Zero-knowledge proof method of tree model and computing equipment

Abstract

The embodiment of the invention relates to a zero-knowledge proving method of a tree model and computing equipment, the tree model comprises a prediction part and a result processing part, and the method is executed by first equipment and comprises the following steps: firstly, generating a first proving for proving the correctness of a prediction process; the prediction process comprises a process of inputting the first data into the prediction part to obtain a first result; then, the target code is converted into a target byte code, zero-knowledge proof is conducted on the correctness of the operation process of the target byte code, and a second proof is generated; the target code comprises a code of the result processing part and a code for data transmission between the result processing part and the prediction part; the result processing part is used for processing the first result to obtain a prediction result; next, zero-knowledge proof is carried out on the correctness of the data transmission process, and a third proof is generated; and finally, sending the total proof and the public data to the second equipment for verifying the correctness of the tree model.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of privacy computing technology, and in particular, to a zero-knowledge proof method and computing device for a tree model. Background Art

[0002] As one of the most commonly used models in machine learning, tree models have been widely used in finance, medical care, recommendation and other fields due to their excellent performance and interpretability. For example, in the financial field, tree models can be used in anti-fraud prediction, default prediction and many other aspects.

[0003] However, in actual applications, the prediction process of tree models often involves multiple parties, including model holders and data holders. The data holder sends the data to be predicted to the model holder, and the model holder uses the model it holds to make predictions and then sends the prediction results to the data holder. This process cannot guarantee that the model holder uses the correct model to make a complete prediction. The model holder may use a different version of the model than what it claims, deliberately skip the model prediction step to reduce the computational cost, or introduce bias in the prediction process to obtain additional benefits. For example, a model holder claims that its random forest model for anti-fraud prediction contains 1,000 decision trees, but in actual prediction, only 100 decision trees are used to reduce the computational cost. This will lead to a decrease in the accuracy of the prediction, which in turn leads to the loss of user property, but the data holder cannot discover this problem when receiving the prediction results.

[0004] In addition, the data holder cannot know whether the model is as good as the model holder claims before making a prediction. Since the model is often privately owned by the model holder, the data holder cannot directly obtain the model to view its structure and parameters, and it is difficult to verify the performance of the model on real data. Still taking the previous anti-fraud scenario as an example, a model holder claims that its anti-fraud model has achieved 95% accuracy on a certain data set, but without revealing the details of the model, the data holder cannot verify the authenticity of this statement.

[0005] Therefore, a method is needed to allow the model owner to verify the accuracy proof of the tree model before prediction without disclosing the model details, so as to understand the model performance in advance. The data is then handed over to the model owner for prediction, and the prediction results and prediction correctness proof are obtained at the same time to verify whether the prediction results are correctly predicted by the previously selected tree model. Summary of the invention

[0006] The purpose of this specification is to provide a zero-knowledge proof method and computing device for a tree model, aiming to solve the above-mentioned problems.

[0007] In a first aspect, the present specification provides a zero-knowledge proof method of a tree model, wherein the tree model includes a prediction part and a result processing part. The method is executed by a first device and includes:

[0008] Using a preset zero-knowledge proof framework, generating a first proof for proving the correctness of a prediction process; the prediction process includes a process of inputting first data into the prediction part to obtain a first result;

[0009] Convert the target code into a target bytecode, perform zero-knowledge proof on the correctness of the running process of the target bytecode, and generate a second proof; the target code includes the code of the result processing part and the code of data transmission between the result processing part and the prediction part; the result processing part is used to process the first result to obtain a prediction result;

[0010] Performing zero-knowledge proof on the correctness of the data transmission process to generate a third proof;

[0011] The total proof and the public data are sent to a second device for verifying the correctness of the tree model; the total proof includes the first proof, the second proof and the third proof; the public data includes the first result and the predicted result.

[0012] In some possible implementations, the public data also includes the first verification key.

[0013] In some possible implementations, the target bytecode is wasm bytecode; and the public data further includes the second verification key.

[0014] In some possible implementations, the public data also includes the third verification key.

[0015] In some possible implementations, the public data also includes the fourth verification key.

