Tree model joint training method and bucket threshold extraction method

Abstract

The invention provides a joint training method of a tree model and a bucket threshold extraction method. The first party and the second party hold samples including a first feature and a second feature, respectively. And the first party firstly obtains bucket information corresponding to the second feature of the intersection sample through a hidden tracer primary key privacy intersection and hidden tracer primary key privacy bucket protocol jointly executed by the first party and the second party. And receiving a second fragment of the bucket number and a second fragment of the bucket boundary mark value in the bucket information sent by the second party, and carrying out secret sharing decryption based on the second fragment of the bucket number and the second fragment of the bucket boundary mark value. And further receiving the homomorphic ciphertext of the second fragment of the feature value in the bucket information sent by the second party, and determining the homomorphic ciphertext of the feature value of the intersection sample based on the homomorphic ciphertext of the second fragment of the feature value and the homomorphic sum of the first fragment. And finally, according to the bucket number of the second feature of each intersection sample, the bucket editing mark value and the homomorphic ciphertext of the feature value, determining a bucket threshold homomorphic ciphertext corresponding to each bucket. And carrying out tree model training.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of privacy computing technology, and in particular, relate to a tree model joint training method and a bucket threshold extraction method. Background Art

[0002] A decision tree model is a tree structure that can be used to score or classify the attributes of a target object based on the input feature values ​​of the target object. Privacy computing is a method in which multiple parties conduct joint data processing without disclosing their own data. With the continuous development of privacy computing technology, there is a need in the existing technology for two parties to jointly conduct privacy computing for modeling a tree model.

[0003] When two parties jointly build a tree model, they often need to first determine the intersection samples of the two parties, that is, the samples with the same identification information (or primary key) held by both parties. In related technologies, the intersection samples are generally determined by the private set intersection (PSI) method. PSI allows the participants to obtain the primary key information of the intersection without knowing the non-intersection primary key information of the other party.

[0004] However, the above scheme will leak the primary key information of the intersection samples, which is not conducive to maintaining data privacy. Summary of the invention

[0005] The purpose of this specification is to solve the problem of leaking primary key information and provide a tree model joint training method and a bucket threshold extraction method.

[0006] A first aspect of the present specification provides a tree model joint training method, which is applied to a first party. The method also involves a second party, wherein the first party and the second party respectively hold samples including a first feature and a second feature; the method comprises:

[0007] A plurality of intersection samples are obtained by performing an anonymous key privacy intersection in conjunction with the second party, and a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value are obtained by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket;

[0008] Receive the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample;

[0009] Receive the homomorphic ciphertext of the second shard of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second shard of the eigenvalue and the first shard of the eigenvalue;

[0010] Determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample;

[0011] Using the multiple intersection samples, jointly perform joint training of the tree model with the second party to determine the split point of each non-leaf node in the tree model, where the split point is indicated by the bucket number of the feature;

[0012] When the splitting point is the bucket number corresponding to the second feature, the bucket threshold homomorphic ciphertext corresponding to the bucket number is obtained, so as to jointly determine the splitting condition corresponding to the splitting point according to the bucket threshold homomorphic ciphertext and the second party, and calculate the weight value of the leaf node based on this.

[0013] A second aspect of the present specification provides a bucket threshold extraction method, which is applied to a first party. The method also involves a second party. The first party and the second party respectively hold samples including a first feature and a second feature. The method includes:

[0014] A plurality of intersection samples are obtained by performing an anonymous key privacy intersection in conjunction with the second party, and a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value are obtained by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket;

[0015] Receive the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample;

[0016] Receive the homomorphic ciphertext of the second shard of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second shard of the eigenvalue and the first shard of the eigenvalue;

[0017] According to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample, the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature is determined; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

[0018] A third aspect of the present specification provides a tree model joint training device, applied to a first party, wherein the first party and the second party respectively hold samples including a first feature and a second feature; the device comprises:

[0019] A bucketing module, configured to obtain a plurality of intersection samples by performing an anonymous key privacy intersection in conjunction with a second party, and to obtain a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of a corresponding bucket;

[0020] A secret sharing decryption module is used to receive the second slice of the bucket number and the second slice of the bucket boundary marking value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marking value to determine the bucket number and the bucket boundary marking value corresponding to the second feature of each intersection sample;

[0021] A homomorphic operation module, used for receiving the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determining the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue;

[0022] A bucket threshold extraction module is used to determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample;

[0023] A split point determination module, used to use the multiple intersection samples and jointly perform joint training of the tree model with the second party to determine the split point of each non-leaf node in the tree model, wherein the split point is indicated by the bucket number of the feature;

[0024] The weight value calculation module is used to obtain the bucket threshold homomorphic ciphertext corresponding to the bucket number when the splitting point is the bucket number corresponding to the second feature, so as to jointly determine the splitting condition corresponding to the splitting point according to the bucket threshold homomorphic ciphertext and the second party, and calculate the weight value of the leaf node based on this.

[0025] A fourth aspect of the present specification provides a bucket threshold extraction device, applied to a first party, wherein the first party and the second party respectively hold samples including a first feature and a second feature; the device comprises:

[0026] A bucketing module, configured to obtain a plurality of intersection samples by performing an anonymous key privacy intersection in conjunction with a second party, and to obtain a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of a corresponding bucket;

[0027] A secret sharing decryption module is used to receive the second slice of the bucket number and the second slice of the bucket boundary marking value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marking value to determine the bucket number and the bucket boundary marking value corresponding to the second feature of each intersection sample;

[0028] A homomorphic operation module, used for receiving the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determining the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue;

[0029] The bucket threshold extraction module is used to determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

[0030] The fifth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the above-mentioned tree model joint training method or bucket threshold extraction method.

[0031] The sixth aspect of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the above-mentioned tree model joint training method or bucket threshold extraction method is implemented.

[0032] The seventh aspect of the present specification provides a computer program product, including a computer program / instruction, which implements the above-mentioned tree model joint training method or bucket threshold extraction method when executed by a processor.

[0033] Through the above method, on the basis of obtaining the feature value sharding, bucket number sharding and bucket boundary mark value sharding corresponding to each feature of the intersection sample based on the anonymous primary key privacy intersection and anonymous primary key privacy bucketing protocol, the bucket threshold ciphertext extraction can be completed without leaking the primary key information and other privacy information, and the tree model training can be completed based on the bucket threshold, thereby realizing the tree model training based on the anonymous primary key. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0035] Figure 1 It is a schematic diagram of a decision tree;

[0036] Figure 2 is a flow chart of a tree model joint training method in one embodiment;

[0037] Figure 3 is a flowchart of a tree model joint training method in another embodiment;

[0038] Figure 4 is a flowchart of a bucket threshold extraction method in an embodiment of this specification;

[0039] Figure 5 It is a structural block diagram of a tree model joint training device in an embodiment of this specification;

[0040] Figure 6 It is a structural block diagram of a bucket threshold extraction device in one embodiment of this specification. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0042] With the requirements of data security, privacy computing methods that take into account both privacy protection requirements and data utilization have been widely used. In related technologies, multiple participants use their respective data to perform joint privacy computing, such as joint modeling and joint federated learning.

[0043] The decision tree model generally exists in the form of a binary tree. It determines which leaf node a sample falls on based on the splitting conditions of the non-leaf nodes, and determines the score or classification of the sample based on the weight value of the leaf node. Figure 1 As shown, Figure 1It is a simple decision tree. The content in the non-leaf node represents the splitting condition of the node, A is the identifier of a certain feature, and the number is the corresponding splitting threshold. The content in the leaf node represents the weight value of the leaf node. If the sample meets the condition that is less than the corresponding splitting threshold, it will fall into the node on the left side of the node, otherwise it will fall into the node on the right side until the sample falls into a leaf node. For example, if the feature value of feature A of a certain sample is 1, then according to the splitting condition judgment of each non-leaf node, it can be determined that the sample falls into the leftmost leaf node, then the score value of the sample is 1. It should be noted that Figure 1 What is shown is a simple decision tree model. The decision tree model actually used may not generate the judgment conditions of non-leaf nodes based on only one feature, but may also complete the classification or scoring of samples through multiple trees at the same time.

[0044] There are many training methods for tree models, generally including gradient boosting decision tree (GBDT), extreme gradient boosting tree (XGBoost), etc. GBDT will be briefly introduced here. GBDT is an iterative decision tree algorithm that combines gradient boosting and decision tree algorithms. Multiple decision trees are trained iteratively, and each decision tree is trained on the residual (the difference between the predicted value and the actual value) of the previous tree. During the training process, the structure and parameters of each decision tree are continuously optimized by the gradient boosting method to minimize the loss function of the model. In the prediction stage, the prediction results of multiple decision trees are summed or weighted averaged to obtain the final prediction result. Gradient decision trees are usually used to solve regression and classification problems. For example, a tree model can be trained to classify the financial credit risk of users, so as to quickly identify users with credit risks (such as fraud risks).

[0045] To jointly train the tree model with privacy protection, the participants (two examples are used here) are generally required to determine the common samples, that is, the intersection samples. Specifically, each participant generally holds the primary key and feature value corresponding to each training sample, and different participants hold different feature values. The two participants can determine the intersection samples with the same primary key based on the primary key.

[0046] Among them, the primary key is the identification information that can distinguish different training samples. For example, in the scenario of classifying the financial credit risk of users, the primary key can be the user's identity information, mobile phone number, etc., which can uniquely distinguish the user. Different participants hold different feature values. For example, in the scenario of classifying the financial credit risk of users, one participant can hold the transaction data between the user and other users, and another participant can hold the user's friend information, such as which user has a friend relationship with him.

[0047] As for the method of determining the intersection sample, it is generally determined by the PSI method. PSI can ensure that the non-intersection primary key information is not leaked. After PSI is executed, the two participants can determine the primary key information of the intersection sample, and the two participants can further jointly complete the training of the tree model based on the intersection sample.

[0048] Although the above method can protect the non-intersection primary key information, the primary key information of the intersection samples needs to be disclosed during the training process. With the further development of privacy protection, there is a need in related technologies to conduct more secure joint modeling privacy computing under the conditions of anonymizing the primary key information of the data and encrypting the entire data process. For example, the two parties are a bank and a company that provides application services. The application is an anonymous application. If the intersection primary key information is disclosed, the bank may know that the user corresponding to the intersection primary key has registered the application, which may lead to user privacy leakage.

