this case, when the verifier needs to use the first proof data and the second proof data to verify the trustworthiness of the machine learning model to be verified, the first proof data and the second proof data can be obtained from the blockchain.

[0130] Step 310: Send the first proof data and the second proof data to the verifier respectively, so that the verifier performs zero-knowledge verification on the first proof data and the second proof data respectively based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, determine that the first calculation result is the calculation result obtained by the machine learning model performing inference calculation on the first verification data set, and the second calculation result is the calculation result obtained by the machine learning model performing inference calculation on the second verification data set, and obtain data indicators for indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result and the second calculation result.

[0131] In this embodiment, in order to enable the above-mentioned verification party to perform trustworthy capability verification on the above-mentioned machine learning model, the above-mentioned proof party may send the above-mentioned first proof data and the above-mentioned second proof data to the verification party.

[0132] When the above-mentioned verification party obtains the above-mentioned first proof data and the above-mentioned second proof data, on the one hand, it can perform zero-knowledge verification on the first proof data based on the proof verification algorithm in the above-mentioned zero-knowledge proof scheme, that is, verify whether the first proof data is valid in a zero-knowledge manner; for example, the validity of the first proof data can be verified based on the above-mentioned first verification data set, the above-mentioned first calculation result, and the first proof data itself. If the zero-knowledge verification passes, it means that the first proof data is valid, so that the verification party can determine that the above-mentioned first calculation result is indeed the calculation result obtained by the above-mentioned machine learning model through inference calculation on the above-mentioned first verification data set.

[0133] On the other hand, based on the proof verification algorithm in the zero-knowledge proof scheme, zero-knowledge verification can be performed on the second proof data, that is, whether the second proof data is valid can be verified in a zero-knowledge manner; for example, the validity of the second proof data can be verified based on the second verification data set, the second calculation result, and the second proof data itself. If the zero-knowledge verification passes, it means that the second proof data is valid, so that the verifier can determine that the second calculation result is indeed the calculation result obtained by the machine learning model to perform inference calculation on the second verification data set.

[0134] If the verification party determines that the first calculation result is indeed the calculation result obtained by the machine learning model for the first verification data set, and the second calculation result is indeed the calculation result obtained by the machine learning model for the second verification data set, then the data indicators for indicating the trustworthiness of the machine learning model obtained by data analysis of the first calculation result and the second calculation result can be obtained. At this time, not only can the data indicators for indicating the model effect of the machine learning model obtained by data analysis of the first calculation result be obtained, but also the data indicators for indicating the model effect of the machine learning model obtained by data analysis of the second calculation result can be obtained, and the data indicators for indicating the robustness and stability of the machine learning model obtained by data analysis of the first calculation result and the second calculation result can be obtained. In addition, it can be confirmed that these data indicators are obtained by testing the machine learning model on the actual data set, so the trustworthiness of the machine learning model indicated by these data indicators is also true.

[0135] For example, if the proof verification algorithm in the above zero-knowledge proof scheme is represented by function V(x), then on the one hand, it can be verified that V(A, R, P)? = True, that is, it can be verified whether the above first verification data set, the above first calculation result and the above first proof data satisfy the mathematical relationship described by function V(x); on the other hand, it can be verified that V(A', ​​R', P')? = True, that is, it can be verified whether the above second verification data set, the above second calculation result and the above second proof data satisfy the mathematical relationship described by function V(x).

[0136] and Figure 3 Accordingly, please refer to Figure 4 , Figure 4 It is a flowchart of another method for verifying the trustworthiness of a machine learning model shown in an exemplary embodiment of the present application.

[0137] The above-mentioned machine learning model's trustworthiness verification method can be applied to the above-mentioned verification parties; Figure 4 As shown, the method may include the following steps:

[0138] Step 402: Obtain first proof data and second proof data; wherein, the first proof data is proof data corresponding to the first calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the first calculation result is the calculation result corresponding to the first verification data set obtained by the prover through inference calculation on the first verification data set by the machine learning model to be verified; the first proof data is used to prove that the first calculation result is the calculation result obtained by inference calculation of the machine learning model on the first verification data set; the second proof data is proof data corresponding to the second calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the second calculation result is the calculation result corresponding to the second verification data set obtained by the prover through inference calculation on the second verification data set by the machine learning model to be verified; the second proof data is used to prove that the second calculation result is the calculation result obtained by inference calculation of the machine learning model on the second verification data set; the second verification data set is a verification data set obtained by sample perturbation processing on the first verification data set.

[0139] Step 404: Based on the proof verification algorithm in the zero-knowledge proof scheme, perform zero-knowledge verification on the first proof data and the second proof data respectively.

[0140] Step 406: When the zero-knowledge verification passes, determine that the first calculation result is the calculation result obtained by the machine learning model through inference calculation on the first verification data set, and the second calculation result is the calculation result obtained by the machine learning model through inference calculation on the second verification data set, and obtain data indicators indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result and the second calculation result.

[0141] The specific implementation of the above steps 402 to 406 can refer to Figure 3 The embodiments shown in this application will not be described in detail here.