[0016] In some possible implementations, the tree model includes at least one of the following: a lightGBM model, an AdaBoost model, an XGBoost model, and a random forest model.

[0017] The second aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect.

[0018] A third aspect of the specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0019] The fourth aspect of this specification provides a computer program product, including a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0020] The zero-knowledge proof method and computing device of the tree model proposed in the embodiments of this specification enable the model holder to prove the accuracy and prediction correctness of the tree model based on zero-knowledge proof, and then send the generated proof to the data holder for verification. Specifically, the model holder divides the tree model into a prediction part and a result processing part, and uses a preset zero-knowledge proof framework to prove the correctness of the prediction process of the prediction part to obtain a first proof. At the same time, the prediction part is regarded as an interface, and the code for data transmission with the prediction part is added to the code of the result processing part, and then the correctness of the running process of the two parts of the code is zero-knowledge proved to obtain a second proof. In addition, the correctness of the data transmission process is also zero-knowledge proved to obtain a third proof. Then the total proof containing the above three proofs and the relevant public data are sent to the data holder to verify the correctness of the tree model.

[0021] The embodiments of this specification effectively protect the privacy of the model holder by using zero-knowledge proof, so that the model holder can be convinced of the correctness of their prediction process / the correctness of the model accuracy without having to pass the model to the data holder. In addition, by dividing the tree model into two parts, the more complex reasoning part is handed over to the zero-knowledge proof framework for proof, and then the running process of the code of the remaining result processing part is directly proved by zero-knowledge proof, which can achieve a faster proof speed than directly proving the running process of the code of the entire tree model. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 It is a schematic diagram of an implementation scenario of a zero-knowledge proof method of a tree model in one embodiment;

[0024] Figure 2 is a flowchart of a zero-knowledge proof method of a tree model in one embodiment of this specification;

[0025] Figure 3 It is a schematic block diagram of a zero-knowledge proof device of a tree model in one embodiment of this specification. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0027] As mentioned above, the model holder needs a method to convince the data holder of the correctness of their prediction process / the correctness of the model accuracy without having to pass the model to the data holder. To meet this requirement, the zero-knowledge proof method can be used to allow the model holder to prove the correctness of the model prediction process / the correctness of the model accuracy to the data holder without leaking any other information about the model.

[0028] Generally speaking, the tree model owned by the model holder is in the form of code written in a high-level programming language. When proving the correctness of the prediction process / model accuracy of the tree model based on the high-level language code, the high-level language code is usually first compiled into bytecode, and then the running process of the bytecode is subjected to zero-knowledge proof.

[0029] In this process, if all the codes of the prediction process / model accuracy calculation process are converted into bytecode representation, the amount of bytecode obtained will be huge, which will make the subsequent zero-knowledge proof process impossible.

[0030] In order to solve the aforementioned problem, the embodiments of this specification propose a zero-knowledge proof method of a tree model to solve the aforementioned problem. Figure 1 Schematic diagram of the implementation scenario of the zero-knowledge proof method of the tree model in one embodiment. Figure 1 In the example, the tree model is held by the model holder, and includes a prediction part and a result processing part. The prediction part includes the tree structure and specific parameters of the tree model, which is used to make predictions based on the input data to obtain the prediction results of each tree in the tree model. The result processing part is used to summarize the prediction results of each tree and perform aggregation processing corresponding to the tree model to obtain the final prediction result. For example, when the tree model is a random forest, the aggregation processing can be majority voting or averaging; when the tree model is an XGBoost (eXtreme Gradient Boosting) model, the aggregation processing can be summation. The tree model is written in a high-level language (such as Java, C++, etc.), among which the prediction part, as the core part of the tree model, occupies the vast majority of the code.

[0031] To this end, the model holder, as the prover in the zero-knowledge proof system, separates the prediction part of the tree model from the result processing part, and uses the preset zero-knowledge proof framework to perform zero-knowledge proof on the correctness of the prediction process / model accuracy calculation process of the prediction part, and generates a proof of the correctness of the prediction process, such as Figure 1 The zero-knowledge proof framework may be, for example, a zero-knowledge proof circuit, such as a Halo2 circuit, etc.