[0049] Based on this, the present specification provides a joint training method for a tree model, which is applied to a first party. The first party and another participating party, the second party, respectively hold samples including a first feature and a second feature. First, the first slice of the feature value corresponding to the second feature of the intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary mark value are obtained by jointly executing the anonymized primary key privacy intersection and the anonymized primary key privacy bucketing protocol with the second party. The bucket boundary mark value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket. And receive the second slice of the bucket number and the second slice of the bucket boundary mark value corresponding to the second feature of the intersection sample sent by the second party, and perform secret sharing decryption based on this to obtain the bucket number and bucket boundary mark value corresponding to the second feature of the intersection sample. Further receive the homomorphic ciphertext of the second slice of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the feature value of the intersection sample based on the homomorphic ciphertext of the second slice of the feature value and the homomorphic sum of the first slice. Finally, the bucket threshold homomorphic ciphertext corresponding to each bucket is determined based on the bucket number of the second feature of each intersection sample, the bucket edit mark value, and the homomorphic ciphertext of the feature value. The second party uses the intersection sample to calculate the derivative value, bucket accumulation, and the gain value to calculate the split point. After determining the bucket number corresponding to the split point, the bucket threshold homomorphic ciphertext corresponding to the bucket number can be obtained, and the leaf node weight value is calculated based on the homomorphic ciphertext.

[0050] Through the above method, on the basis of obtaining the feature value sharding, bucket number sharding and bucket boundary mark value sharding corresponding to each feature of the intersection sample based on the anonymous primary key privacy intersection and anonymous primary key privacy bucketing protocol, the bucket threshold ciphertext extraction can be completed without leaking the primary key information and other privacy information, and the tree model training can be completed based on the bucket threshold, thereby realizing the tree model training based on the anonymous primary key.

[0051] Next, the method shown in this specification is described.

[0052] For ease of understanding, here we will first briefly explain the training method of the tree model. The training process of the tree model is generally divided into six steps: feature sorting and bucketing, derivative calculation, bucket accumulation, gain value and split point calculation, sample division, and leaf node weight calculation.

[0053] Feature sorting and bucketing, that is, sorting samples according to the size of the eigenvalue, and determining the bucket corresponding to each sample according to the size of the eigenvalue. Different buckets correspond to different eigenvalue size ranges. By bucketing the eigenvalues, the efficiency of model training can be improved. For example, after the features are bucketed, the subsequent training process can determine the size relationship of the eigenvalues ​​in units of buckets, which facilitates the calculation of the gain value (the specific calculation process is described later). And when calculating the split point, the split point can be selected from each bucket threshold instead of traversing all possible values ​​of the eigenvalue to determine the split point.

[0054] In addition, when a sample has multiple types of features, it is necessary to divide the sample into buckets according to the feature values ​​of different features, and determine the buckets corresponding to each feature value of the sample. For example, if the first feature value of the sample is 1, it is divided into bucket numbered 1, and if the second feature value of the sample is 10, it is divided into bucket numbered 10.

[0055] Through bucketing, we can get the bucket numbers corresponding to each sample. Each bucket corresponds to a unique bucket number, and the bucket numbers corresponding to different types of features do not overlap. For example, if a sample has m features, and each feature is divided into b buckets, then there are a total of m*b buckets, and the bucket numbers corresponding to each bucket in the m*b buckets do not overlap. For example, the first type of feature corresponds to the bucket numbered 1-b, the second type of feature corresponds to the bucket numbered b+1-2b, and so on.

[0056] After the bucketing is completed, each tree can be trained. As for the number of trees, multiple trees can be determined in advance, and each tree can be trained sequentially. In order to reduce the occurrence of overfitting, it is also possible to first train a tree based on the sample, and then use the residual of the tree to train the next tree until the residual is less than a certain value. When training each tree, the depth of the tree can be pre-specified.

[0057] The training process for the tth tree specifically includes:

[0058] 1. Determine the derivative value of each sample by derivatizing the loss function.

[0059] For ease of understanding, the derivation formula in XGBoost is first explained. It should be noted that the method of this specification can be used not only in XGBoost, but also in the training of tree models such as GBDT. Here, XGBoost is used as an example for explanation, which does not limit this specification.

[0060] The objective function can be expressed as formula (1):

[0061]

[0062] in, is the loss function, which is used to measure the quality of the model prediction results, Ω(f t ) is a regular term used to reduce the degree of overfitting of the model. n is the total number of samples involved in training, y i is the label of sample i, is the prediction result of the first t-1 trees, which is a constant value. t (x i ) is the variable to be confirmed, that is, the prediction result of the tth tree in the current training for the sample. γ,λ are hyperparameters, T is the tree f t The number of leaf nodes, w j is the weight value of the jth leaf node.

[0063] In the binary classification problem, the loss function l uses log loss, and the specific formula is shown in formula (2):

[0064]

[0065] By differentiating the loss function, we can obtain the first-order derivative value g and the second-order derivative value h of the function, as shown in formula (3):

[0066]

[0067] 2. For each non-leaf node, perform bucket accumulation, use the gain value to determine the split point and sample division.

[0068] (1) According to the sample partitioning result of the parent node of the non-leaf node, determine the samples that fall into the non-leaf node. And use the derivative values ​​of the samples that fall into the non-leaf node to determine the derivative cumulative values ​​corresponding to each bucket. That is, for each bucket, for the samples that belong to the bucket and fall into the current non-leaf node, add up the derivative values ​​of these samples to obtain the derivative cumulative values ​​corresponding to each bucket. The derivative cumulative values ​​here include the first-order derivative cumulative value and the second-order derivative cumulative value. That is, we can get:

[0069]

[0070] Among them, G j is the cumulative value of the first-order derivative corresponding to the bucket numbered j, H j is the cumulative value of the second-order derivative corresponding to the bucket numbered j. The reason for calculating the cumulative value of the derivative will be explained below.

[0071] (2) Using the information gain method, determine the gain value corresponding to the bucket threshold of each bucket, and determine the maximum gain value. The bucket threshold of the bucket corresponding to the maximum gain value is used as the split point.

[0072] Next, the derivation of the gain value calculation formula will be explained.

[0073] We need to train the objective function towards the trend of gradient descent, and we need to approximate it according to the trend of the derivative. For the loss function, we can As x+Δx in Taylor expansion. According to Taylor expansion, And g i To use the loss function Find the first-order partial derivative, h i To use the loss function Find the second-order partial derivative. Therefore, by removing the constant value in the objective function, the objective function can be expanded into formula (5):

[0074]

[0075] in, Represents the weight value of the leaf node where the i-th sample falls in the tree model.

[0076] because With w j There is a corresponding mapping relationship: I j =i|q(x i ) = j, that is, sample x i It will eventually be classified into the jth leaf node (through I j Convert the traversal on the sample to the traversal on the leaf node), so that Obj (t) It is only related to the leaf nodes of the tree to be constructed. Since n>>T (T is the number of leaf nodes), there are a large number of repeated w values. Therefore, we use the derivative accumulation values ​​G and H obtained by formula (4) to merge these identical w values ​​and further update Obj (t) ,get:

[0077]

[0078] Formula (6) can be viewed as T equations about w j A quadratic function of one variable. Since the coefficient of the quadratic term (H j +λ)>0, therefore, each leaf node is When taking the minimum value, we can get:

[0079]

[0080] According to formula (7), the final leaf node weight value range is related to the structure and node distribution information. Next, we will explain how to construct the tree structure, that is, how to determine the split point of the tree model.

[0081] In the related art, split finding refers to determining the splitting features and splitting thresholds of each node when building a decision tree to maximize the prediction accuracy of the model. The calculation of the splitting point is usually performed by measuring the change in purity or impurity of the node after the split. Indicators such as the Gini coefficient, information gain, or mean square error are usually used to evaluate the selection of the splitting point. The feature that reduces the impurity the most and the corresponding splitting point are selected as the splitting point. This is a better split for a single cut.

[0082] Next, the split point calculation method based on information gain will be explained.

[0083] In order to reduce the cost of trying to construct the tree structure, a greedy algorithm is used to initialize a tree with only one root node, and then traverse each leaf node according to The magnitude of the decrease (i.e. enumerate the current node splitting situation to obtain the maximum gain value), determine the splitting point, and expand the tree structure one by one. Therefore, as shown below, the Gain value formula (8) after the previous node split can be determined by subtraction:

[0084]

[0085] Among them, G L and G R Respectively represent the sum of the derivative values ​​of samples whose eigenvalues ​​are less than or equal to and greater than the splitting threshold of the splitting point.

[0086] The Gain values ​​corresponding to each bucket threshold can be calculated, and the largest one can be selected as the split point corresponding to the non-leaf node.

[0087] 3. For each leaf node, use formula (7) to calculate the weight value of the leaf node.

[0088] In this way, the tree model can be trained.

[0089] After briefly explaining the training process of the tree model, we will then explain how two parties can jointly train the tree model when the primary key is anonymized.

[0090] The present specification provides a tree model joint training method, which is applied to a first party. The method also involves a second party. The first party and the second party respectively hold samples including a first feature and a second feature. The first party and the second party jointly complete the training of the tree model using the samples they respectively hold.

[0091] Among them, the first feature and the second feature may be features of different types. In addition, the number of types of the first feature may be more than one, and similarly, the second feature may also include features of multiple types. For example, in the scenario of classifying the financial credit risk of users, the first feature may include: the number of transactions between the user and users with low financial credit risk, the number of large transfers by the user, etc. The second feature may include: the number of users with low financial credit risk among the user's friends, the number of chats between the user and users with low financial credit risk, etc.

[0092] In addition, the first party and the second party may also hold the primary key corresponding to each sample. The meaning of the primary key is detailed in the previous article and will not be repeated here. In order to complete the training of the tree model, either the first party or the second party may also have the label value corresponding to the sample.

[0093] like Figure 2 As shown, Figure 2 1 is a schematic diagram of a tree model joint training method according to an exemplary embodiment of the present specification, comprising the following steps:

[0094] Step 201, obtain multiple intersection samples by performing an anonymous primary key privacy intersection jointly with the second party, and obtain the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary mark value by performing an anonymous primary key privacy bucketing protocol jointly with the second party.

[0095] The bucket boundary mark value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket.

[0096] Specifically, the anonymous primary key privacy intersection method in the relevant technology can be used to obtain each intersection sample, and the anonymous primary key privacy bucketing protocol can be used to bucket the intersection samples to obtain the bucketing information of each feature of each intersection sample.

[0097] Among them, Circuit-PSI is a method to obtain intersection samples without disclosing the intersection key to the participating parties. Specifically, Circuit-PSI is based on PSI and further requires that when extracting intersection information, the primary key information of the intersection part needs to be further protected.

[0098] A method for private intersection of anonymized primary keys in related technologies is to use a Cuckoo hash table to reduce the number of intersection data required for comparison, and keep the intersection result as ciphertext through privacy comparison, and use the ciphertext information of whether all positions on the Cuckoo hash table are intersections as the output result of private intersection of anonymized primary keys. It should be noted that the above-mentioned example of private intersection of anonymized primary keys does not represent a limitation on this specification.

[0099] Anonymous primary key privacy feature bucketing is a protocol that completes feature secret bucketing and outputs the secret shared bucket number in a scenario where the data party does not know the data intersection and the feature value is ciphertext.

