A tree model joint training method and a bucketing threshold extraction method

Abstract

The specification provides a joint training method of tree model and a bucket threshold extraction method. A first party and a second party respectively hold samples including first features and second features. The first party first obtains the bucket information corresponding to the second feature of the intersection sample by performing the anonymous primary key privacy intersection and the anonymous primary key privacy bucketing protocol jointly with the second party. And receives the second slice of the bucket number and the second slice of the bucket boundary marker value in the bucket information sent by the second party, and performs secret sharing decryption based on this. Further receive the homomorphic ciphertext of the second slice of the feature value in the bucket information sent by the second party, and determine the homomorphic ciphertext of the feature value of the intersection sample based on the homomorphic ciphertext of the second slice of the feature value and the homomorphic sum of the first slice. Finally, according to the bucket number, the bucket edit marker value and the homomorphic ciphertext of the feature value of the second feature of each intersection sample, determine the homomorphic ciphertext of the bucket threshold corresponding to each bucket. And perform tree model training.

Description

TECHNICAL FIELD

[0001] Embodiments of the present specification belong to the technical field of privacy computing, and particularly relate to a tree model joint training method and a bucket threshold extraction method. BACKGROUND

[0002] A decision tree model is a tree structure, and through the decision tree, the attributes of a target object can be scored or classified according to the characteristic values of the input target object. Privacy computing is a method of joint data processing by multiple parties without revealing the data they hold. With the continuous development of privacy computing technology, there is a demand in the prior art for two parties to jointly model a tree model for privacy computing.

[0003] In the process of two parties jointly modeling a tree model, it is often necessary to first determine the intersection samples of the two parties, that is, the samples with the same identification information (or primary key) held by both parties. In related technologies, the intersection samples are generally determined by a private set intersection (PSI) method. PSI enables a party to obtain the primary key information of the intersection without knowing the non-intersection primary key information of the other party.

[0004] However, the above scheme discloses the primary key information of the intersection samples, which is not conducive to maintaining data privacy. SUMMARY

[0005] The purpose of the present specification is to solve the problem of disclosing primary key information, and to provide a tree model joint training method and a bucket threshold extraction method.

[0006] The first aspect of the present specification provides a tree model joint training method applied to a first party, the method also involving a second party, the first party and the second party each holding samples including first features and second features; the method comprising:

[0007] obtaining a plurality of intersection samples through joint execution of an anonymous primary key private set intersection with the second party, and obtaining a first shard of the feature values corresponding to the second features of each intersection sample, a first shard of the bucket numbers, and a first shard of the bucket boundary marker values through joint execution of an anonymous primary key private bucketing protocol with the second party, the bucket boundary marker values being used to indicate whether the feature values of the intersection sample are the bucket threshold values of the corresponding buckets;

[0008] receiving the second shard of the bucket numbers corresponding to the second features of each intersection sample and the second shard of the bucket boundary marker values sent by the second party, and performing secret sharing decryption based on the first shard of the bucket numbers and the first shard of the bucket boundary marker values to determine the bucket numbers corresponding to the second features of each intersection sample and the bucket boundary marker values;

[0009] receive homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the feature value homomorphic ciphertext of the second feature of each intersection sample based on the homomorphic sum of the first shard of the feature value and the second shard;

[0010] determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number corresponding to the second feature of each intersection sample, the bucket boundary marker value, and the feature value homomorphic ciphertext;

[0011] perform joint training of the tree model with the second party using the plurality of intersection samples to determine the split point of each non-leaf node in the tree model, the split point being indicated by the bucket number of the feature;

[0012] In the case where the split point is the bucket number corresponding to the second feature, obtain the bucket threshold homomorphic ciphertext corresponding to the bucket number, to determine the split condition corresponding to the split point based on the bucket threshold homomorphic ciphertext and the second party, and perform calculation of the leaf node weight value based thereon.

[0013] The second aspect of the present specification provides a bucket threshold extraction method, applied to a first party, the method also involving a second party, the first party and the second party respectively holding samples including a first feature and a second feature; the method comprises:

[0014] obtain a plurality of intersection samples through the joint execution of the anonymous primary key privacy intersection protocol with the second party, and obtain the first shard of the feature value, the first shard of the bucket number, and the first shard of the bucket boundary marker value corresponding to the second feature of each intersection sample through the joint execution of the anonymous primary key privacy bucketing protocol with the second party, the bucket boundary marker value being used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket;

[0015] receive the second shard of the bucket number and the second shard of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the first shard of the bucket number and the first shard of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample;

[0016] receive homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the feature value homomorphic ciphertext of the second feature of each intersection sample based on the homomorphic sum of the first shard of the feature value and the second shard;

[0017] determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number corresponding to the second feature of each intersection sample, the bucket boundary marker value, and the feature value homomorphic ciphertext; the bucket threshold homomorphic ciphertext is used for joint training of the model by the first party and the second party.