[0142] It should be noted that in zero-knowledge proof technology, a proof key can also be used to generate a proof, and a verification key can be used to verify the validity of the proof. The existence of these two sets of keys can ensure that only people who know specific knowledge can generate a valid proof, while ensuring that others cannot forge the proof. At the same time, the design of the proof key and the verification key makes the proof very compact and the verification process very efficient. With these two sets of keys, there is no need for further interaction between the prover and the verifier, and the proof can be generated separately and submitted to the verifier.

[0143] Among them, the proof key is a set of parameters used to help the prover construct a zero-knowledge proof. The proof key is usually generated by a trusted setup process, which involves some random numbers and other secret values, which are destroyed after the proof key is generated. The proof key itself does not contain any secret information, but it contains enough information for the prover to create a valid proof.

[0144] The verification key is another set of parameters generated by the trusted setup process, which is used by the verifier to check the validity of the proof. The verification key also does not contain any secret information, but it contains all the information the verifier needs to determine whether a proof is a valid proof for a given statement.

[0145] Trusted setup refers to an initialization phase in which the circuit or the constraint system defined by the circuit is used to generate the proof and verification keys. In this phase, the secret values ​​required to generate the proof and verification keys are generated by multiple parties or in a unilateral process, and then these secret values ​​must be securely destroyed. This is to prevent someone from abusing these secret values ​​to forge proofs. If the secret values ​​are not destroyed, or the trusted setup is compromised, the security of the system may be compromised.

[0146] Based on this, in some embodiments, the above-mentioned verifier can represent the reasoning logic of the above-mentioned machine learning model as a logic gate circuit based on the circuit representation algorithm in the above-mentioned zero-knowledge proof scheme, and based on the logic gate circuit, generate a proof key corresponding to the proof generation algorithm and a verification key corresponding to the proof verification algorithm in the zero-knowledge proof scheme.

[0147] In order for the certifying party to obtain the certification key and use the certification key to generate certification data, the verifying party may send the certification key to the certifying party.

[0148] When the above-mentioned prover obtains the above-mentioned proof key, on the one hand, the proof key, the above-mentioned first verification data set, the above-mentioned first calculation result and the model data of the above-mentioned machine learning model can be input into the proof function converted by the above-mentioned logic gate circuit for calculation to generate the above-mentioned first proof data corresponding to the first calculation result. In practical applications, the prover can obtain the logic gate circuit from the above-mentioned verifier and convert the logic gate circuit into the proof function based on the proof generation algorithm in the above-mentioned zero-knowledge proof scheme; or, the prover can obtain the proof function converted by the verifier based on the proof generation algorithm in the above-mentioned zero-knowledge proof scheme from the above-mentioned verifier; this application does not impose any special restrictions on this.

[0149] On the other hand, the above-mentioned proof key, the above-mentioned second verification data set, the above-mentioned second calculation result and the model data of the above-mentioned machine learning model can be input into the above-mentioned proof function for calculation to generate the above-mentioned second proof data corresponding to the second calculation result.

[0150] For example, let A represent the first verification data set, R represent the first calculation result, A' represent the second verification set, R' represent the second calculation result, model represent the commitment data corresponding to the model data of the machine learning model, pk represent the proof key, and function P(x) represent the proof generation algorithm in the zero-knowledge proof scheme, then the first proof data can be represented as P(pk,A,R,model), and the second proof data can be represented as P'(pk,A',R',model).

[0151] In order to enable the above-mentioned verifier to perform trusted capability verification on the above-mentioned machine learning model, on the one hand, the above-mentioned prover can send the above-mentioned first verification data set, the above-mentioned first calculation result and the above-mentioned first proof data to the above-mentioned verifier. When the verifier obtains the first verification data, the first calculation result and the first proof data, it can perform zero-knowledge verification on the first proof data based on the proof verification algorithm in the above-mentioned zero-knowledge proof scheme. Specifically, the verifier can input the above-mentioned verification key, the first verification data set, the first calculation result and the first proof data into the verification function contained in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the first proof data. In this case, it can be judged whether the zero-knowledge verification of the first proof data is passed based on the calculation result of the verification function.

[0152] On the other hand, the certificate may send the second verification data set, the second calculation result and the second proof data to the verifier. When the verifier obtains the second verification data, the second calculation result and the second proof data, it may perform zero-knowledge verification on the second proof data based on the proof verification algorithm in the zero-knowledge proof scheme. Specifically, the verifier may input the verification key, the second verification data set, the second calculation result and the second proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the second proof data. In this case, it may be determined whether the zero-knowledge verification on the second proof data is passed based on the calculation result of the verification function.

[0153] For example, if vk represents the verification key and function V(x) represents the proof verification algorithm in the zero-knowledge proof scheme, then on the one hand, it can be verified that V(vk,A,R,P)?=Ture, that is, it can be verified whether the first verification data set, the first calculation result and the first proof data satisfy the mathematical relationship described by function V(x); on the other hand, it can be verified that V(vk,A',R',P')?=Ture, that is, it can be verified whether the second verification data set, the second calculation result and the second proof data satisfy the mathematical relationship described by function V(x).