[0032] At the same time, after separation, the result processing part needs to transmit data with the prediction part, including sending the input data to be predicted to the prediction part and receiving the prediction results generated by the prediction part. The model owner compiles and converts the code of the result processing part and the data transmission part to obtain the corresponding bytecode, and performs zero-knowledge proof on the correctness of the bytecode running process, generating a proof of the correctness of the bytecode running process, such as Figure 1 as shown on the left.

[0033] In addition to performing zero-knowledge proofs on the correctness of the above two parts, it is also necessary to prove the correctness of the data transmission process, that is, the input data sent by the left data transmission part is the same as the input data received by the right prediction part; and the prediction result data sent by the right prediction part is the same as the prediction result data received by the left data transmission part. Therefore, the model holder performs zero-knowledge proof on the correctness of the data transmission process and generates a proof of the correctness of the data transmission process, such as Figure 1 Shown in the middle.

[0034] After obtaining the zero-knowledge proof results of the above three parts, the model holder aggregates the proof results of the above three parts to obtain a total proof, and sends the total proof and the public data used to verify the total proof to the data holder as the verifier. The public data includes the prediction results of each tree in the prediction part, and the total prediction result obtained by aggregation in the result processing part.

[0035] The data holder can then verify the correctness of the total proof. Once the verification is passed, it can be considered that the model holder's statement about the prediction process / model accuracy calculation process is correct.

[0036] The following describes the specific implementation steps of the zero-knowledge proof method of the above tree model in conjunction with a specific embodiment.

[0037] Figure 2 1 is a flowchart of a zero-knowledge proof method of a tree model in an embodiment of this specification. The execution subject of the method can be any platform or server or device cluster with computing and processing capabilities. Figure 2As shown, the tree model includes a prediction part and a result processing part, and the method is executed by a first device, and at least includes: step 202, using a preset zero-knowledge proof framework to generate a first proof for proving the correctness of the prediction process; the prediction process includes a process of inputting first data into the prediction part to obtain a first result; step 204, converting the target code into a target bytecode, performing a zero-knowledge proof on the correctness of the running process of the target bytecode, and generating a second proof; the target code includes the code of the result processing part, and the code of data transmission between the result processing part and the prediction part; the result processing part is used to process the first result to obtain a predicted result; step 206, performing a zero-knowledge proof on the correctness of the data transmission process, and generating a third proof; step 208, sending the total proof and public data to the second device for verifying the correctness of the tree model; the total proof includes the first proof, the second proof and the third proof; the public data includes the first result and the predicted result.

[0038] The specific execution process of each of the above steps is described below.

[0039] First, in step 202, a first proof is generated to prove the correctness of a prediction process using a preset zero-knowledge proof framework; the prediction process includes a process of inputting first data into the prediction part to obtain a first result.

[0040] The first device may be a model holder, a prover in the zero-knowledge proof process. The first data may be data to be tested, and the first result output by each tree in the prediction part is obtained by inputting the first data into the prediction part.

[0041] In one embodiment, the tree model may be any form of tree model, such as a lightGBM (Light Gradient Boosting Machine) model, an AdaBoost (Adaptive Boosting) model, an XGBoost model, a random forest model, and the like.

[0042] The tree model may be a model for making predictions in a variety of scenarios. For example, in one embodiment, the tree model may be used in an anti-fraud scenario to predict whether a user and / or transaction is a risky user and / or a risky transaction. In this case, the input first data may include at least one of user characteristics and transaction information, and the first result may be the prediction result of each tree in the tree model as to whether the input user / transaction is risky.

[0043] In one embodiment, the zero-knowledge proof framework of step 202 can be a framework based on an arithmetic circuit. This type of framework first converts the calculation process to be proved into an arithmetic circuit, and then generates a zero-knowledge proof based on the arithmetic circuit. The arithmetic circuit is a directed acyclic graph used to represent arithmetic calculations, which includes input lines, output lines, intermediate lines, and arithmetic gates. The input line represents the input value of the calculation, the output line represents the final result of the calculation, the intermediate line is used to connect the various gates and transmit the intermediate calculation results. The arithmetic gate is used to perform arithmetic operations, including standard gates and custom gates. Standard gates are used to perform some common standard operations, such as addition gates for addition, multiplication gates for multiplication, comparison gates for comparison operations, and the like. Custom gates allow developers to define arbitrary constraint relationships, and can implement complex arithmetic operations and logical relationships, such as constraints containing polynomials.