[0100] A method of an anonymous primary key privacy bucketing protocol in the related art is specifically: obtaining a first intersection result corresponding to a first data set held by a first party; wherein the first intersection result is an intersection result obtained by performing PSI calculation on a data identifier contained in the first data set held by the first party and a data identifier contained in a second data set held by a second party of the at least two parties; the first intersection result includes first intersection results corresponding to each data identifier contained in the first data set; the first intersection result corresponding to any data identifier in the first data set includes at least two secret slices obtained by splitting the PSI calculation result corresponding to the data identifier based on a secret sharing algorithm; the at least two secret slices include the first secret slice held by the first party. According to the size relationship of the characteristic values ​​corresponding to each data identifier contained in the first data set, the held first secret slices are sorted to obtain a first sequence composed of the sorted first secret slices. The prefix sum corresponding to each first secret slice contained in the first sequence is calculated; and based on the PSI calculation results corresponding to each data identifier in the first data set, the target number of data identifiers contained in the first data set and the data identifiers contained in the second data set held by the second party is determined to have an intersection. Based on the target number and the preset number of buckets, the prefix sum corresponding to each first secret shard contained in the first sequence is mapped to a first bucket number shard held by the first party, so as to locally complete the feature bucketing of the feature values ​​corresponding to each data identifier contained in the first data set; the first bucket number shard is one of the bucket numbers to which the feature values ​​corresponding to each data identifier contained in the first data set belong, and is a bucket number shard held by the first party. It should be noted that the above example does not represent a limitation on this specification.

[0101] Through the above-mentioned private intersection of the anonymized primary key and the private bucketing protocol of the anonymized primary key, the bucketing information of the feature value corresponding to each sample can be obtained. The bucketing information exists in the form of secret sharing shards.

[0102] Secret sharing is also called secret splitting or secret sharing. The basic principle is to split the secret into multiple shares, also called shards, and give them to different people for safekeeping. Only when more than a threshold number of people merge their shares can the secret be recovered; no information about the secret can be recovered from shares less than the threshold number. In privacy computing, the threshold number is usually the same as the number of participants.

[0103] In the secret sharing scenario, for the second feature, the bucket information obtained by the first party includes: the first slice of the feature value, the first slice of the bucket number, and the first slice of the bucket boundary marker value. It should be noted that these three first slices are not the same slice, and the first and second are used here to distinguish which party the corresponding slice belongs to. It can be understood that, correspondingly, the second party also obtains the second slice of the feature value corresponding to the second feature of the intersection sample, the second slice of the bucket number, and the second slice of the bucket boundary marker value.

[0104] Next, each bucket information will be described in detail. The eigenvalue included in the bucket information is the eigenvalue corresponding to the second feature. The bucket number can represent the eigenvalue range corresponding to the eigenvalue of the second feature of the sample. For the specific description of the bucket number, please refer to the previous text and will not be repeated here. The special bucket boundary mark value is used to indicate whether the eigenvalue of the intersection sample is the bucket threshold of the corresponding bucket. For example, the bucket boundary mark value can take 0 and 1. When it takes 0, it means that the eigenvalue is not the bucket threshold corresponding to the bucket. When it takes 1, it can indicate that the eigenvalue is the bucket threshold corresponding to the bucket. The bucket threshold can be the smallest eigenvalue in the bucket. Alternatively, the bucket threshold of each bucket can also be the largest eigenvalue in the bucket.

[0105] It should be noted that Figure 2 The method for extracting the bucket threshold corresponding to the second feature is used for illustration. In an optional embodiment, the first party and the second party in the present application can also use a similar method to obtain the bucket threshold corresponding to the first feature. Specifically, in step 201, in addition to obtaining the bucket information corresponding to the second feature, the first party can also obtain the bucket information corresponding to the first feature, that is, the first slice of the feature value, the first slice of the bucket number, and the first slice of the bucket boundary mark value.

[0106] Corresponding to step 201, the second party can also obtain the second slice of the feature value corresponding to the first feature of the intersection sample, the second slice of the bucket number and the second slice of the bucket boundary mark value through anonymous primary key privacy intersection and anonymous primary key privacy bucketing.

[0107] In the case where the first party and the second party each have bucket information corresponding to the first feature and the second feature, the bucket information owned by the first party and the second party can be presented in the form of a matrix. Next, the bucket information owned by the first party and the second party will be described through a specific implementation method, and the following specific example does not limit this specification.

[0108] For the convenience of explanation, angle brackets are used in this manual. <x>Indicates that the current variable X is encrypted by secret sharing, and P A and P B Hold secret sharing shards separately <x> A and <x> B .

[0109] Specifically, in an optional implementation, the first party P A and the second party P B A sample set with different characteristics, where P A Own A feature (i.e. the first feature), P B Own m B feature (i.e., the second feature) and label information Y. Figure 3 As shown in Figure 2, the two parties can obtain the secret share matrix output by the full anonymous bucketing protocol after jointly calculating (i.e., anonymous primary key privacy intersection and anonymous primary key privacy bucketing) through secret sharing. <d>= <B1||U1||X1||...||B m ||U m ||X m ||Y>, the matrix consists of n rows and 3m+1 columns. n is the total number of intersection samples, m=m A +m B is the total number of features. i >The shard representing the bucket number of the i-th feature, i >Shards representing the bucket boundary marker values ​​for the i-th feature, <X i > represents the slices of the eigenvalues. The first 3m columns of the matrix represent the slices of the bucket numbers, the slices of the bucket boundary marker values, and the slices of the eigenvalues ​​corresponding to each feature. The last column is the slice of the label value <y>. || represents the connector of each column of data in the matrix.

[0110] In addition, the value of i in the matrix is ​​1-m A When , the corresponding fragment is the fragment corresponding to the first feature, that is, the first party P A The shards corresponding to the features possessed, correspondingly, i takes the value of m B When the value is , the corresponding fragment is the fragment corresponding to the second feature, that is, the second square P B The shards corresponding to the features owned.

[0111] Each row in the matrix corresponds to an intersection sample, and every 3 columns correspond to a feature. For example, for the first square P A For the first row of the matrix held, the first three elements represent: the first slice of the bucket number corresponding to the feature numbered 1 in the first feature of the first intersection sample, the first slice of the bucket boundary mark value, and the first slice of the feature value.

[0112] In addition, b is used here to represent the number of buckets corresponding to each feature, so all features correspond to m*b buckets in total. The bucket number can be 1-m*b, where the bucket number corresponding to the feature numbered 1 is 1-b, and so on.

[0113] After obtaining the bucket data of the anonymized primary key intersection sample to be processed, it is necessary to extract the bucket data, that is, extract the ciphertext information of the bucket threshold corresponding to each bucket. The bucket data extraction corresponds to steps 203-207. Next, steps 203-207 will be described in detail.

[0114] Step 203, receiving the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and performing secret sharing decryption based on it and the first slice of the bucket number and the first slice of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample.

[0115] Specifically, the first party will perform secret sharing and decryption on the bucket number and bucket boundary marking value of the second feature corresponding to each sample (that is, the feature held by the second party). In this way, the first party can use the bucket number and bucket boundary marking value of the second feature of each sample to determine which intersection sample's feature value is the bucket threshold of the corresponding bucket, thereby extracting the bucket threshold plaintext corresponding to each bucket in step 207.

[0116] Specifically, for each intersection sample, since the first party already has the first slice of the bucket number corresponding to the second feature of the intersection sample, after obtaining the second slice of the bucket number corresponding to the second feature of the intersection sample, the first slice and the second slice can be used for secret sharing decryption. Similarly, the bucket boundary marker value corresponding to each intersection sample can also be secret shared decryption.

[0117] It should also be noted that since the second feature is a feature held by the second party, even if the first party obtains the bucket boundary markers and bucket numbers corresponding to the second feature of each sample, it cannot obtain any additional information (such as the primary key of the intersection sample, the characteristic value of the second feature, etc.) based on the bucket boundary marker values ​​and bucket numbers. Therefore, here we choose to let the first party assist the second party in extracting the bucket numbers and bucket boundary marker values ​​of each sample, and this process can protect data privacy.

[0118] Among them, in order for the first party to determine which shards the received data corresponds to respectively held locally, the second party can transmit the second shards of the bucket numbers of the second features of each intersection sample in the form of a matrix or array, so that the corresponding first shards can be determined according to the positions of each second shard in the matrix or array. In addition, after determining the intersection samples, the intersection samples can be renumbered, and the correspondence between the shards can be identified based on the number, such as the shards of the bucket numbers corresponding to the first intersection sample. Although the number is also identification information, the original primary key of the sample generally includes an identifier that can uniquely identify a sample (such as a mobile phone number, etc.), and the above renumbering does not disclose any data privacy.

[0119] Here, the specific example mentioned in step 201 will be used for further explanation. B from <d> B Extract the fragments and send it to P A .P A Use the received fragments and the corresponding fragments you hold locally Perform secret sharing decryption. Figure 3 As shown, P A After decryption, we can get the intersection sample m B The bucket number of the second feature and bucket boundary marker values

[0120] Correspondingly, similar operations can be performed here so that the second party can obtain the bucket number and bucket number label value of the first feature of each intersection sample.

[0121] Specifically, P A from <d> A Extract the fragments and send it to P B .P B Use the received fragments and the corresponding fragments you hold locally Perform secret sharing decryption. Figure 3 As shown, P B By decrypting, we can get the first m A The bucket number of the intersection data features and bucket boundary marker values

[0122] Step 205: Receive the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue.

[0123] Specifically, the first party may determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample according to the homomorphic ciphertext of the second shard of the eigenvalue and the homomorphic sum of the first shard.

[0124] First, let's explain homomorphic encryption. Homomorphic encryption is an encryption method commonly used in privacy computing. Compared with ordinary encryption, homomorphic encryption has the property of homomorphism, that is, it can perform calculations on encrypted data. For example, by performing homomorphic addition operations on the homomorphic encrypted ciphertext [a] of a and the unencrypted data b, the ciphertext [a+b] of a+b can be obtained, and a, b, or a+b will not be leaked during the operation, and the decryption key does not need to be used.

[0125] The above homomorphic sum, i.e., the homomorphic ciphertext of the second shard, is the result of homomorphic addition operation with the first shard. In addition, the homomorphic addition operation does not directly sum the plaintext and the ciphertext, but obtains the homomorphic sum through another operation method that is equivalent to adding the plaintext corresponding to the two data and then encrypting it.

[0126] As for the specific encryption key, in order to prevent privacy leakage, the homomorphic ciphertext of the second shard can be encrypted by the public key of the second party. According to the characteristics of asymmetric encryption, the homomorphic ciphertext can only be decrypted by the private key of the second party. Therefore, even if the first party obtains the homomorphic ciphertext of the second characteristic eigenvalue of each intersection sample, it cannot decrypt it, and no privacy will be leaked in the above process.