[0154] In some embodiments, in order to ensure the data security and reliability of the above-mentioned proof key and the above-mentioned verification key, the characteristics of blockchain such as immutability, transparency and security can be utilized, and the above-mentioned verifier can publish the proof key and the verification key to a pre-established blockchain for storage. In this case, when the above-mentioned prover needs to use the proof key to generate proof data later, the proof key can be obtained from the blockchain. Of course, in order to reduce the maintenance cost of the verification key by the verifier and to ensure the security and correctness of the use of the verification key, when the verifier needs to use the verification key to verify the trusted capability of the machine learning model to be verified later, the verification key can also be obtained from the blockchain.

[0155] As described in the above-mentioned step 308, commitment data corresponding to the model data of the above-mentioned machine learning model can be generated based on a preset commitment scheme, and the above-mentioned first proof data can be generated based on the above-mentioned first verification data set, the above-mentioned first calculation result and the commitment data; and the above-mentioned second proof data can also be generated based on the above-mentioned second verification data set, the above-mentioned second calculation result and the commitment data.

[0156] In this case, in order for the above-mentioned verifier to perform trusted capability verification on the above-mentioned machine learning model, the above-mentioned prover may send the above-mentioned commitment data, the above-mentioned first verification data set, the above-mentioned first calculation result and the above-mentioned first proof data to the verifier. When the verifier obtains the commitment data, the first verification data, the first calculation result and the first proof data, it may perform zero-knowledge verification on the first proof data based on the proof verification algorithm in the above-mentioned zero-knowledge proof scheme. Specifically, the verifier may input the above-mentioned verification key, the commitment data, the first verification data set, the first calculation result and the first proof data into the verification function contained in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the first proof data.

[0157] In addition, the certificate may also send the second verification data set, the second calculation result and the second proof data to the verifier. When the verifier obtains the commitment data, the second verification data, the second calculation result and the second proof data, it may perform zero-knowledge verification on the second proof data based on the proof verification algorithm in the zero-knowledge proof scheme. Specifically, the verifier may input the verification key, the commitment data, the second verification data set, the second calculation result and the second proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the second proof data.

[0158] In some embodiments, since the proof key corresponding to the proof generation algorithm in the above-mentioned zero-knowledge proof scheme, the verification key corresponding to the proof verification algorithm in the zero-knowledge proof scheme, the commitment data corresponding to the model data of the above-mentioned machine learning model, the above-mentioned first verification data set, the above-mentioned first calculation result, the above-mentioned first proof data, the above-mentioned first verification data set, the above-mentioned first calculation result, the above-mentioned first proof data, etc. can all be stored in a pre-assembled blockchain, in order to reduce the operational tediousness of the above-mentioned verification policy to verify the trustworthiness of the machine learning model, a smart contract for model verification can be deployed on the blockchain.

[0159] In this case, when verifying the validity of the proof data, the above-mentioned verifier can specifically call the above-mentioned smart contract, execute the calculation logic related to model verification contained in the smart contract, obtain the commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model from the above-mentioned blockchain, and input the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function contained in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

[0160] In some embodiments, the above-mentioned prover, after obtaining the above-mentioned first calculation result and the above-mentioned second calculation result, can generate a model verification report of the above-mentioned machine learning model based on the first calculation result and the second calculation result. Specifically, the prover can perform data analysis on the first calculation result to obtain data indicators for indicating the trustworthy ability of the machine learning model (for example: model effect). Similarly, the prover can perform data analysis on the second calculation result to obtain data indicators for indicating the trustworthy ability of the machine learning model (for example: model effect). In addition, since the above-mentioned second verification data set corresponding to the second calculation result is obtained by performing sample perturbation processing on the above-mentioned first verification data set corresponding to the first calculation result, the prover can perform data analysis on the first calculation result and the second calculation result, for example: by comparing and analyzing the changes between the first calculation result and the second calculation result, obtain data indicators for indicating the trustworthy ability such as stability and robustness of the machine learning model. In the case of obtaining these data indicators, a model verification report containing the inspection results such as the model effect, stability and robustness of the machine learning model can be further generated.

[0161] When the above-mentioned prover obtains the various data indicators of the above-mentioned machine learning model (or the model verification report composed of various data indicators), the above-mentioned proving party can publish these data indicators to a pre-established blockchain for storage. In this case, the above-mentioned verifier can obtain these data indicators from the blockchain and understand the trustworthiness of the machine learning model through these data indicators. Since the blockchain has the characteristics of immutability, transparency and security, the data security and reliability of the model verification report stored in the blockchain can be ensured.

[0162] In some embodiments, the above-mentioned verification party, when determining that the above-mentioned first calculation result is indeed the calculation result obtained by the above-mentioned machine learning model for the above-mentioned first verification data set by reasoning and calculation, and the above-mentioned second calculation result is indeed the calculation result obtained by the machine learning model for the above-mentioned second verification data set by reasoning and calculation, can generate a model verification report of the above-mentioned machine learning model based on the first calculation result and the second calculation result. Specifically, the verification party can perform data analysis on the first calculation result to obtain data indicators for indicating the trustworthy ability of the machine learning model (for example: model effect). Similarly, the verification party can perform data analysis on the second calculation result to obtain data indicators for indicating the trustworthy ability of the machine learning model (for example: model effect). In addition, since the above-mentioned second verification data set corresponding to the second calculation result is obtained by performing sample perturbation processing on the above-mentioned first verification data set corresponding to the first calculation result, the verification party can perform data analysis on the first calculation result and the second calculation result, for example: by comparing and analyzing the changes between the first calculation result and the second calculation result, obtain data indicators for indicating the trustworthy ability of the machine learning model such as stability and robustness. After obtaining these data indicators, a model verification report can be further generated that includes the test results of the model effect, stability, and robustness of the machine learning model.