[0018] The third aspect of the specification provides a tree model joint training apparatus applied to a first party, wherein the first party and a second party respectively hold samples including first features and second features; the apparatus comprises:

[0019] a bucketing module configured to obtain a plurality of intersection samples by performing an anonymous primary key privacy intersection with the second party, and obtain a first shard of a feature value corresponding to the second feature, a first shard of a bucketing number, and a first shard of a bucketing boundary marker value of each intersection sample by performing an anonymous primary key privacy bucketing protocol with the second party, wherein the bucketing boundary marker value is used to indicate whether the feature value of the intersection sample is a bucketing threshold of the corresponding bucket;

[0020] a secret sharing decryption module configured to receive a second shard of the bucketing number and a second shard of the bucketing boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the first shard of the bucketing number and the first shard of the bucketing boundary marker value to determine the bucketing number and the bucketing boundary marker value corresponding to the second feature of each intersection sample;

[0021] a homomorphic operation module configured to receive homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine homomorphic ciphertext of the feature value of the second feature of each intersection sample based on a homomorphic sum of the first shard of the feature value;

[0022] a bucketing threshold extraction module configured to determine homomorphic ciphertext of the bucketing threshold of each bucket corresponding to the second feature based on the bucketing number, the bucketing boundary marker value, and the homomorphic ciphertext of the feature value corresponding to the second feature of each intersection sample;

[0023] a split point determination module configured to jointly perform joint training of a tree model with the second party by using the plurality of intersection samples to determine a split point of each non-leaf node in the tree model, wherein the split point is indicated by a bucketing number of a feature;

[0024] a weight value calculation module configured to, in a case where the split point is the bucketing number corresponding to the second feature, obtain homomorphic ciphertext of the bucketing threshold corresponding to the bucketing number, determine a split condition corresponding to the split point based on the homomorphic ciphertext of the bucketing threshold and the second party, and perform calculation of a weight value of a leaf node based on this.

[0025] The fourth aspect of the specification provides a bucketing threshold extraction apparatus applied to a first party, wherein the first party and a second party respectively hold samples including first features and second features; the apparatus comprises:

[0026] a bucketing module configured to obtain a plurality of intersection samples by performing an anonymous primary key privacy intersection with the second party, and obtain a first shard of a feature value corresponding to a second feature of each intersection sample, a first shard of a bucket number, and a first shard of a bucket boundary marker value by performing an anonymous primary key privacy bucketing protocol with the second party, the bucket boundary marker value being used to indicate whether the feature value of the intersection sample is a bucket threshold value of a corresponding bucket;

[0027] a secret sharing decryption module configured to receive a second shard of the bucket number and a second shard of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second shard of the bucket number and the second shard of the bucket boundary marker value and the first shard of the bucket number and the first shard of the bucket boundary marker value, to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample;

[0028] a homomorphic operation module configured to receive homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine homomorphic ciphertext of the feature value of the second feature of each intersection sample based on the homomorphic ciphertext of the second shard of the feature value and a homomorphic sum of the first shard of the feature value;

[0029] a bucket threshold value extraction module configured to determine homomorphic ciphertext of a bucket threshold value of each bucket corresponding to the second feature according to the bucket number, the bucket boundary marker value, and the homomorphic ciphertext of the feature value corresponding to the second feature, the homomorphic ciphertext of the bucket threshold value being used for the first party and the second party to jointly train a model.

[0030] The fifth aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer program causes the computer to execute the tree model joint training method or the bucket threshold value extraction method described above.

[0031] The sixth aspect of the present specification provides a computing device including a memory and a processor, the memory having executable code stored therein, and the processor implementing the tree model joint training method or the bucket threshold value extraction method described above when executing the executable code.

[0032] The seventh aspect of the present specification provides a computer program product including a computer program / instruction, which, when executed by a processor, implements the tree model joint training method or the bucket threshold value extraction method described above.