[0044] For the tree model, the first data input into the prediction part of the tree model may correspond to the input line of the arithmetic circuit, and the first result obtained by the prediction part may correspond to the output line of the arithmetic circuit. The decision node (split node) inside the prediction part may correspond to the intermediate line and arithmetic gate in the arithmetic circuit.

[0045] In this embodiment, step 202 specifically includes step 2022 and step 2024 .

[0046] At step 2022, the prediction portion is converted into a first arithmetic circuit.

[0047] The conversion process can be done using a circuit compiler in a zero-knowledge proof framework, such as Circom, Halo2, etc.

[0048] Then, in step 2024, a first proof is generated based on the first arithmetic circuit and the first data.

[0049] Depending on the zero-knowledge proof framework used, the process of generating the first proof in step 2024 may also be different.

[0050] In a specific embodiment, the zero-knowledge proof framework is a Halo2 framework, and the first arithmetic circuit is a Halo2 circuit; step 2024 specifically includes:

[0051] First, a first certification key and a first verification key are generated according to the first arithmetic circuit.

[0052] The Proving Key is the key used by the prover to generate the proof. It contains complete circuit information and public parameters of the polynomial commitment scheme, which is used to perform calculations and generate proofs to ensure the correctness and zero-knowledge of the proof.

[0053] The Verification Key is a key used by the verifier to verify the proof, which usually contains simplified information of the circuit, public parameters used for verification, and public parameters of the polynomial commitment scheme.

[0054] Among them, the public parameters of the polynomial commitment scheme are used to generate and verify polynomial commitments, providing a cryptographic basis for the zero-knowledge proof system and ensuring the security and correctness of the proof.

[0055] Then, a first certificate is generated based on the first arithmetic circuit, the first certification key and the first data.

[0056] By using the corresponding preset methods in the Halo2 framework, it is possible to generate the proof key, verification key and final proof. For example, the keygen_pk method and keygen_vk method in Halo2 can be called to generate the first proof key and the first verification key, respectively, and the create_proof method in Halo2 can be called to generate the first proof.

[0057] Specifically, the process of generating the first verification key using the keygen_vk method may be:

[0058] let params1=Params::new(k);

[0059] let vk1=keygen_vk(params1,circuit1);

[0060] Where params1 is the public parameter of the polynomial commitment scheme, and the size of the polynomial commitment is k. circuit1 is the first arithmetic circuit, and vk1 is the first verification key. keygen_vk generates the first verification key vk1 according to the public parameters of the polynomial commitment scheme and the first arithmetic circuit circuit1.

[0061] The process of generating the first attestation key using the keygen_pk method can be:

[0062] let pk1=keygen_pk(params1,vk1.clone(),circuit1);

[0063] Wherein, pk1 is the first proof key. keygen_pk generates the first proof key pk1 according to the public parameters of the polynomial commitment scheme, the first verification key vk1 and the first arithmetic circuit circuit1.

[0064] The process of generating the first proof using the create_proof method can be:

[0065] let proof1=create_proof(params1,pk1,circuit1,public_inputs,rng,transcript);

[0066] Among them, public_inputs is the public input corresponding to the first data, rng is the random number generator, transcript is used to record all interactive information in the proof generation process, and proof1 is the first proof.

[0067] In other embodiments, other zero-knowledge proof frameworks may be used, such as a zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) framework, a PLONK framework, etc., and the corresponding process of the framework may be followed to generate a first proof according to the first arithmetic circuit.

[0068] Then, in step 204, the target code is converted into a target bytecode, and a zero-knowledge proof is performed on the correctness of the running process of the target bytecode to generate a second proof; the target code includes the code of the result processing part, and the code of data transmission between the result processing part and the prediction part; the result processing part is used to process the first result to obtain a prediction result.