[0163] Since the above-mentioned inspection results are obtained by the above-mentioned verification party through its own analysis, the authenticity and reliability of the trustworthy capability verification results of the above-mentioned machine learning model obtained by the verification party can be ensured.

[0164] When the above-mentioned verifier obtains the various data indicators of the above-mentioned machine learning model (or the model verification report composed of various data indicators), it can also publish these data indicators to a pre-established blockchain for storage. In this case, other verifiers can obtain these data indicators from the blockchain and understand the trustworthiness of the machine learning model through these data indicators. Since the blockchain has the characteristics of immutability, transparency and security, the data security and reliability of the model verification report stored in the blockchain can be ensured.

[0165] For example, for the above machine learning model, assuming that based on the above first calculation result, it can be determined that the value of the KS indicator is 0.406, the value of the "Top-10% Precision" (i.e., the precision of the top 10% calculation results among all calculation results) indicator is 0.960, the value of the "Top-10% Recall" (i.e., the recall of the top 10% calculation results among all calculation results) indicator is 0.194, and the value of the "Top-10% Lift" (i.e., the lift of the top 10% calculation results among all calculation results) indicator is 1.921. And assuming that based on the above second calculation result, it can be determined that the value of the KS indicator is 0.326, the value of the "Top-10% Precision" (i.e., the precision of the top 10% of all calculation results) indicator is 0.881, the value of the "Top-10% Recall" (i.e., the recall of the top 10% of all calculation results) indicator is 0.178, and the value of the "Top-10% Lift" (i.e., the lift of the top 10% of all calculation results) indicator is 1.762, then the test results shown in the following table can be obtained:

[0166]

[0167] The degree of model effect degradation in the above table can reflect the credibility of the above machine learning model, such as stability and robustness.

[0168] Corresponding to the embodiment of the aforementioned method for verifying the trusted capability of a machine learning model, the present application also provides an embodiment of a device for verifying the trusted capability of a machine learning model.

[0169] Please refer to Figure 5 , Figure 5 It is a structural diagram of a device shown in an exemplary embodiment of the present application. At the hardware level, the device includes a processor 502, an internal bus 504, a network interface 506, a memory 508 and a non-volatile memory 510, and of course may also include other required hardware. One or more embodiments of the present application can be implemented based on software, such as the processor 502 reading the corresponding computer program from the non-volatile memory 510 into the memory 508 and then running it. Of course, in addition to the software implementation, one or more embodiments of the present application do not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic module, but can also be hardware or logic devices.

[0170] Please refer to Figure 6 , Figure 6 It is a block diagram of a trusted capability verification device for a machine learning model shown in an exemplary embodiment of the present application.

[0171] The trustworthy capability verification device of the above machine learning model can be applied to Figure 5 The device shown in the figure can realize the technical solution of the present application. Among them, the device can be used as a prover for performing specific verification tasks on the machine learning model. The trusted capability verification device of the machine learning model can specifically include:

[0172] An acquisition module 602 is used to acquire a first validation data set for model validation;

[0173] The calculation module 604 inputs the first verification data set into the machine learning model to be verified, and the machine learning model performs inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set;

[0174] A generation module 606 generates first proof data corresponding to the first calculation result based on a proof generation algorithm in a preset zero-knowledge proof scheme; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model performing inference calculation on the first verification data set;

[0175] The verification module 608 sends the first proof data to the verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme, and when the zero-knowledge verification passes, determines that the first calculation result is the calculation result obtained by the machine learning model performing inference calculation on the first verification data set, and obtains data indicators for indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0176] In some embodiments, the apparatus further comprises:

[0177] A processing module, performing sample perturbation processing on the first verification data set to obtain a second verification data set;

[0178] The calculation module 604 is further used to input the second verification data set into the machine learning model, and the machine learning model performs inference calculation on the second verification data set to obtain a second calculation result corresponding to the second verification data set;

[0179] The generating module 606 is further configured to generate second proof data corresponding to the second calculation result based on a proof generating algorithm in a preset zero-knowledge proof scheme; wherein the second proof data is used to prove that the second calculation result is a calculation result obtained by the machine learning model through inference calculation on the second verification data set;

[0180] The verification module 608 is also used to send the second proof data to the verifier, so that the verifier performs zero-knowledge verification on the second proof data based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, the second calculation result is determined to be the calculation result obtained by the machine learning model performing inference calculation on the second verification data set, and a data indicator indicating the trustworthiness of the machine learning model is obtained by performing data analysis on the first calculation result and the second calculation result.

[0181] In some embodiments, based on the proof generation algorithm in the zero-knowledge proof scheme, generating proof data corresponding to the calculation result includes:

[0182] Obtaining a proof key; wherein the proof key is a key corresponding to the proof generation algorithm generated by the verifier based on a logic gate circuit; the logic gate circuit is a logic gate circuit represented by the verifier based on the circuit representation algorithm in the zero-knowledge proof scheme, which represents the reasoning logic of the machine learning model;

[0183] The proof key, verification data set, calculation result and model data of the machine learning model are input into the proof function for calculation to generate proof data corresponding to the calculation result; wherein the proof function is a function that converts the logic gate circuit into a proof generation algorithm based on the zero-knowledge proof scheme.