[0127] The above specific embodiments are still used for description.

[0128] For the sake of convenience, this specification uses brackets [X] to indicate that a variable is homomorphically encrypted. A The A in the upper right corner indicates that the ciphertext is P A The public key encryption, the corresponding private key belongs to P A , only P A The ciphertext can be decrypted. Correspondingly, [X] B The B in the upper right corner indicates that the ciphertext can only be obtained by P B Decrypt it.

[0129] Specifically, P B from <d> B Extract the fragments Obtained using homomorphic encryption and send it to P A .P A Use the received fragments and the corresponding fragments you hold locally Perform homomorphic addition operations to obtain ciphertext under homomorphic encryption only

[0130] Correspondingly, the first party can also homomorphically encrypt the first shard of the feature value corresponding to the first feature of each intersection sample held by itself, and send it to the second party. The second party uses the homomorphic ciphertext of the first shard and the homomorphic sum of the second shard to obtain the homomorphic ciphertext of the feature value corresponding to the first feature of each intersection sample.

[0131] Specifically, P A from <d> A Extract the fragments Obtained using homomorphic encryption and send it to P B .P B Use the received fragments and the corresponding fragments you hold locally Perform accumulation operation to obtain the ciphertext under homomorphic encryption only

[0132] The above process is as follows Figure 3 As shown, the first party and the second party respectively hold the homomorphic ciphertext of the feature value of the feature held by the other party.

[0133] Step 207, determining the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample.

[0134] Specifically, through step 203, the first party can determine the bucket number and bucket boundary marking value corresponding to the second feature of each intersection sample. Through step 205, the first party can obtain the characteristic value homomorphic ciphertext corresponding to the second feature of each intersection sample. Then the first party can traverse the bucket numbers of each sample, and determine the bucket boundary marking value in the intersection samples corresponding to each bucket to represent the sample whose characteristic value is the corresponding bucket threshold, and use the characteristic value homomorphic ciphertext of the determined sample as the bucket threshold homomorphic ciphertext corresponding to the bucket.

[0135] The above specific example is still used for illustration. A according to and You can get the following m B The position of the bucket boundary marker value corresponding to the second feature in the above eigenvalue matrix. Then, we can extract The homomorphic ciphertext value at the corresponding position in is used as the homomorphic ciphertext of the bucket threshold of the corresponding bucket Among them, each S j The size of the array is b, which is the number of buckets corresponding to the feature.

[0136] Correspondingly, the second party can also obtain the bucket threshold homomorphic ciphertext of each bucket of the first feature based on the bucket number and bucket boundary mark value of the first feature of each intersection sample obtained by secret sharing decryption, as well as the homomorphic ciphertext of the feature value.

[0137] Specifically, P B according to and You can get the first m A features, each bucket number corresponds to the bucket and its position in the feature value array, and then extract The ciphertext value at the corresponding position in is used as the secret share of each bucket threshold Each array S i The size of is b.

[0138] The above steps 203-207 provide a tree model training method that allows the non-feature party to extract bucket information for efficient auxiliary calculation. Specifically, for the second feature held by the second party, the first party extracts the ciphertext of the corresponding bucket threshold. In this way, in the above process, the second party cannot know any information about the second feature of the intersection sample. Even if the first party obtains the bucket number of the second feature of each intersection sample (that is, the distribution information of the sample is known), since the first party cannot know the distribution data of the eigenvalue of the second feature, it cannot obtain any privacy data. The eigenvalue of the second feature held by the first party is also protected by homomorphic encryption to protect data privacy.

[0139] In addition, the above method also provides a batch ciphertext element extraction method based on homomorphic encryption and secret sharing ciphertext conversion technology. The above process can be abstractly regarded as a batch anonymous query (Private Information Retrieval, PIR) in the secret sharing ciphertext array. The above method can perform unlimited secure extraction operations. This method makes the data holder unaware of the position of the extracted or queried element in the array (that is, the second party cannot know the position of the bucket threshold in the eigenvalue array), and the extracting party cannot know the plaintext information of the extraction result (that is, the information of the eigenvalue and bucket threshold). Specifically, the homomorphic encryption extraction table is initialized in step 205, and the bucket boundary value fragmentation is extracted in step 207 through this method. In an optional implementation, in a subsequent process, the homomorphic ciphertext of the above bucket threshold can be converted to a secret sharing protocol through homomorphic encryption, the corresponding fragmentation is output, and the information of the split point is extracted. The specific implementation method of this example will be described in detail below.

[0140] Next, a method of using the bucket threshold homomorphic ciphertext to train the tree model after extracting the bucket threshold homomorphic ciphertext will be described, see steps 209 to 211 for details.

[0141] Step 209: Utilize the multiple intersection samples and jointly perform joint training of the tree model with the second party to determine the split point of each non-leaf node in the tree model.

[0142] The split point is indicated by the bucket number of the feature.

[0143] As mentioned above, after completing the bucketing, the derivatives of multiple intersection samples can be calculated, and for each non-leaf node, the bucket accumulation corresponding to the non-leaf node can be calculated, and the gain value and split point can be calculated using the bucket accumulation.

[0144] Specifically, the above process may be similar to the execution method in the related art. Here, step 209 will be described through an embodiment, and this example does not limit this specification.

[0145] 1. Initialize the prediction value array.

[0146] The initialized prediction value array is the initial prediction value of each sample when no tree model processes the sample. For non-first trees, the prediction value used by the tree to calculate the derivative value can be obtained based on the prediction value results of the previous trees, but for the first tree, its prediction value needs to be initialized.

[0147] As for the specific initialization method, it is simple to directly initialize the prediction value array to an array of all 0s. In addition, it can also be: the label holder initializes the prediction value array according to the distribution of the prediction values ​​of all samples.

[0148] After initializing the prediction value array, the prediction value array can be converted into the secret sharing shards held by the first party and the second party respectively, to facilitate subsequent calculations.

[0149] Using the above specific embodiment, the step may be: B Initialize the prediction array And encrypt it through secret sharing into a secret shard held by both parties The above steps also correspond to Figure 3 The two parties in the above example obtain the label value fragment, and the second party P B Initialize the prediction value.

[0150] 2. Here we will use the training process of the kth tree to illustrate.

[0151] (1) The derivative value of the intersection sample is calculated jointly with the second party to obtain a derivative value slice of each intersection sample; the derivative value is calculated according to the loss function of the tree model.

[0152] That is, using the prediction results of the first k-1 trees and the label value shards, and using the gradient derivation formula in formula (3), we calculate the shards of the first-order derivative value g and the second-order derivative value h corresponding to each intersection sample.

[0153] The prediction results of the first k-1 trees here, when k is greater than 1, can be the slices of the prediction values ​​obtained by predicting the first k-1 trees for each intersection sample after training. When k is 1, the prediction result can be the prediction value array initialized in 1.

[0154] The reason why the prediction results and label values ​​used above are in the form of shards is that the method of this specification shows a method for the first party and the second party to jointly train the tree model. In this scenario, in order to protect data privacy, the prediction values ​​and label values ​​are generally split into secret sharing shards held by both parties.

[0155] Correspondingly, the first-order derivative value g and the second-order derivative value h are also the data obtained by joint calculation by both parties using the multiplication and division operations of secret sharing in the secret sharing scenario. The first-order derivative value g and the second-order derivative value h obtained by both parties also exist in the form of shards. As the definitions of the first-order derivative value and the second-order derivative value show, the size of the label value can be inferred from the first-order derivative value and the second-order derivative value, especially in the process of processing the first tree. Therefore, encryption in the form of secret sharing can protect data privacy.

[0156] Specifically, continuing with the above example, the steps can be: both parties use And the gradient derivative formula g = σ(p k )-y,h=(1-σ(p k ))·σ(p k ), in the secret sharing scenario, the derivative value is calculated { <g i >, <h i >} i∈[1,n] This step corresponds to Figure 3 In the red dotted box, the content of the middle box is derived through sigmoid according to the prediction value sharding and label value sharding held by both parties to obtain the first-order derivative value array and the second-order value array corresponding to the k-th tree. Figure 3 In the figure, the red line in the bottom box connects the steps, that is, the prediction value array used in this step is obtained based on the prediction value calculated by the k-1th tree. Figure 3 The boxes on both sides represent local computations by the two parties, while the box in the middle represents joint computations by the two parties.

[0157] in That is, the predicted value of the first k-1 trees, and the The meanings of other elements are as mentioned above and will not be repeated here.

[0158] It should be noted that this step does not involve the use of bucket information, and can be the same as the implementation method in the related art. The above example is only an optional implementation method and does not limit this specification.

[0159] (2) Optionally, to facilitate calculation, the sample distribution of the root node (i.e., the first node of the tree) can be initialized.

[0160] This sample distribution is equivalent to considering the root node as the previous node before the root node, and determining which intersection samples fall into the root node after the splitting condition of the previous node of the root node is processed. According to the definition of this sample distribution, the sample distribution of the root node can be initialized to data representing that all nodes fall into the current node.

[0161] For example, 1 indicates that an intersection sample falls into the current node, and 0 indicates that an intersection sample does not fall into the current node. The initialized sample distribution can be an array of all 1s.

[0162] Specifically, using the previous example, it can be P A Initialize the sample distribution of the root node locally is a vector of size n containing all 1s. Similarly, P B Initialize all 1 vectors of size n locally This corresponds to Figure 3 The two parties in the sample distribution are initialized.

[0163] This is because the sample distribution is needed to determine which samples fall into the current node when performing bucket accumulation in the subsequent steps. Initializing the sample distribution of the root node is similar to initializing the prediction value matrix. All non-leaf nodes can be processed by the same processing logic, which is convenient for training.

[0164] In addition, in an optional implementation, for the sample distribution of each node, the first party and the second party may jointly own the sample distribution in the form of "sharing with computational secrets".

[0165] Specifically, for the lth node, both parties hold These two arrays are the arrays of ciphertext. For the jth sample, Only when , can we determine that the jth sample falls into the lth node.

[0166] (3) For each (for example, the lth) non-leaf node, execute:

[0167] (3.1) The first party obtains the derivative value homomorphic ciphertext of the first intersection sample according to the secret sharing to homomorphic encryption protocol jointly executed with the second party. The first intersection sample is the intersection sample falling into the non-leaf node.

[0168] Correspondingly, the second party also executes a similar method to obtain the homomorphic ciphertext of the derivative value of the first intersection sample.

[0169] In the specific implementation, the derivative value homomorphic ciphertext corresponding to all intersection samples may be obtained. Specifically, the first party and the second party jointly execute the secret sharing to homomorphic encryption protocol to obtain the derivative value homomorphic ciphertext of each intersection sample respectively. The derivative value homomorphic ciphertext obtained by the first party can only be encrypted by the private key of the second party, and the derivative value homomorphic ciphertext obtained by the second party can only be decrypted by the private key of the first party.