[0033] Through the above method, based on the feature value shard, the bucket number shard, and the bucket boundary marker value shard corresponding to each feature of the intersection sample obtained based on the anonymous primary key privacy intersection and the anonymous primary key privacy bucketing protocol, the extraction of the bucket threshold value ciphertext can be completed without leaking the primary key information and other private information, and the training of the tree model based on the bucket threshold value is completed, thereby realizing the training of the tree model based on the anonymous primary key. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a schematic diagram of a decision tree;

[0036] Figure 2 This is a flowchart of a tree model joint training method in one embodiment;

[0037] Figure 3 This is a flowchart of a tree model joint training method in another embodiment;

[0038] Figure 4 This is a flowchart of a bucket threshold extraction method in one embodiment of this specification;

[0039] Figure 5 This is a structural block diagram of a tree model joint training device in one embodiment of this specification;

[0040] Figure 6 This is a structural block diagram of a bucket threshold extraction device in one embodiment of this specification. Detailed Implementation

[0041] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0042] With increasing demands for data security, privacy-preserving computation methods that balance privacy protection and data utilization are being widely adopted. These technologies involve multiple stakeholders using their respective data for joint privacy-preserving computations, such as joint modeling and joint federated learning.

[0043] Decision tree models typically exist in the form of binary trees. The splitting conditions of non-leaf nodes determine which leaf node a sample falls into, and the weight values ​​of the leaf nodes determine the score or classification of that sample. For example... Figure 1 As shown, Figure 1is a simple decision tree. The content in the non-leaf node represents the split condition of the node, A is the identification of a certain feature, and the number is the corresponding split threshold. The content in the leaf node represents the weight value of the leaf node. In the case where the sample meets the corresponding split threshold, the sample will fall into the node on the left side of the node, otherwise it will fall into the node on the right side. For example, if the feature value of a sample is 1, then according to the split condition of each non-leaf node, it can be determined that the sample falls into the leftmost leaf node, and the score value of the sample is 1. It should be noted that, Figure 1 A simple decision tree model is shown. The actual decision tree model used may not only generate the judgment condition of the non-leaf node according to one feature, but also may complete the classification or scoring of the sample through multiple trees.

[0044] There are various training methods for tree models, generally including gradient decision tree (GBDT), extreme gradient boosting (XGBoost), etc. Here, GBDT will be briefly introduced. GBDT is an iterative decision tree algorithm that combines gradient boosting and decision tree algorithms. Through iterative training of multiple decision trees, each decision tree is trained on the residual (difference between predicted value and actual value) of the previous tree. In the training process, the structure and parameters of each decision tree are continuously optimized through gradient boosting to minimize the loss function of the model. In the prediction stage, the prediction results of multiple decision trees are summed or weighted averaged to obtain the final prediction result. Gradient decision trees are usually used to solve regression and classification problems. For example, a tree model can be trained to classify users' financial credit risk, so as to quickly identify users with credit risk (such as fraud risk).

[0045] Through privacy protection, joint training of tree models is generally required to determine common samples (here, two examples) by participants, that is, intersection samples. Specifically, each participant generally holds the primary key and feature value corresponding to each training sample, and different participants hold different feature values. Two participants can determine the intersection samples held by the two participants according to the primary key, which have the same primary key.

[0046] The primary key is identification information that can distinguish different training samples, such as, in the scenario of classifying the financial credit risk of a user, the primary key can be identification information of the identity of the user, a mobile phone number, or the like, which can uniquely distinguish the user. Different participants hold different feature values, such as, in the scenario of classifying the financial credit risk of a user, one participant can hold transaction data of the user and other users, and another participant can hold friend information of the user, such as, which user has a friend relationship with the user.

[0047] For the method of determining the intersection sample, the PSI method is generally used to determine the intersection sample. The PSI can ensure that the non-intersection primary key information is not disclosed. After the PSI is executed, the two participants can determine the primary key information of the intersection sample, and the two participants can further jointly complete the training of the tree model based on the intersection sample.

[0048] Although the non-intersection primary key information can be protected in the above method, the primary key information of the intersection sample needs to be disclosed in the training process. With the further development of privacy protection, there is a demand for more secure joint modeling privacy calculation under the condition of anonymous data primary key information and data full-process encryption in the related art. For example, the two participants are a bank and a company providing an application service. The application is an anonymous application. If the intersection primary key information is disclosed, the bank can learn that the user corresponding to the intersection primary key registers the application, which can lead to user privacy leakage.