[0184] In some embodiments, sending the proof data to a verifier so that the verifier performs zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme includes:

[0185] The verification data set, the calculation result and the proof data are sent to the verifier, so that the verifier inputs the verification key, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the verification key is a key generated by the verifier based on the logic gate circuit and corresponding to the proof verification algorithm.

[0186] In some embodiments, the apparatus further comprises:

[0187] A commitment module, which generates commitment data corresponding to the model data of the machine learning model based on a preset commitment scheme;

[0188] The proof data is sent to a verifier, so that the verifier performs zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme, including:

[0189] The commitment data, the verification data set, the calculation result and the proof data are sent to the verifier, so that the verifier inputs the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the verification key is a key generated by the verifier based on the logic gate circuit and corresponding to the proof verification algorithm.

[0190] In some embodiments, the sending of the commitment data, the verification data set, the calculation result, and the proof data to the verifier so that the verifier inputs the verification key, the commitment data, the verification data set, the calculation result, and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data, includes:

[0191] The commitment data, the verification data set, the calculation result and the proof data are published on the blockchain for storage, so that the verifier obtains the commitment data, the verification data set, the calculation result and the proof data from the blockchain, and inputs the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

[0192] In some embodiments, the attestation key is published by the verifier to a blockchain for storage;

[0193] The obtaining of the certification key comprises:

[0194] Obtaining a proof key from the blockchain.

[0195] In some embodiments, the apparatus further comprises:

[0196] A first reporting module performs data analysis on the first calculation result to obtain data indicators for indicating the trustworthy capability of the machine learning model; wherein the trustworthy capability includes the model effect; and publishes the data indicators to the blockchain for storage, so that the verifier obtains the data indicators from the blockchain.

[0197] In some embodiments, the apparatus further comprises:

[0198] The second reporting module performs data analysis on the first calculation result and the second calculation result to obtain data indicators for indicating the trustworthy capability of the machine learning model; wherein the trustworthy capability includes model effect, stability and / or robustness; and publishes the data indicators to the blockchain for storage so that the verifier can obtain the data indicators from the blockchain.

[0199] Please refer to Figure 7 , Figure 7 It is a block diagram of another device for verifying the trustworthiness of a machine learning model as shown in an exemplary embodiment of the present application.

[0200] The trustworthy capability verification device of the above machine learning model can be applied to Figure 5 The device shown in the figure can realize the technical solution of the present application. Among them, the device can be used as a verification party to understand the trustworthiness of the machine learning model through the test results of the machine learning model. The trustworthiness verification device of the machine learning model can specifically include:

[0201] The acquisition module 702 acquires first proof data; wherein the first proof data is proof data corresponding to the first calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the first calculation result is the calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation on the first verification data set by the machine learning model to be verified; the first proof data is used to prove that the first calculation result is the calculation result obtained by the machine learning model through reasoning calculation on the first verification data set;

[0202] A verification module 704 performs zero-knowledge verification on the first proof data based on a proof verification algorithm in the zero-knowledge proof scheme;

[0203] Determination module 706, when the zero-knowledge verification passes, determines that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set, and obtains a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

[0204] In some embodiments, the acquisition module 702 is also used to acquire second proof data; wherein the second proof data is proof data corresponding to the second calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the second calculation result is the calculation result corresponding to the second verification data set obtained by the prover through the machine learning model for inference calculation on the second verification data set; the second proof data is used to prove that the second calculation result is the calculation result obtained by the machine learning model for inference calculation on the second verification data set; the second verification data set is a verification data set obtained by performing sample perturbation processing on the first verification data set;

[0205] The verification module 704 is further configured to perform zero-knowledge verification on the second proof data based on the proof verification algorithm in the zero-knowledge proof scheme;

[0206] The determination module 706 is also used to determine, when the zero-knowledge verification passes, that the second calculation result is a calculation result obtained by the machine learning model performing inference calculations on the second verification data set, and to obtain data indicators indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result and the second calculation result.

[0207] In some embodiments, the apparatus further comprises:

[0208] A generation module, which represents the reasoning logic of the machine learning model as a logic gate circuit based on the circuit representation algorithm in the zero-knowledge proof scheme, and generates a proof key corresponding to the proof generation algorithm and a verification key corresponding to the proof verification algorithm based on the logic gate circuit;

[0209] The interactive module sends the proof key to the prover, so that the prover inputs the proof key, the verification data set, the calculation result and the model data of the machine learning model into the proof function for calculation to generate proof data corresponding to the calculation result; wherein the proof function is a function that converts the logic gate circuit into a proof generation algorithm based on the zero-knowledge proof scheme.