[0069] The result processing part is used to summarize the prediction results of each tree according to a specific tree model and perform aggregation processing corresponding to the tree model to obtain the final prediction result. For example, when the tree model is a random forest, the aggregation processing can be majority voting or averaging; when the tree model is an XGBoost (eXtreme Gradient Boosting) model, the aggregation processing can be summation.

[0070] Due to the particularity of the calculation process of the result processing part, such as summarizing the voting results, etc., it is impossible to use the method of step 202 to convert the result processing part into the corresponding arithmetic circuit and perform zero-knowledge proof. Therefore, in step 204, it is converted into target bytecode together with the data transmission code, and the correctness of the operation process of the target bytecode is proved by zero-knowledge.

[0071] The process of converting the target code into the target bytecode in step 204 can be implemented using a compiler corresponding to the target bytecode. After obtaining the target bytecode, a preset second zero-knowledge proof framework can be used to perform zero-knowledge proof on the correctness of the running process of the target bytecode.

[0072] In one embodiment, in step 204, the correctness of the running process of the target bytecode is zero-knowledge proved to generate a second proof, including: converting the target bytecode into a second arithmetic circuit; generating a second proof key and a second verification key according to the second arithmetic circuit; generating a second proof according to the second arithmetic circuit and the second proof key.

[0073] In a more specific embodiment, the target bytecode may be wasm (WebAssembly) bytecode, and accordingly, the second zero-knowledge proof framework may be a zkwasm framework. wasm is a low-level binary format that allows developers to use high-performance code written in other programming languages ​​(such as C, C++, or Rust, etc.) to run in a browser.

[0074] After obtaining the target bytecode, the target bytecode can be converted into a second arithmetic circuit through the setup command of zkwasm, and the corresponding second proof key and second verification key can be generated. Through the prove command of zkwasm, the second proof can be generated according to the second arithmetic circuit and the second proof key.

[0075] In other embodiments, other bytecodes and corresponding zero-knowledge proof frameworks may be used to generate the second proof.

[0076] Next, in step 206, a zero-knowledge proof is performed on the correctness of the data transmission process to generate a third proof.

[0077] Specifically, step 206 includes step 2062 and step 2064 .

[0078] In step 2062, the data transmission process is converted into a third arithmetic circuit.

[0079] The third arithmetic circuit is used to constrain the data sent and received to be the same. For example, when the third arithmetic circuit is a Halo2 circuit, its corresponding circuit table may include two columns, which correspond to the data sent and received respectively. The zero-knowledge proof of the correctness of the data transmission process includes proving that the values ​​corresponding to the two columns are equal.

[0080] Exemplarily, the circuit table of the third arithmetic circuit may be as shown in Table 1:

[0081] Table 1: Example of a circuit table for the third arithmetic circuit

[0082] x y a1 a2 b1 b2 c1 c2

[0083] The x column represents the data sent, the y column represents the data received, and the subsequent rows give the specific data sent and received. The corresponding circuit constraint may be xy=0, which is used to constrain the values ​​of x and y to be equal.

[0084] Then, in step 2064, a third proof is generated based on the third arithmetic circuit and the transmitted data.

[0085] In a specific embodiment, the third arithmetic circuit is a Halo2 circuit; step 2064 specifically includes:

[0086] A third certification key and a third verification key are generated according to the third arithmetic circuit; and a third certification is generated according to the third arithmetic circuit, the third certification key and the transmitted data.

[0087] The process of generating the third proof according to the third arithmetic circuit and the transmitted data in step 2064 can refer to the specific process in step 202, which will not be repeated here.

[0088] Finally, in step 208, the total proof and public data are sent to the second device for verifying the correctness of the tree model; the total proof includes the first proof, the second proof and the third proof; the public data includes the first result and the predicted result.

[0089] The second device can be the data holder and the verifier in the zero-knowledge proof process. The second device verifies the zero-knowledge proof result provided by the first device based on the received proof and the public data used to verify the proof to determine the correctness of the tree model prediction process.

[0090] In one embodiment, when the first certification key is used in the process of generating the first certification in step 202, the public data also includes the first verification key.

[0091] In one embodiment, when a second certification key is used in the process of generating the second certification in step 204, the public data further includes the second verification key.