[0049] Based on this, the present specification provides a tree model joint training method, which is applied to a first party. The first party and another participant, the second party, each hold samples including first features and second features. First, the first party obtains the first slice of the feature value corresponding to the second feature of the intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary marker value through the anonymous primary key privacy intersection and anonymous primary key privacy bucketing protocol jointly executed with the second party. The bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket. The first party also receives the second slice of the bucket number and the second slice of the bucket boundary marker value corresponding to the second feature of the intersection sample sent by the second party, and based on this, performs secret sharing decryption to obtain the bucket number and the bucket boundary marker value corresponding to the second feature of the intersection sample. Further, the first party receives the homomorphic ciphertext of the second slice of the feature value corresponding to the second feature of each intersection sample sent by the second party, and based on the homomorphic ciphertext of the second slice of the feature value and the homomorphic sum of the first slice, determines the homomorphic ciphertext of the feature value of the intersection sample. Finally, according to the bucket number, the bucket edit marker value, and the homomorphic ciphertext of the feature value of the second feature of each intersection sample, the first party determines the homomorphic ciphertext of the bucket threshold corresponding to each bucket. Then, the first party jointly calculates the derivative value with the second party using the intersection sample, accumulates the buckets, calculates the split point using the gain value, determines the bucket number corresponding to the split point, and then obtains the homomorphic ciphertext of the bucket threshold corresponding to the bucket number, and performs leaf node weight value calculation based on the homomorphic ciphertext.

[0050] Through the above method, based on the anonymous primary key privacy intersection and anonymous primary key privacy bucketing protocol, the feature value slice, bucket number slice, and bucket boundary marker value slice corresponding to each feature of the intersection sample are obtained. Without revealing the primary key information and other privacy information, the extraction of the bucket threshold ciphertext can be completed, and the training of the tree model based on the bucket threshold can be completed. In this way, the tree model training based on the anonymous primary key is realized.

[0051] Next, the method shown in the present specification will be described.

[0052] For the convenience of understanding, the training method of the tree model will be described first. The training process of the tree model generally includes six steps: feature sorting and bucketing, derivative calculation, bucket accumulation, gain value and split point calculation, sample division, and leaf node weight calculation.

[0053] Feature sorting and bucketing, that is, sorting the samples according to the sizes of the feature values, and determining the corresponding bucket of each sample according to the size of the feature value. Different buckets correspond to different ranges of sizes of the feature values. By bucketing the feature values, the model training efficiency can be improved. For example, after the feature values are bucketed, the subsequent training process can determine the size relationship of the feature values in units of buckets, which facilitates the calculation of the gain value (the specific calculation process is described below). And when calculating the split point, the split point can be selected from the thresholds of the buckets, instead of determining the split point by traversing all possible values of the feature values.

[0054] In addition, in the case where the sample has multiple types of features, the sample is respectively bucketed according to the feature values of different features of the sample, and the respective buckets corresponding to the feature values of the sample are determined. For example, the first feature value of the sample is 1, which is divided into a bucket with a bucket number of 1, and the second feature value of the sample is 10, which is divided into a bucket with a bucket number of 10.

[0055] Through bucketing, the respective bucket numbers corresponding to the samples can be obtained. Each bucket corresponds to a unique bucket number, and the bucket numbers corresponding to different types of features do not coincide. For example, a sample has m types of features, and each feature is divided into b buckets, so there are m*b buckets in total, and the bucket numbers corresponding to the m*b buckets do not coincide. For example, the first type of feature corresponds to a bucket with a bucket number of 1-b, the second type of feature corresponds to a bucket with a bucket number of b+1-2b, and so on.

[0056] After the bucketing is completed, each tree can be trained. As for the number of trees, a plurality of trees can be determined in advance, and each tree can be sequentially trained. In order to reduce the occurrence of overfitting, a tree can be trained according to the sample first, and then the residual of the tree is used to train the next tree until the residual is less than a certain value. The depth of each tree during training can be specified in advance.

[0057] The training process of the tth tree specifically includes:

[0058] 1. Derivative values of each sample are determined by deriving the loss function.

[0059] Here, in order to facilitate understanding, the derivation formula in XGBoost is first described. It should be noted that the method of the present specification can be used not only in XGBoost but also in the training of tree models such as GBDT. Here, XGBoost is only used as an example for description, and the present specification is not limited to XGBoost.

[0060] The objective function can be as shown in formula (1):

[0061]

[0062] wherein, is a loss function, which is used to measure the goodness of the model prediction results, Ω(f t ) is a regularization term, which is used to reduce the degree of overfitting of the model. n is the total number of samples participating in training, y i is the label of sample i, is the prediction result of the first t-1 trees, and is a constant value. f t (x i ) is the variable to be confirmed at present, that is, the prediction result of the tth tree being trained for the sample. γ, λ are hyperparameters, and T is the number of leaf nodes of the tree f t . w j is the weight value of the jth leaf node.