[0210] In some embodiments, the machine learning model is a tree model; the size of the logic gate circuit satisfies the following conditions:

[0211] num tree *num sample *num depth ≤2 k -10;

[0212] num sample *num attr≤2 k -10;

[0213] max node ≤(2 k -10) / 130;

[0214] Among them, 2 k is the size of the logic gate circuit, k is a natural number, num tree is the number of trees in the machine learning model, num depth is the depth of the tree in the machine learning model, max node is the maximum number of nodes in the tree of the machine learning model, num sample The number of samples required to perform inference calculations for the machine learning model; num attr The number of attributes of the sample used when performing inference calculations for the machine learning model.

[0215] In some embodiments, the value of k is the minimum value that satisfies the condition.

[0216] In some embodiments, obtaining proof data, and performing zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme, includes:

[0217] The verification data set, the calculation result and the proof data are obtained, and the verification key, the verification data set, the calculation result and the proof data are input into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

[0218] In some embodiments, obtaining proof data, and performing zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme, includes:

[0219] Obtain commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model, and input the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the commitment data is generated by the prover based on a preset commitment scheme.

[0220] In some embodiments, the commitment data, the verification data set, the calculation result, and the proof data are published by the proving party to a blockchain for storage;

[0221] The obtaining of the commitment data, the verification data set, the calculation result and the certification data corresponding to the model data of the machine learning model includes:

[0222] Commitment data, the verification data set, the calculation result, and the proof data corresponding to the model data of the machine learning model are obtained from the blockchain.

[0223] In some embodiments, the commitment data, the verification data set, the calculation result and the proof data are published by the proving party to a blockchain for storage; a smart contract for model verification is deployed on the blockchain;

[0224] The obtaining of the commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model, and inputting the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data, includes:

[0225] The smart contract is called to obtain the commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model from the blockchain, and the verification key, the commitment data, the verification data set, the calculation result and the proof data are input into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

[0226] In some embodiments, sending the attestation key to the attesting party so that the attesting party inputs the attestation key, the verification data set, the calculation result, and the model data of the machine learning model into an attestation function for calculation to generate attestation data corresponding to the calculation result includes:

[0227] The proof key is published on the blockchain for storage, so that the proving party obtains the proof key from the blockchain, and inputs the proof key, the verification data set, the calculation result and the model data of the machine learning model into the proof function for calculation to generate proof data corresponding to the calculation result.

[0228] In some embodiments, the data indicator is published by the proving party to a blockchain for storage;

[0229] Obtaining the data indicators includes:

[0230] The data indicator is obtained from the blockchain.

[0231] In some embodiments, the obtaining of a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result includes:

[0232] Perform data analysis on the first calculation result to obtain data indicators for indicating the trustworthiness of the machine learning model; wherein the trustworthiness includes model effects.

[0233] In some embodiments, the acquiring of a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result and the second calculation result includes:

[0234] Perform data analysis on the first calculation result and the second calculation result to obtain data indicators indicating the trustworthy capability of the machine learning model; wherein the trustworthy capability includes model effect, stability and / or robustness.

[0235] For the device embodiment, it basically corresponds to the method embodiment, so the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the technical solution of the present application.

[0236] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0237] In a typical configuration, a computer includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0238] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0239] Computer-readable media include permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, disk storage, quantum memory, graphene-based storage media or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0240] It should be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0241] The above specific embodiments of the present application are described. Other embodiments are within the scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0242] The terms used in one or more embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of the present application. The singular forms of "a", "said" and "the" are also intended to include plural forms, unless the context clearly indicates other meanings. The term "and / or" refers to and includes any or all possible combinations of one or more associated listed items.

[0243] The description of the terms "one embodiment", "some embodiments", "example", "specific example" or "an implementation method" etc. used in one or more embodiments of the present application means that the specific features or characteristics described in conjunction with the embodiment are included in at least one embodiment of the present application. The schematic description of these terms is not necessarily for the same embodiment. Moreover, the specific features or characteristics described can be combined in a suitable manner in one or more embodiments of the present application. In addition, different embodiments and specific features or characteristics in different embodiments can be combined without contradicting each other.

[0244] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in one or more embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determination".

[0245] The above description is merely a preferred embodiment of one or more embodiments of the present application and is not intended to limit one or more embodiments of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application shall be included in the scope of protection of one or more embodiments of the present application.

[0246] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

Claims

1. A method for verifying the trustworthiness of a machine learning model, applied to a proving party, the method comprising: Obtaining a first validation data set for model validation; Inputting the first verification data set into a machine learning model to be verified, and having the machine learning model perform inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set; Based on a proof generation algorithm in a preset zero-knowledge proof scheme, generate first proof data corresponding to the first calculation result; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set; The first proof data is sent to the verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, the first calculation result is determined to be the calculation result obtained by the machine learning model performing inference calculation on the first verification data set, and a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result is obtained.

2. The method according to claim 1, further comprising: Performing sample perturbation processing on the first verification data set to obtain a second verification data set; Inputting the second verification data set into the machine learning model, and having the machine learning model perform inference calculation on the second verification data set to obtain a second calculation result corresponding to the second verification data set; Based on the proof generation algorithm in the preset zero-knowledge proof scheme, generate second proof data corresponding to the second calculation result; wherein the second proof data is used to prove that the second calculation result is a calculation result obtained by the machine learning model performing inference calculation on the second verification data set; The second proof data is sent to the verifier, so that the verifier performs zero-knowledge verification on the second proof data based on the proof verification algorithm in the zero-knowledge proof scheme. When the zero-knowledge verification passes, the second calculation result is determined to be the calculation result obtained by the machine learning model performing inference calculation on the second verification data set, and a data indicator indicating the trustworthiness of the machine learning model is obtained by performing data analysis on the first calculation result and the second calculation result.