[0092] In one embodiment, when a third certification key is used in the process of generating the third certification in step 206, the public data also includes the third verification key.

[0093] The second device can use the verification method provided in the relevant zero-knowledge proof framework to verify the first proof, the second proof, and the third proof respectively. When all three proofs are verified, the correctness of the tree model prediction process can be verified.

[0094] For example, when the first proof and the third proof are generated using the Halol2 framework, the verification method can be the verify_proof method in Halo2. When the second proof is generated using the zkwasm framework, the verification command can be the verify command of zkwasm.

[0095] Through the above steps, the privacy of the model holder is protected, so that the data holder can be convinced of the correctness of the tree model prediction process without having to transmit the tree model to the data holder. At the same time, the embodiment of this specification adopts the method of bytecode plus external circuit, which can achieve a faster proof speed than directly converting all processes into bytecode for proof.

[0096] In some possible implementations, the tree model further includes an accuracy calculation part, which is used to calculate the prediction accuracy of the tree model based on the prediction results and the actual results. In this implementation, the method is also used to perform zero-knowledge proof of the correctness of the accuracy calculation process, including:

[0097] Step 210, using the zero-knowledge proof framework, generates a fourth proof for proving the correctness of the accuracy calculation process; the accuracy calculation process includes inputting the predicted result and the real result corresponding to the first data into the accuracy calculation part to obtain the prediction accuracy value; the total proof also includes the fourth proof; the public data also includes the prediction accuracy value.

[0098] In one embodiment, the zero-knowledge proof framework of step 210 may be a framework based on an arithmetic circuit. In this embodiment, step 210 specifically includes step 2102 and step 2104.

[0099] In step 2102, the precision calculation part is converted into a fourth arithmetic circuit.

[0100] In step 2104, a fourth proof is generated according to the fourth arithmetic circuit, the predicted result and the true result.

[0101] In a specific embodiment, the zero-knowledge proof framework is a Halo2 framework, and the fourth arithmetic circuit is a Halo2 circuit; step 2104 specifically includes:

[0102] According to the fourth arithmetic circuit, a fourth proof key and a fourth verification key are generated; according to the fourth arithmetic circuit, the fourth proof key, the predicted result and the true result, a fourth proof is generated.

[0103] The process of generating the fourth proof according to the fourth arithmetic circuit, the predicted result and the true result in step 2104 can refer to the specific process in step 202, which will not be repeated here.

[0104] In this embodiment, the public data in step 208 also includes the fourth verification key.

[0105] Through step 210, the model holder does not need to transmit the tree model to the data holder, and the data holder can be convinced of the correctness of the model accuracy of the tree model.

[0106] According to another embodiment, a zero-knowledge proof device of a tree model is also provided. Figure 3 This is a schematic block diagram of a zero-knowledge proof device for a tree model in an embodiment of this specification. The device can be deployed in any device, platform or device cluster with computing and processing capabilities. Figure 3 As shown, the tree model includes a prediction part and a result processing part, and the apparatus 300 is deployed on a first device and includes:

[0107] The first proof generating unit 302 is configured to generate a first proof for proving the correctness of a prediction process using a preset zero-knowledge proof framework; the prediction process includes a process of inputting first data into the prediction part to obtain a first result;

[0108] The second proof generating unit 304 is configured to convert the target code into a target bytecode, perform a zero-knowledge proof on the correctness of the running process of the target bytecode, and generate a second proof; the target code includes the code of the result processing part and the code of data transmission between the result processing part and the prediction part; the result processing part is used to process the first result to obtain a prediction result;

[0109] A third proof generating unit 306 is configured to perform zero-knowledge proof on the correctness of the data transmission process and generate a third proof;

[0110] The sending unit 308 is configured to send the total proof and public data to the second device for verifying the correctness of the tree model; the total proof includes the first proof, the second proof and the third proof; the public data includes the first result and the predicted result.