[0170] As for the method of obtaining the derivative value homomorphic ciphertext corresponding to the first intersection sample in this step, since the split point will be used later to update the distribution of intersection samples corresponding to each node. And the first-order derivative value shards and second-order derivative value shards are updated by using the secret sharing product of the sample distribution and the shards of the first-order derivative value and the second-order derivative value. In this way, for any node, the derivative value of the intersection sample that does not fall into the node is set to 0. As a result, the derivative value shards of the same intersection sample may be different in different nodes, so this step needs to be performed once in each node.

[0171] In addition, as mentioned above, in the above steps, the sample distribution can be determined by the "sharing with computational secrets" method. In this case, the above method can ensure that: when neither party can obtain the exact sample where the intersection sample falls, the derivative value shard is updated, which is more secure.

[0172] Among them, the secret sharing to homomorphic encryption protocol can be that the second party first locally homomorphically encrypts the derivative value shards and sends them to the first party. The first party calculates the homomorphic ciphertext of the derivative value shards and the homomorphic sum of the derivative value shards held locally to obtain the derivative value homomorphic ciphertext of each intersection sample.

[0173] Here we still use the previous example to illustrate. B In local <g i > B , <h i ) B } i∈[1，n] Perform homomorphic encryption and obtain {[ <g i > B ] B , [ <h i > B ] B } i∈[1，n] and send it to P A .P A The local { <g i > A , <h i > A } i∈[1，n] and{[ <g i > B ] B , [ <h i > B ] B } i∈[1，n] Add together to obtain the ciphertext array of homomorphic encryption only {[g i ] B ,[h i ] B } i∈[1，n] The method for the second party to obtain the derivative value homomorphic ciphertext is similar to this one, so I will not go into details here. This corresponds to Figure 3 The A2H process in is the process of converting secret sharing into homomorphic encryption.

[0174] (3.2) Obtain the cumulative value of the derivative corresponding to each bucket.

[0175] The cumulative value of the derivative corresponding to each bucket, that is, the sum of the derivative values ​​corresponding to the bucket in the intersection samples falling into the node.

[0176] The specific acquisition method may be that the first party sends the bucket number of the second feature of each intersection sample obtained in the above step to the second party, and the second party locally performs derivative value slicing and accumulation on the bucket corresponding to the second feature according to the bucket number of the intersection sample and the sample distribution of each node. At the same time, the first party also accumulates the derivative value slicing on each bucket corresponding to the second feature according to the bucket number of the second feature of each intersection sample and the sample distribution of each node. In this way, for the second feature, the first party and the second party can simultaneously obtain the derivative cumulative value slicing of each bucket corresponding to the second feature.

[0177] The processing method for the first feature is similar and will not be repeated here.

[0178] In addition, the derivative cumulative value (the homomorphic ciphertext of the derivative cumulative value obtained here) can also be obtained by the method in the following example.

[0179] Considering the distribution of all samples owned by the second party, there is a possibility that the intersection samples may be inferred from the bucket numbers corresponding to the intersection samples. Therefore, in order to further improve security, it is also possible that: for each bucket corresponding to the second feature, the first party accumulates the derivative value homomorphic ciphertext of the first intersection sample belonging to the bucket, and obtains the derivative cumulative value homomorphic ciphertext corresponding to each bucket of the second feature. Correspondingly, the second party can also obtain the derivative cumulative value homomorphic ciphertext corresponding to each bucket corresponding to the first feature.

[0180] Specifically, for the samples determined to fall into the node in the sample distribution, the first party can perform homomorphic addition operations on the derivative value homomorphic ciphertexts of the intersection samples of each bucket according to the bucket numbers corresponding to the second features of each intersection sample obtained in the above steps to obtain the derivative cumulative value homomorphic ciphertexts of each bucket. The processing method of the second party is similar to this and will not be repeated here.

[0181] Still using the above example, the specific implementation of this step can be: A Initialize all 0 gradient bucket accumulation matrix Then, P A According to the bucket information and sample distribution information Will satisfy The corresponding j ] B ,[h j ] B Add to Among them, B i,j is the bucket number corresponding to the i-th feature of the j-th sample. Figure 3 The process by which the two parties in the secret sharing calculate the derivative cumulative value ciphertext [G] and [H].

[0182] It should be noted that when the sample distribution is represented by the ciphertext form of "sharing with computational secrets", It does not mean that the corresponding intersection sample falls into this node. However, since the derivative value sharding is updated by using secret sharing with calculation, However, if the jth intersection sample does not fall into the lth non-leaf node, the derivative value ciphertext corresponding to the intersection sample [g j ] B ,[h j ] B The plaintext is actually updated to 0. In this way, even if the ciphertext is accumulated with only the corresponding derivative cumulative value, it will not affect the correctness of the result of the bucket accumulation matrix.

[0183] (3.3) The splitting point is calculated using the cumulative value of the derivatives corresponding to each bucket.

[0184] The specific meaning of the split point is described in the previous section. Here, the information gain method is used as an example to illustrate the calculation method of the split point. The specific calculation and derivation process of the information gain method is shown in formula (8), which will not be repeated here.

[0185] Specifically, this step can be that both parties use the derivative cumulative value obtained in the example of 3.2 to slice and use the information gain method to jointly calculate the splitting point. This process is similar to the specific implementation process of the related technology and will not be repeated here.

[0186] In the case of obtaining the homomorphic ciphertext of the derivative cumulative value using the second example of 3.2, the step can be: according to the homomorphic ciphertext of the derivative cumulative value corresponding to each bucket, use the information gain method and jointly determine the splitting point of the non-leaf node with the second party; the second party has the homomorphic ciphertext of the derivative cumulative value of each bucket corresponding to the first feature.

[0187] The above process will be described in detail below.

[0188] In this example, although the derivative accumulation value homomorphic ciphertext is held, considering that the division operation of the homomorphic ciphertext is not easy to implement for the homomorphic ciphertext, the derivative accumulation value homomorphic ciphertext can be converted into the form of secret sharing shards. And using the four arithmetic operations such as multiplication and division of the secret sharing of the two parties, the gain value corresponding to each bucket is determined by combining formula (8). And based on this, the split point is determined.

[0189] In other words, the above process specifically includes: first, jointly executing the homomorphic encryption to secret sharing protocol with the second party to obtain the derivative cumulative value shards corresponding to each bucket.

[0190] The buckets obtained here may include: buckets corresponding to the first feature and buckets corresponding to the second feature.

[0191] The specific implementation method of the homomorphic encryption to secret sharing protocol can refer to the implementation method in the related art. Homomorphic encryption to secret sharing can complete the conversion of two encryption protocols without leaking specific plaintext. Here, the process of homomorphic encryption to secret sharing will be explained through a specific example, which does not limit this specification.

[0192] The first party has the homomorphic ciphertext of the first data. The two parties generate random numbers f1 and f2 respectively. The second party homomorphically encrypts f2 and sends the homomorphic ciphertext of f2 to the first party. The first party generates two secret sharing shards of f1 and sends the shards to the other party. For example, if the first party generates shard 1 and shard 2 of f1, it can keep shard 1 and send shard 2 to the second party.

[0193] The first party can calculate the homomorphic ciphertext of the first data, the homomorphic ciphertext of f2, and the homomorphic sum of f1, and send the homomorphic sum to the second party for decryption. The second party obtains the plaintext of the sum of the first data, f1, and f2. Furthermore, the second party can obtain the plaintext of the sum of the first data and f1 based on the plaintext of f2 held locally, which is referred to as the second data here. Furthermore, the second party can generate two fragments of the second data and send the corresponding fragments to the first party. Further, the two parties use the fragments of the second data held by each party, subtract the fragment of f1, and obtain the fragments of the first data held by each party.

[0194] The above example is still used to illustrate this step:

[0195] First, P A Using homomorphic encryption to convert secret sharing protocol, combined with P B Will Become a secret sharing shard held by both parties Similarly, both parties can also obtain the derivative cumulative value fragments of each bucket of the first feature This step corresponds to Figure 3 The H2A (Homomorphic Encryption to Arithmetic Secret Sharing) process is the process of obtaining the derivative accumulation value shard (also called derivative sum) of each bucket through the homomorphic ciphertext of the derivative accumulation value matrix held by both parties through the homomorphic encryption to secret sharing protocol.

[0196] Secondly, merge the two gradient bucket accumulation matrices (that is, the derivative accumulation value slices corresponding to each bucket) to obtain { <G i,q > , <H j,q >} i∈[1,m],q∈[1,b] .

[0197] Second, using the information gain method, the derivative cumulative value corresponding to each bucket is sharded, and the second party jointly performs secret sharing arithmetic operations to determine the gain value corresponding to each bucket.

[0198] The above specific example will be used here for further explanation.

[0199] Both parties use the decision tree calculation rules and the tree model gain value calculation formula in the MPC scenario Get the corresponding { <Gain i,q >} i∈[1,m],q∈[1,b] ,in This corresponds to Figure 3 In the case of <gl> 、 <gr> 、 <hl>, <hr> , and calculate the gain value <gain>process.

[0200] <gl>is the derivative value shard sum of the second intersection sample for the qth bucket of the i-th feature. The second intersection sample is: the intersection samples that fall into the non-leaf node, the intersection samples that belong to the bucket, and the intersection samples that belong to a number value less than the bucket. It can be understood as the derivative cumulative value shard of the intersection samples to the left of the bucket threshold corresponding to the bucket.

[0201] <gr>The meaning and <gl>Similar, no further elaboration is required here.

[0202] It should be noted that {(Gain i,q >} i∈[1,m],q∈[1,b] It is calculated jointly by both parties using secret sharing and four arithmetic operations, rather than being calculated locally by each party.

[0203] Third, the gain values ​​corresponding to each bucket are compared according to the secret comparison method to determine the split point of the non-leaf node.

[0204] Specifically, the maximum gain value among the gain values ​​can be determined according to the secret comparison, and the bucket threshold of the bucket corresponding to the maximum gain value is used as the split point of the leaf node. The split point specifically includes features and feature values.

[0205] Among them, the secret comparison can refer to the scheme of using secret sharing in the relevant technology to realize the comparison size of ciphertext. For example, a secret comparison scheme based on a garbled circuit, a secret comparison scheme based on the GMW (Goldreich-Micali-Wigderson) protocol, etc. In addition, when efficiency is more concerned, efficiency can also be improved by reducing the accuracy of the splitting point. Specifically. A bucket corresponding to a gain value can be randomly selected from several gain values ​​among several larger gain values ​​obtained through several secret comparisons as a splitting point. For example, there are 4 gain values ​​in total. After performing two pairwise comparisons, it is determined that the larger gain value between the first gain value and the second gain value is the first gain value, and the larger gain value between the third gain value and the fourth gain value is determined to be the fourth gain value, then a bucket corresponding to a gain value can be randomly selected from the first gain value and the fourth gain value, or through a specific selection logic, as the splitting point.