3. The method according to claim 2, generating proof data corresponding to the calculation result based on the proof generation algorithm in the zero-knowledge proof scheme, comprising: Obtaining a proof key; wherein the proof key is a key corresponding to the proof generation algorithm generated by the verifier based on a logic gate circuit; the logic gate circuit is a logic gate circuit represented by the verifier based on the circuit representation algorithm in the zero-knowledge proof scheme, which represents the reasoning logic of the machine learning model; The proof key, verification data set, calculation result and model data of the machine learning model are input into the proof function for calculation to generate proof data corresponding to the calculation result; wherein the proof function is a function that converts the logic gate circuit into a proof generation algorithm based on the zero-knowledge proof scheme.

4. The method according to claim 3, sending the proof data to a verifier so that the verifier performs zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme, comprising: The verification data set, the calculation result and the proof data are sent to the verifier, so that the verifier inputs the verification key, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the verification key is a key generated by the verifier based on the logic gate circuit and corresponding to the proof verification algorithm.

5. The method according to claim 3, further comprising: Based on a preset commitment scheme, generating commitment data corresponding to the model data of the machine learning model; The proof data is sent to a verifier, so that the verifier performs zero-knowledge verification on the proof data based on a proof verification algorithm in the zero-knowledge proof scheme, including: The commitment data, the verification data set, the calculation result and the proof data are sent to the verifier, so that the verifier inputs the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the verification key is a key generated by the verifier based on the logic gate circuit and corresponding to the proof verification algorithm.

6. The method according to claim 5, wherein the sending the commitment data, the verification data set, the calculation result and the proof data to the verifier so that the verifier inputs the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data, comprises: The commitment data, the verification data set, the calculation result and the proof data are published on the blockchain for storage, so that the verifier obtains the commitment data, the verification data set, the calculation result and the proof data from the blockchain, and inputs the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

7. The method according to claim 3, wherein the certification key is published by the verifier to the blockchain for storage; The obtaining of the certification key comprises: Obtaining a proof key from the blockchain.

8. The method according to claim 1, further comprising: Performing data analysis on the first calculation result to obtain a data indicator for indicating the trustworthiness of the machine learning model; wherein the trustworthiness includes a model effect; The data indicator is published on the blockchain for storage, so that the verifier can obtain the data indicator from the blockchain.

9. The method according to claim 2, further comprising: Performing data analysis on the first calculation result and the second calculation result to obtain a data indicator for indicating the trustworthiness of the machine learning model; wherein the trustworthiness includes model effect, stability and / or robustness; The data indicator is published on the blockchain for storage, so that the verifier can obtain the data indicator from the blockchain.

10. A method for verifying the trustworthiness of a machine learning model, applied to a verification party, the method comprising: Obtaining first proof data; wherein the first proof data is proof data corresponding to the first calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the first calculation result is the calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation on the first verification data set by the machine learning model to be verified; the first proof data is used to prove that the first calculation result is the calculation result obtained by the machine learning model through reasoning calculation on the first verification data set; Based on the proof verification algorithm in the zero-knowledge proof scheme, performing zero-knowledge verification on the first proof data; When the zero-knowledge verification passes, it is determined that the first calculation result is the calculation result obtained by the machine learning model through inference calculation on the first verification data set, and a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result is obtained.

11. The method according to claim 10, further comprising: Obtain second proof data; wherein the second proof data is proof data corresponding to the second calculation result generated by the prover based on the proof generation algorithm in the preset zero-knowledge proof scheme; the second calculation result is the calculation result corresponding to the second verification data set obtained by the prover through reasoning calculation on the second verification data set by the machine learning model; the second proof data is used to prove that the second calculation result is the calculation result obtained by the machine learning model through reasoning calculation on the second verification data set; the second verification data set is a verification data set obtained by performing sample perturbation processing on the first verification data set; Based on the proof verification algorithm in the zero-knowledge proof scheme, performing zero-knowledge verification on the second proof data; When the zero-knowledge verification passes, the second calculation result is determined to be the calculation result obtained by the machine learning model through inference calculation on the second verification data set, and data indicators indicating the trustworthiness of the machine learning model are obtained by performing data analysis on the first calculation result and the second calculation result.

12. The method according to claim 11, further comprising: Based on the circuit representation algorithm in the zero-knowledge proof scheme, the reasoning logic of the machine learning model is represented as a logic gate circuit, and based on the logic gate circuit, a proof key corresponding to the proof generation algorithm and a verification key corresponding to the proof verification algorithm are generated; The proof key is sent to the proving party so that the proving party inputs the proof key, the verification data set, the calculation result and the model data of the machine learning model into the proof function for calculation to generate proof data corresponding to the calculation result; wherein the proof function is a function that converts the logic gate circuit into a proof generation algorithm based on the zero-knowledge proof scheme.