[0111] In some possible implementations, the tree model further includes an accuracy calculation part; and the device 300 further includes:

[0112] The fourth proof generation unit 310 is configured to use the zero-knowledge proof framework to generate a fourth proof for proving the correctness of the accuracy calculation process; the accuracy calculation process includes inputting the predicted result and the true result corresponding to the first data into the accuracy calculation part to obtain the prediction accuracy value; the total proof also includes the fourth proof; the public data also includes the prediction accuracy value.

[0113] According to another aspect of the embodiment, a computer program product is also provided, including a computer program / instruction, which implements the steps of the method described in any of the above embodiments when executed by a processor.

[0114] According to yet another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any one of the above embodiments is implemented.

[0115] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0116] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0117] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0118] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0119] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0120] This specification is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0121] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0122] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0123] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0124] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0125] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0126] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0128] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0129] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A zero-knowledge proof method for a tree model, wherein the tree model includes a prediction part and a result processing part, and the method is executed by a first device, comprising: Using a preset zero-knowledge proof framework, generate a first proof for proving the correctness of the prediction process; The prediction process includes a process of inputting first data into the prediction part to obtain a first result; Convert the target code into target bytecode, perform zero-knowledge proof on the correctness of the running process of the target bytecode, and generate a second proof; The target code includes the code of the result processing part and the code of data transmission between the result processing part and the prediction part; The result processing part is used to process the first result to obtain a prediction result; Performing zero-knowledge proof on the correctness of the data transmission process to generate a third proof; The total proof and the public data are sent to a second device for verifying the correctness of the tree model; the total proof includes the first proof, the second proof and the third proof; the public data includes the first result and the predicted result.

2. The method according to claim 1, wherein: The tree model also includes an accuracy calculation part; the method also includes: Using the zero-knowledge proof framework, a fourth proof is generated to prove the correctness of the accuracy calculation process; the accuracy calculation process includes inputting the predicted result and the real result corresponding to the first data into the accuracy calculation part to obtain the prediction accuracy value; the total proof also includes the fourth proof; the public data also includes the prediction accuracy value.

3. The method according to claim 1, wherein: Using the preset zero-knowledge proof framework, the first proof is generated to prove the correctness of the prediction process, including: converting the predicted portion into a first arithmetic circuit; A first proof is generated based on the first arithmetic circuit and the first data.

4. The method according to claim 3, wherein: The zero-knowledge proof framework is a Halo2 framework, and the first arithmetic circuit is a Halo2 circuit; Generating a first proof according to the first arithmetic circuit and the first data, comprising: generating a first certification key and a first verification key according to the first arithmetic circuit; A first certificate is generated based on the first arithmetic circuit, a first certification key and the first data.

5. The method according to claim 1, wherein: Perform zero-knowledge proof on the correctness of the target bytecode running process and generate a second proof, including: converting the target bytecode into a second arithmetic circuit; generating a second certification key and a second verification key according to the second arithmetic circuit; A second certificate is generated according to the second arithmetic circuit and the second certification key.

6. The method according to claim 1, wherein: Performing zero-knowledge proof on the correctness of the data transmission process to generate a third proof, including: converting the data transmission process into a third arithmetic circuit; A third proof is generated based on the third arithmetic circuit and the transmitted data.

7. The method according to claim 6, wherein: The third arithmetic circuit is a Halo2 circuit; Generating a third proof according to the third arithmetic circuit and the transmitted data, comprising: generating a third certification key and a third verification key according to the third arithmetic circuit; A third certificate is generated based on the third arithmetic circuit, the third certification key and the transmitted data.

8. The method according to claim 2, wherein: Using the zero-knowledge proof framework, a fourth proof is generated for proving the correctness of the precision calculation process, including: converting the precision calculation part into a fourth arithmetic circuit; A fourth proof is generated based on the fourth arithmetic circuit, the predicted result and the true result.

9. The method according to claim 8, wherein: The zero-knowledge proof framework is a Halo2 framework, and the fourth arithmetic circuit is a Halo2 circuit; Generating a fourth proof according to the fourth arithmetic circuit, the predicted result and the true result, comprising: generating a fourth certification key and a fourth verification key according to the fourth arithmetic circuit; A fourth proof is generated according to the fourth arithmetic circuit, the fourth proof key, the predicted result and the true result.

10. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 9 is implemented.

Images