[0206] Here we will use the specific example in the previous article to illustrate this step. Specifically, both parties can use the privacy extreme value solution method to obtain { <Gain i,q >} i∈[1,m],q∈[1,nb] The secret shard of the bucket number corresponding to the maximum value<max_idx> .

[0207] In addition, after executing the above steps, it can also be determined whether the bucket corresponding to the split point is the bucket of the first feature or the bucket of the second feature. The above process will be described here through a specific embodiment, which does not limit this specification.

[0208] As described above, the split point can be indicated by the sharding of the bucket number, and the numbers of the buckets corresponding to each feature can be sequentially numbered, so it can be determined that the first number of numbers in the bucket number corresponds to the bucket of the first feature.

[0209] Then, by using the privacy comparison method jointly executed with the second party, the size relationship between the bucket number corresponding to the split point and the first quantity is determined by using the shards of the bucket number corresponding to the split point; when the split point is greater than the first quantity, the split point is determined to be the bucket number corresponding to the second feature. Correspondingly, when the split point does not exceed the first quantity, the split point can be determined to be the bucket number corresponding to the first feature.

[0210] The privacy comparison method can be found in the related art and will not be described in detail here.

[0211] Here, the above specific example will be used to describe this step.

[0212] As for the specific method, both parties can first determine the sharding and m of the split point through the privacy comparison method. A ×nb, thereby determining whether the feature of the split point is the first feature or the second feature.

[0213] Step 211, when the splitting point is the bucket number corresponding to the second feature, obtain the bucket threshold homomorphic ciphertext corresponding to the bucket number, and jointly determine the splitting condition corresponding to the splitting point according to the bucket threshold homomorphic ciphertext and the second party, and calculate the weight value of the leaf node based on this.

[0214] Specifically, since the bucket thresholds of each bucket of the second feature are held by the first party in the form of homomorphic ciphertext, the homomorphic ciphertext held by the first party can be used to determine the splitting point, determine the sample distribution of subsequent nodes of the node, and calculate the weight values ​​of the leaf nodes in subsequent steps.

[0215] Step 211 may include two steps: one is to generate the splitting condition of the non-leaf node of the tree model, that is, to update the sample distribution of the next node; the other is to calculate the weight value of the leaf node. The two processes will be described separately here.

[0216] The determination of the splitting conditions will be described here through two specific embodiments, which do not limit the present specification.

[0217] When the feature of the split point is the second feature, belongs to the second party, and both parties hold the fragments of the split point, the first implementation method may be:

[0218] In the tree model under the general MPC scenario, if the splitting condition corresponding to a non-leaf node is a feature of the second party, then the second party holds the splitting condition of that node. Therefore, the plaintext of the corresponding <max_idx> can be publicly disclosed to the second party here. That is, the first party sends the shards of <max_idx> to the second party, and the second party decrypts it. Further, according to max_idx = i × b + j, it is known that the splitting boundary of the first node is the j-th bucket of the i-th feature.

[0219] Furthermore, since the first party holds the bucketing thresholds of the second feature held by the second party, the second party can, through the oblivious transfer method, input max_idx and obtain the homomorphic ciphertext of the bucketing threshold corresponding to max_idx from the homomorphic ciphertexts of the bucketing thresholds of each bucket of the second feature held by the first party. Decrypt it using the private key held by the second party to obtain the corresponding splitting condition.

[0220] <max_idx> is less than m A The case of ×b is similar and will not be elaborated here.

[0221] In addition, considering that if the second party obtains the bucketing threshold corresponding to a specific bucket of the second feature, then there is a situation where the second party can, based on this bucketing threshold, reverse-infer which samples are intersection samples. For example, if the bucketing threshold of a certain bucket of a certain feature is 1, and only specific samples of the second party have a value of 1 for this feature, then it can be determined that this sample must be an intersection sample. Another example is that a certain feature is divided into 10 buckets in total, the bucketing threshold of the 5th bucket is 5 (which can be obtained according to max_idx), while all samples are bucketed according to all values of this feature, and the bucketing threshold of the fifth bucket may be 6, then it can be determined that some samples with relatively large feature values are not intersection samples, which may leak some information.

[0222] Therefore, a second implementation method is also proposed in this specification: Specifically, if <max_idx> is greater than m A ×b, if so, it means that this feature is the second feature, and the corresponding sample distribution information and bucketing thresholds are managed by the first party P A . <max_idx> can be publicly disclosed to P alone A , specifically, it can receive the shards of the bucketing numbers corresponding to the splitting points held by the second party sent by the second party, and perform secret sharing decryption on the bucketing numbers corresponding to the splitting points. Conversely, <max_idx> is publicly disclosed to P alone B . Combining Figure 3 , this step corresponds to Figure 3 the SS comparison (i.e., secret comparison) in to obtain <max_idx>, and the process of disclosing the splitting point to the party to whom the bucketing information of the splitting point belongs.

[0223] Assume P B Get the value max_idx, then P B We can know that the split boundary of the first node is the jth bucket of the i-th feature through max_idx=i×b+j. B The distribution of n samples with bucket number j as the boundary Update and determine the sample distribution information of the left and right child nodes 21 and 21+1 of the first node, that is, This corresponds to Figure 3 The two parties in the process update the sample distribution of their own nodes respectively. Since the bucket number of the split point is only disclosed to the second party, the first party updates the sample distribution stored locally according to the "sharing with computing secrets" method mentioned above.

[0224] Then extract the ciphertext of the bucket threshold corresponding to the first feature [S i,j ] A , and convert it into a secret sharing shard value <T k,l >, as the splitting threshold of the current node. This corresponds to Figure 3 The process of thresholding after splitting is shown.

[0225] In other words, the bucket threshold homomorphic ciphertext corresponding to the split point can be processed into bucket threshold shards through the homomorphic encryption-to-secret sharing protocol jointly executed with the second party, and the bucket threshold shards are used as the splitting condition of the non-leaf node. It should be noted that if both parties hold the plaintext of the split point, the bucket threshold shards can also be directly obtained through the homomorphic encryption-to-secret sharing protocol jointly executed with the second party to obtain the splitting condition of the lth leaf node.

[0226] Through the above steps, both parties finally obtain the split condition of the node, and <T k,l > and the corresponding feature number (plaintext or ciphertext). In this method, since the node splitting conditions are different from those in related technologies, it is also necessary to change the prediction method when using the tree model. For each node, two parties need to jointly predict.

[0227] Finally, after obtaining the bucket threshold of the split point (i.e., the split point threshold), both parties can jointly update the derivative value array based on their respective sample distributions. The specific description of this process can be found in the previous description of the derivative cumulative value array, which will not be repeated here. and The combination and calculation of <g l >Secret sharing product operation of arrays to obtain their respective <g 2l > Slice array. For <g 2l+1 >, according to <g l > and <g 2l >Secret sharing subtraction operation is performed to obtain. <h 2l > and <h 2l+1 The calculation method of > is similar to that of , which will not be described in detail. This step corresponds to the process of updating the derivative value array in the last joint calculation box in the blue dotted box.

[0228] Among them, although the second party can update according to the split point and However, since the split point of the node before this node may not be owned by the second party, and It is not possible to obtain the accurate situation of each intersection sample of the node. Therefore, it is necessary to use the first-party The updating of derivative values ​​is accomplished through joint execution of secret sharing and computation.

[0229] Next, the calculation method of the leaf node is explained. Specifically, it can be executed for the lth leaf node:

[0230] First, determine the intersection samples that fall into the leaf node, and the derivative value ciphertexts of these intersection samples. For the specific acquisition method, please refer to the description of the previous step. After obtaining the derivative value ciphertext of the leaf node, you can accumulate: the derivative value ciphertexts of each intersection sample that falls into the leaf node, get the derivative cumulative value corresponding to the leaf node, and use the derivative cumulative value to calculate the weight value of the leaf node.

[0231] It should be noted that in the privacy protection scenario of the anonymous primary key, if the intersection samples that fall on the current leaf node are leaked, there may be a possibility of leaking the intersection sample primary key information. Therefore, in order to protect data privacy, the above-mentioned accumulation of the derivative value ciphertexts of each intersection sample that falls on the leaf node can specifically obtain the derivative value ciphertext array updated above and accumulate all the values ​​in the derivative value ciphertext array. The length of the derivative value ciphertext array is equal to the number of intersection samples, and when updating the derivative value ciphertext array, according to the sample distribution, the derivative value plaintext of the intersection sample that does not fall into the current node is set to 0, so that even if all the contents of the derivative value ciphertext array are accumulated, it will not affect the accuracy of the final result. In this way, the accumulation of weight values ​​is achieved while ensuring privacy.

[0232] Here we will still use the above specific examples to illustrate:

[0233] The two parties obtained the <gl>and <h l > (here, refers to the,th leaf node), calculate the cumulative derivative value of the leaf node locally <g1>and <h1>, specifically, P A calculate <g1> A = ∑ i∈[n] <g l [i]> A sum <h1> A =∑ i∈[n] <h l [i]> A , P B calculate <g1> B = ∑ i∈[n] <g l [i]> B sum <h1> B =∑ i∈[n] <h l [i]> B .

[0234] Furthermore, the two parties jointly use secret sharing addition and division to calculate the { <g1> ， <h1>}Enter the leaf node weight ciphertext value calculation formula Get the leaf node calculation weight value

[0235] In addition, considering that for leaf nodes, the updated <g l > and <h l >Only participates in the calculation of leaf node weights and is not used in other steps. <g l > and <h l >A large number of secret sharing multiplication operations are required, specifically, the ciphertext of the calculated sample distribution needs to be combined with the parent node <g>and <h>Multiplication, while secret sharing is time-consuming, resulting in a waste of computing resources.

[0236] Therefore, this specification also provides another way to obtain the weight value for calculating the leaf node. The party that does not hold the parent node splitting point first confuses the derivative cumulative value slice array. And transmits it to the other party through inadvertent transmission, so that the other party obtains the obfuscated derivative cumulative value slice corresponding to the splitting point, and obtains the first slice based on the derivative cumulative value slice corresponding to the splitting point held locally and the obfuscated slice. The party that does not hold the splitting point uses the random number used during the obfuscation as the second new slice. The two parties jointly use the first new slice and the second new slice to calculate the weight value.

[0237] Specifically, the above process of calculating the weight value of a leaf node may include: based on the bucket number of the parent node splitting point, the first slice of the derivative cumulative value of the bucket threshold corresponding to the splitting point, and the derivative cumulative value slice array held by the second party, and jointly with the second party based on oblivious transmission, obtain the first new slice of the derivative cumulative value corresponding to the bucket threshold of the parent node splitting point; the derivative cumulative value slice array includes derivative cumulative value slices corresponding to multiple bucket thresholds used when calculating the splitting point, and the derivative cumulative value slice corresponding to each bucket threshold includes the sum of the derivative value slices of the intersection samples whose characteristic values ​​are less than or greater than the bucket threshold; the derivative value slice is obtained by jointly calculating the loss function of the tree model with the second party; using the first new slice, jointly perform the calculation of the weight value of the leaf node with the second party.