13. The method according to claim 12, wherein the machine learning model is a tree model; and the size of the logic gate circuit satisfies the following conditions: whether tre one sample *number depth ≤2 k -10; whether sample *number attr ≤2 k -10; max node ≤(2 k -10) / 130; in, 2 k is the size of the logic gate circuit, k is a natural number, num tree is the number of trees in the machine learning model, num depth is the depth of the tree in the machine learning model, max node is the maximum number of nodes in the tree of the machine learning model, num sample The number of samples required to perform inference calculations for the machine learning model; num attr The number of attributes of the sample used when performing inference calculations for the machine learning model. The method according to claim 13 , wherein the value of k is a minimum value that satisfies the condition.

15. The method according to claim 12, obtaining proof data, and performing zero-knowledge verification on the proof data based on the proof verification algorithm in the zero-knowledge proof scheme, comprising: The verification data set, the calculation result and the proof data are obtained, and the verification key, the verification data set, the calculation result and the proof data are input into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

16. The method according to claim 12, obtaining proof data, and performing zero-knowledge verification on the proof data based on the proof verification algorithm in the zero-knowledge proof scheme, comprising: Obtain commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model, and input the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data; wherein the commitment data is generated by the prover based on a preset commitment scheme.

17. The method according to claim 16, wherein the commitment data, the verification data set, the calculation result and the proof data are published by the proving party to a blockchain for storage; The obtaining of the commitment data, the verification data set, the calculation result and the certification data corresponding to the model data of the machine learning model includes: Commitment data, the verification data set, the calculation result, and the proof data corresponding to the model data of the machine learning model are obtained from the blockchain.

18. According to the method of claim 16, the commitment data, the verification data set, the calculation result and the proof data are published by the proving party to a blockchain for storage; a smart contract for model verification is deployed on the blockchain; The obtaining of the commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model, and inputting the verification key, the commitment data, the verification data set, the calculation result and the proof data into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data, includes: The smart contract is called to obtain the commitment data, the verification data set, the calculation result and the proof data corresponding to the model data of the machine learning model from the blockchain, and the verification key, the commitment data, the verification data set, the calculation result and the proof data are input into the verification function included in the proof verification algorithm for calculation, so as to perform zero-knowledge verification on the proof data.

19. The method according to claim 17 or 18, wherein sending the attestation key to the attesting party so that the attesting party inputs the attestation key, the verification data set, the calculation result and the model data of the machine learning model into an attestation function for calculation to generate attestation data corresponding to the calculation result comprises: The proof key is published on the blockchain for storage, so that the proving party obtains the proof key from the blockchain, and inputs the proof key, the verification data set, the calculation result and the model data of the machine learning model into the proof function for calculation to generate proof data corresponding to the calculation result.

20. The method according to claim 10 or 11, wherein the data indicator is published by the proving party to a blockchain for storage; Obtaining the data indicators includes: The data indicator is obtained from the blockchain.

21. According to the method of claim 10, the obtaining of a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result comprises: Perform data analysis on the first calculation result to obtain data indicators for indicating the trustworthiness of the machine learning model; wherein the trustworthiness includes model effects.

22. According to the method of claim 11, the acquiring of data indicators indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result and the second calculation result comprises: Perform data analysis on the first calculation result and the second calculation result to obtain data indicators indicating the trustworthy capability of the machine learning model; wherein the trustworthy capability includes model effect, stability and / or robustness.

23. A trusted capability verification device for a machine learning model, applied to a proving party, the device comprising: An acquisition module is used to acquire a first validation data set for model validation; A computing module, inputting the first verification data set into a machine learning model to be verified, and having the machine learning model perform inference calculation on the first verification data set to obtain a first calculation result corresponding to the first verification data set; A generation module, based on a proof generation algorithm in a preset zero-knowledge proof scheme, generates first proof data corresponding to the first calculation result; wherein the first proof data is used to prove that the first calculation result is a calculation result obtained by the machine learning model performing inference calculation on the first verification data set; A verification module sends the first proof data to a verifier, so that the verifier performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme, and when the zero-knowledge verification passes, determines that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set, and obtains a data indicator for indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

24. A trusted capability verification device for a machine learning model, applied to a verification party, the device comprising: An acquisition module is configured to acquire first proof data; wherein the first proof data is proof data corresponding to a first calculation result generated by a prover based on a proof generation algorithm in a preset zero-knowledge proof scheme; the first calculation result is a calculation result corresponding to the first verification data set obtained by the prover through reasoning calculation of a first verification data set by a machine learning model to be verified; the first proof data is used to prove that the first calculation result is a calculation result obtained by reasoning calculation of the machine learning model on the first verification data set; A verification module, which performs zero-knowledge verification on the first proof data based on the proof verification algorithm in the zero-knowledge proof scheme; The determination module determines, when the zero-knowledge verification passes, that the first calculation result is a calculation result obtained by the machine learning model through inference calculation on the first verification data set, and obtains a data indicator indicating the trustworthiness of the machine learning model obtained by performing data analysis on the first calculation result.

25. An electronic device comprising: processor; a memory for storing processor-executable instructions; The processor implements the method according to any one of claims 1 to 22 by running the executable instructions.

26. A computer-readable storage medium having computer instructions stored thereon, which implement the method according to any one of claims 1 to 22 when executed by a processor.

Images