[0238] In the above oblivious transmission, the first party can input the corresponding bucket number, and the second party can input the obfuscated derivative cumulative value slice array, so that the first party can obtain the obfuscated derivative cumulative value slice corresponding to the bucket number.

[0239] It should be noted that the derivative cumulative value slice array mentioned here has a different meaning from the derivative cumulative value slice corresponding to each bucket calculated in the previous text. The derivative cumulative value slice corresponding to each bucket threshold here can include the left derivative cumulative value slice and the right derivative cumulative value slice. The left derivative cumulative value slice is the one mentioned in the previous text. <gl>, the right derivative cumulative value slice is the one mentioned above <gr>.

[0240] The obfuscation method mentioned above can be specifically obfuscated using random numbers. Specifically, when obtaining the first new shard, the specific steps performed by the first party include: taking the bucket number of the parent node split point as input, jointly performing multiple-choice oblivious transmission with the second party, and obtaining the shard data corresponding to the bucket number from the second party's multiple shard data; the second party's multiple shard data include the difference between each shard in the derivative cumulative value shard array and the first random number; and taking the sum of the first shard of the derivative cumulative value and the shard data corresponding to the bucket number as the first new shard.

[0241] Correspondingly, the process executed by the second party includes: generating a first random number and determining the difference between each shard in the derivative cumulative value shard array and the first random number; based on the difference between each shard in the derivative cumulative value shard array and the first random number, jointly with the second party based on inadvertent transmission, so that the second party obtains the first new shard; using the second random number as the third new shard, and jointly executing the calculation of the leaf node weight value with the second party.

[0242] When the second party holds the corresponding bucket number, the execution method is similar to the above, that is, the first party generates a second random number and calculates the difference between each slice in the derivative cumulative value slice array and the second random number. The second party uses the bucket number of the split point as the input of the oblivious transmission, and the first party uses the difference between each slice in the derivative cumulative value slice array and the second random number as the input of the oblivious transmission. The two parties jointly perform the oblivious transmission, and finally the second party obtains the third new slice, which is the difference between the derivative cumulative value slice corresponding to the bucket number of the split point held by the first party and the second random number. Then the first party uses the second random number as the fourth new slice, and the two parties jointly use the third new slice and the fourth new slice to calculate the weight value of the leaf node using the formula (7) above.

[0243] The first fragment, the second new fragment, the third new fragment and the fourth new fragment may include a new fragment of a first-order derivative value and a new fragment of a second-order derivative value, respectively. When calculating the split point, the first-order derivative value and the second-order derivative value may be combined for calculation. When obtaining the first new fragment of the first-order derivative value and the second-order derivative value, different random numbers may be used for confusion.

[0244] In addition, the above example involves the left derivative cumulative value slice and the right derivative cumulative value slice corresponding to the split point of the parent node. Taking the first-order derivative value as an example, the maximum gain value in the left derivative cumulative value slice gain value corresponding to >Gl> is used to calculate the weight value of the leaf node on the left side corresponding to the parent node. Correspondingly, the maximum gain value is calculated. <gr>Used to calculate the weight value of the leaf node on the right side corresponding to the parent node.

[0245] Still taking the first-order derivative value as an example, the first new fragment obtained by the above method can be the above <gl>The corresponding new shard can also be the above <gr>In addition, the first new fragment may also include the <gl>and the above <gr>Respectively corresponding new shards. In the first new shard, only the above <Gl> or the above <gr>In the case of the corresponding new shard, due to <gl>and <gr>The sum of the derivative values ​​of all intersection samples falling into the parent node is a shard, which is a fixed value. Therefore, the fixed value can be used to subtract the first new shard using a secret sharing subtraction operation to obtain a new shard for calculating the first-order derivative value of another leaf node.

[0246] Next, the above process will be described using the above specific embodiments.

[0247] First, assume that the split point of the parent node of the lth leaf node is P B Hold, then P B The formula for calculating the leaf node weight can be obtained directly through the max_idx obtained in the above steps In the required <g>and <h>exist{ <Gl i，q >, <Hl i，q >} i∈[1，m]，q∈[1，nb] In an optional implementation, d and max-idx may be the same.

[0248] Second, however, due to P A If the feature information and maximum gain value corresponding to the parent node are unknown, <Gl i，q >, <Hl i，q >} i∈[1，m]，q∈[1，nb] Therefore, both parties obtain the position of m*b choose 1 through the oblivious transfer protocol OT. <g>and <h>, both parties obtained <g>and <h>The corresponding third new fragment and the fourth new fragment respectively. Specifically, first P A Generate two random numbers rg and rh and calculate locally { <Gl i，q -rg> A , <Hl i，q -rh> A } i∈[1，m]，q∈[1，nb] , and then use the array as the input of the OT protocol; at the same time, P B Input d in the OT protocol and get the output of the OT protocol <Gl d -rg> A , <Hl d -rh> A Then, P B Compute locally <g> B ←<Gl d -rg> A +<Gl d > B , <h> B ← <Hl d -rg> A + <Hl d > B ;P A Directly use rg and rh as secret shards <g> A ←rg， <h> A ←rh.

[0249] Third, the two sides adopted the formula Get the weight value of the leaf node of the tree model.

[0250] Through the above method, the calculation results obtained when the parent node is calculated are used, and the number of secret sharing multiplication operations is greatly reduced through fewer times of inadvertent transmission, thereby speeding up the calculation efficiency of the weight value.

[0251] After calculating the weight values ​​of the leaf nodes, the tree can be used to update the predicted value slices of each intersection sample and output the tree model.

[0252] Using the specific example above, for each intersection sample i, both parties can Update the prediction results, where f k (i) is the leaf node number corresponding to the i-th sample, which can be obtained by bit-multiplying each leaf node and Get f k (i) is a one-hot encoded vector, and then the vector is compared with <w>Dot product As the weight value of the leaf node. This step also corresponds to Figure 3 The steps of updating the predicted value in . Finally, both parties output the feature information of the split point of each tree and the split threshold (i.e., bucket threshold) as the model output result of this tree model training. The split threshold output here can exist in the form of slices.

[0253] The above method proposes a decision tree model training method for the intersection of two anonymous primary keys. This method can protect data and data primary key IDs while providing a fully anonymous decision tree model with high speed and low communication volume. It solves the problem that the existing local plaintext cannot be used for decision tree modeling in scenarios of fully anonymous encryption of data and anonymous primary key intersection information.

[0254] Since the fully anonymous tree model needs to ensure that the feature holder cannot know the feature distribution information, the above method uses the characteristic that non-feature holders cannot infer non-feature values ​​and primary key ID information through bucket information when extracting bucket threshold homomorphic ciphertext, and regards non-feature holders as efficient auxiliary calculation parties in model training, thereby solving the problem of safely and efficiently training decision tree models in anonymous primary key ID scenarios.

[0255] In addition, the above method also improves the calculation efficiency of the leaf node weight value through the oblivious transfer method.

[0256] In addition, this specification also provides a bucket threshold extraction method, which is applied to a first party. The method also involves a second party, and the first party and the second party respectively hold samples including a first feature and a second feature. The flowchart of the method is as follows Figure 4 As shown, including:

[0257] Step 401, obtain multiple intersection samples by performing anonymous primary key privacy intersection jointly with the second party, and obtain the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary mark value through the anonymous primary key privacy bucketing protocol jointly performed with the second party. The bucket boundary mark value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket.

[0258] Step 403, receiving the second slice of the bucket number and the second slice of the bucket boundary mark value corresponding to the second feature of each intersection sample sent by the second party, and performing secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary mark value to determine the bucket number and the bucket boundary mark value corresponding to the second feature of each intersection sample;

[0259] Step 405, receiving the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determining the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue;

[0260] Step 407, determining the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

[0261] The specific implementation of step 401-step 407 can refer to the description of step 201-step 207 in the specification. The above extracted bucket threshold can be used when the two parties jointly train other models. As long as the training sample needs to be bucketed, the training can be completed using this method.

[0262] This specification also provides a tree model joint training device, applied to a first party, where the first party and the second party respectively hold samples including a first feature and a second feature; Figure 5 As shown, the device comprises:

[0263] Bucketing module 510, used to obtain multiple intersection samples by performing anonymous primary key privacy intersection in conjunction with the second party, and obtain the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary mark value by performing anonymous primary key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket;

[0264] The secret sharing decryption module 520 is used to receive the second slice of the bucket number and the second slice of the bucket boundary marking value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marking value to determine the bucket number and the bucket boundary marking value corresponding to the second feature of each intersection sample;

[0265] The homomorphic operation module 530 is used to receive the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue;

[0266] Bucket threshold extraction module 540, used to determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample;

[0267] A split point determination module 550 is used to use the multiple intersection samples to jointly perform joint training of the tree model with the second party to determine the split point of each non-leaf node in the tree model, where the split point is indicated by the bucket number of the feature;

[0268] The weight value calculation module 560 is used to obtain the bucket threshold homomorphic ciphertext corresponding to the bucket number when the splitting point is the bucket number corresponding to the second feature, so as to jointly determine the splitting condition corresponding to the splitting point based on the bucket threshold homomorphic ciphertext and the second party, and calculate the weight value of the leaf node based on this.

[0269] In an optional implementation, the split point determination module 550 is specifically used to process the bucket threshold homomorphic ciphertext corresponding to the split point into bucket threshold shards through a homomorphic encryption to secret sharing protocol jointly executed with the second party, and use the bucket threshold shards as the splitting condition of the non-leaf node.

[0270] In an optional implementation, the splitting point determination module 550 is specifically used to jointly perform the calculation of the derivative value of the intersection sample with the second party to obtain the derivative value slice of each intersection sample; the derivative value is calculated according to the loss function of the tree model; for each non-leaf node, execute: according to the secret sharing to homomorphic encryption protocol jointly performed by the second party, obtain the derivative value homomorphic ciphertext of the first intersection sample; the first intersection sample is the intersection sample falling into the non-leaf node; for each bucket corresponding to the second feature, accumulate the derivative value homomorphic ciphertext of the first intersection sample belonging to the bucket to obtain the derivative cumulative value homomorphic ciphertext corresponding to each bucket of the second feature; according to the derivative cumulative value homomorphic ciphertext corresponding to each bucket, use the information gain method to jointly determine the splitting point of the non-leaf node with the second party; the second party has the derivative cumulative value homomorphic ciphertext of each bucket corresponding to the first feature.

[0271] In an optional implementation, the splitting point determination module 550 is specifically used to jointly execute the homomorphic encryption to secret sharing protocol with the second party to obtain the derivative cumulative value shards corresponding to each bucket; utilize the information gain method to jointly execute the secret sharing four arithmetic operations with the second party based on the derivative cumulative value shards corresponding to each bucket to determine the gain value corresponding to each bucket; compare the gain values ​​corresponding to each bucket according to the secret comparison method to determine the splitting point of the non-leaf node.

[0272] In an optional implementation, the split point is indicated by a shard of a bucket number, and the first number of numbers in the bucket number corresponds to the bucket of the first feature. The device also includes a split point disclosure module 570 (not shown in the figure), which is used to determine the size relationship between the bucket number corresponding to the split point and the first number by using the shard of the bucket number corresponding to the split point held by the second party through a privacy comparison method jointly executed with the second party; when the split point is greater than the first number, determine that the split point is the bucket number corresponding to the second feature, and receive the shard of the bucket number corresponding to the split point held by the second party sent by the second party, and perform secret sharing decryption on the bucket number corresponding to the split point.

[0273] In an optional implementation, the weight value calculation module 560 is specifically used to obtain a first new slice of the derivative cumulative value corresponding to the bucket threshold of the parent node splitting point based on the bucket number of the parent node splitting point, the first slice of the derivative cumulative value of the bucket threshold corresponding to the splitting point, and the derivative cumulative value slice array held by the second party, and jointly with the second party based on oblivious transmission; the derivative cumulative value slice array includes derivative cumulative value slices corresponding to multiple bucket thresholds used when calculating the splitting point, and the derivative cumulative value slice corresponding to each bucket threshold includes the sum of the derivative value slices of the intersection samples whose characteristic values ​​are less than and / or greater than the bucket threshold; the derivative value slice is obtained by jointly calculating the loss function of the tree model with the second party; and using the first new slice, jointly perform the calculation of the weight value of the leaf node with the second party.

[0274] In an optional implementation, the weight value calculation module 560 is specifically used to take the bucket number of the parent node splitting point as input, and jointly perform multiple-choice oblivious transmission with the second party to obtain the shard data corresponding to the bucket number from the second party's multiple shard data; the second party's multiple shard data include the difference between each shard in the derivative cumulative value shard array and the first random number; and take the sum of the first shard of the derivative cumulative value and the shard data corresponding to the bucket number as the first new shard.

[0275] In an optional implementation, the weight value calculation module 560 is specifically used to generate a second random number and determine the difference between each slice in the derivative cumulative value slice array and the second random number; based on the difference between each slice in the derivative cumulative value slice array and the second random number, jointly with the second party based on inadvertent transmission, so that the second party obtains a third new slice; uses the second random number as the fourth new slice, and jointly performs the calculation of the leaf node weight value with the second party.

[0276] This specification also provides a bucket threshold extraction device, which is applied to a first party, wherein the first party and the second party respectively hold samples including a first feature and a second feature. Figure 6 As shown, the device comprises:

[0277] Bucketing module 610, used to obtain multiple intersection samples by performing anonymous primary key privacy intersection in conjunction with the second party, and obtain the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary mark value by performing anonymous primary key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket;

[0278] The secret sharing decryption module 620 is used to receive the second slice of the bucket number and the second slice of the bucket boundary mark value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary mark value to determine the bucket number and the bucket boundary mark value corresponding to the second feature of each intersection sample;

[0279] The homomorphic operation module 630 is used to receive the homomorphic ciphertext of the second slice of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second slice and the eigenvalue;

[0280] The bucket threshold extraction module 640 is used to determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

[0281] In the 1990s, it was very clear whether the improvement of a technology was a hardware improvement (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements in the method flow today can be regarded as direct improvements in the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs. The original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0282] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0283] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, this specification does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0284] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0285] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0286] This specification is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0287] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0288] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0289] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0290] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0291] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0292] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0293] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0294] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference term "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, in the absence of mutual contradiction, a person skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0295] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.< / w> < / h> < / g> < / h> < / g> < / h> < / g> < / h> < / g> < / h> < / g> < / gr> < / gl> < / gr> < / gr> < / gl> < / gr> < / gl> < / gr> < / gr> < / gl> < / h> < / g> < / h1> < / g1> < / h1> < / h1> < / h1> < / gl> < / gl> < / gr> < / gl> < / gain> < / hl> < / gr> < / gl> < / d> < / d> < / d> < / d> < / y> ​​< / d> < / x> < / x> < / x>

Claims

1. A tree model joint training method, applied to a first party, the method also involving a second party, the first party and the second party respectively holding samples including a first feature and a second feature; the method comprising: A plurality of intersection samples are obtained by performing an anonymous key privacy intersection in conjunction with the second party, and a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value are obtained by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket; Receive the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample; Receive the homomorphic ciphertext of the second shard of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second shard of the eigenvalue and the first shard of the eigenvalue; Determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample; Using the multiple intersection samples, jointly perform joint training of the tree model with the second party to determine the split point of each non-leaf node in the tree model, where the split point is indicated by the bucket number of the feature; When the splitting point is the bucket number corresponding to the second feature, the bucket threshold homomorphic ciphertext corresponding to the bucket number is obtained, so as to jointly determine the splitting condition corresponding to the splitting point according to the bucket threshold homomorphic ciphertext and the second party, and calculate the weight value of the leaf node based on this.

2. According to the method of claim 1, the step of jointly determining the splitting condition corresponding to the splitting point according to the bucket threshold homomorphic ciphertext and the second party comprises: By jointly executing a homomorphic encryption-to-secret sharing protocol with a second party, the bucket threshold homomorphic ciphertext corresponding to the split point is processed into bucket threshold shards, and the bucket threshold shards are used as the splitting condition of the non-leaf node.

3. The method according to claim 1, wherein the method of using the plurality of intersection samples and jointly performing joint training of the tree model with a second party to determine the split point of each non-leaf node in the tree model comprises: The derivative value of the intersection sample is calculated jointly with the second party to obtain a derivative value slice of each intersection sample; the derivative value is calculated according to the loss function of the tree model; For each non-leaf node, execute: According to the secret sharing to homomorphic encryption protocol jointly executed with the second party, a derivative value homomorphic ciphertext of the first intersection sample is obtained; the first intersection sample is an intersection sample falling into the non-leaf node; For each bucket corresponding to the second feature, accumulate the derivative value homomorphic ciphertexts of the first intersection samples belonging to the bucket to obtain the derivative cumulative value homomorphic ciphertexts corresponding to each bucket of the second feature; According to the homomorphic ciphertext of the derivative accumulation values ​​corresponding to each bucket, the information gain method is used to jointly determine the splitting point of the non-leaf node with the second party; the second party has the homomorphic ciphertext of the derivative accumulation values ​​of each bucket corresponding to the first feature.

4. According to the method of claim 3, the step of determining the split point of the non-leaf node jointly with the second party using the information gain method based on the derivative cumulative value homomorphic ciphertext corresponding to each bucket, comprises: Execute the homomorphic encryption-to-secret sharing protocol with the second party to obtain the derivative accumulation value shards corresponding to each bucket; Using the information gain method, the derivative cumulative value corresponding to each bucket is divided into shards, and the second party jointly performs the four arithmetic operations of secret sharing to determine the gain value corresponding to each bucket; The gain values ​​corresponding to each bucket are compared according to the secret comparison method to determine the split point of the non-leaf node.

5. The method according to claim 1, wherein the split point is indicated by a segment of bucket numbers, wherein the first first number of numbers in the bucket numbers correspond to the buckets of the first feature; Before obtaining the bucket threshold homomorphic ciphertext corresponding to the bucket number, the method further includes: Determine, by a privacy comparison method jointly performed with the second party, a size relationship between the bucket number corresponding to the splitting point and the first quantity using the shards of the bucket number corresponding to the splitting point held; When the splitting point is greater than the first number, the splitting point is determined to be the bucket number corresponding to the second feature, and the fragment of the bucket number corresponding to the splitting point held by the second party and sent by the second party is received, and the bucket number corresponding to the splitting point is secret-shared and decrypted.

6. The method according to claim 5, in the case where the split point of the parent node of the leaf node is the bucket number corresponding to the second feature, the calculation of the weight value of the leaf node based on this includes: Based on the bucket number of the parent node splitting point, the first shard of the derivative cumulative value of the bucket threshold corresponding to the splitting point, and the derivative cumulative value shard array held by the second party, the first new shard of the derivative cumulative value corresponding to the bucket threshold of the parent node splitting point is obtained in conjunction with the second party based on oblivious transmission; the derivative cumulative value shard array includes derivative cumulative value shards corresponding to multiple bucket thresholds used when calculating the splitting point, and the derivative cumulative value shard corresponding to each bucket threshold includes the sum of the derivative value shards of the intersection samples whose characteristic values ​​are less than and / or greater than the bucket threshold; the derivative value shard is obtained by joint calculation based on the loss function of the tree model and the second party; The first new shard is used to jointly calculate the leaf node weight value with the second party.

7. The method according to claim 6, wherein the first new shard of the derivative cumulative value corresponding to the bucket threshold of the parent node splitting point is obtained jointly with the second party based on oblivious transmission, comprising: Taking the bucket number of the parent node split point as input, jointly performing one-out-of-many oblivious transmission with the second party, obtaining the shard data corresponding to the bucket number from the second party's multiple shard data; the second party's multiple shard data includes the difference between each shard in the derivative cumulative value shard array and the first random number; The sum of the first slice of the derivative cumulative value and the slice data corresponding to the bucket number is taken as the first new slice.

8. The method according to claim 5, wherein when the split point of the parent node of the leaf node is the bucket number corresponding to the first feature, the calculation of the weight value of the leaf node based on the first feature comprises: Generate a second random number, and determine the difference between each slice in the derivative cumulative value slice array and the second random number; Based on the difference between each shard in the derivative cumulative value shard array and the second random number, the second party is jointly based on oblivious transmission, so that the second party obtains a third new shard; The second random number is used as the fourth new shard, and the leaf node weight value is calculated jointly with the second party.

9. A bucket threshold extraction method, applied to a first party, the method also involving a second party, the first party and the second party respectively holding samples including a first feature and a second feature; the method comprising: A plurality of intersection samples are obtained by performing an anonymous key privacy intersection in conjunction with the second party, and a first slice of a feature value corresponding to a second feature of each intersection sample, a first slice of a bucket number, and a first slice of a bucket boundary mark value are obtained by performing an anonymous key privacy bucketing protocol in conjunction with the second party, wherein the bucket boundary mark value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket; Receive the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second slice of the bucket number and the first slice of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample; Receive the homomorphic ciphertext of the second shard of the eigenvalue corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the eigenvalue of the second feature of each intersection sample based on the homomorphic sum of the second shard of the eigenvalue and the first shard of the eigenvalue; According to the bucket number, bucket boundary mark value and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample, the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature is determined; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 9 is implemented.

Images