[0063] In the binary classification problem, the loss function l adopts the log loss, and the specific formula is shown in formula (2):

[0064]

[0065] The first-order derivative value g and the second-order derivative value h of the loss function can be obtained by derivation, as shown in formula (3):

[0066]

[0067] 2. For each non-leaf node, perform bucket accumulation, determine the split point using the gain value, and divide the samples.

[0068] (1) According to the sample division result of the parent node of the non-leaf node, determine the samples falling into the non-leaf node. And using the derivative value of the samples falling into the non-leaf node, determine the derivative accumulation value corresponding to each bucket. That is, for each bucket, for the samples belonging to the bucket and falling into the current non-leaf node, the derivative values of these samples are accumulated to obtain the derivative accumulation value corresponding to each bucket. The derivative accumulation value here includes the first-order derivative accumulation value and the second-order derivative accumulation value. That is, the following can be obtained:

[0069]

[0070] wherein, G j is the first-order derivative accumulation value corresponding to the bucket numbered j, and H j is the second-order derivative accumulation value corresponding to the bucket numbered j. The reason for calculating the derivative accumulation value will be explained below.

[0071] (2) Using the information gain method, determine the gain value corresponding to the bucket threshold value of each bucket, and determine the maximum gain value. The bucket threshold value of the bucket corresponding to the maximum gain value is taken as the split point.

[0072] Next, the derivation of the gain value calculation formula will be explained.

[0073] We need to train the target function towards the trend of gradient descent, and need to approach the trend of the derivative. For the loss function, we can consider as x+Δx in Taylor expansion. According to Taylor expansion, And g i is the first-order partial derivative of the loss function with respect to h i is the second-order partial derivative of the loss function with respect to Therefore, by removing the constant value in the target function, the target function can be expanded as formula (5):

[0074]

[0075] Among them, represents the weight value of the leaf node where the i-th sample falls in the tree model.

[0076] Since and w j exist a corresponding mapping relationship: I j = i|q(x i ) = j, that is, the sample x i will finally be classified into the j-th leaf node (by I j converts the traversal on the sample into the traversal on the leaf node), so that Obj (t) is only related to the leaf node of the tree to be constructed. Since n >> T (T is the number of leaf nodes), there are a large number of repeated w values, so we use the derivative cumulative values G and H obtained by formula (4) to merge these same w values, and further update Obj (t) , to obtain:

[0077]

[0078] Formula (6) can be regarded as T one-variable quadratic functions about w j . Since the coefficient of the quadratic term (H j + λ) > 0, each leaf node takes the minimum value when , so we can get:

[0079]

[0080] According to formula (7), the final leaf node weight value range is related to the structure of the tree and the node distribution information. Next, how to construct the structure of the tree will be explained. That is, how to determine the split point of the tree model.

[0081] In the related art, split finding refers to determining a split feature and a split threshold of each node to maximize the prediction accuracy of a model when constructing a decision tree. The calculation of the split point is usually performed by measuring the change in the purity or impurity of the nodes after splitting. The Gini coefficient, information gain or mean square error are usually used to evaluate the selection of the split point, and the feature and the corresponding split point that make the impurity decrease the most are selected as the split point, which is a better split for one-time cutting.

[0082] Next, the split point calculation method based on information gain will be described.

[0083] To reduce the cost of attempting to construct a tree structure, a greedy algorithm is used to initialize a tree with only one root node, and then each leaf node is traversed to determine the split point according to the maximum gain value obtained by enumerating the current node split case, and the structure of the tree is expanded one by one. Thus, the Gain value formula (8) of the previous node after splitting can be determined by subtraction as follows:

[0084]

[0085] where G L and G R represent the sum of the derivative values of the samples whose feature values are less than or equal to and greater than the split threshold of the split point, respectively.

[0086] The Gain value corresponding to each bucket threshold can be calculated, and the maximum value is selected as the split point corresponding to the non-leaf node.

[0087] 3. For each leaf node, the weight value of the leaf node is calculated using formula (7).

[0088] In this way, the tree model can be trained.

[0089] After a brief description of the training process of the tree model, the following will describe how two participants jointly train the tree model under the condition of anonymous primary keys.

[0090] The present specification provides a tree model joint training method, which is applied to a first party, the method also involves a second party, the first party and the second party respectively hold samples including first features and second features, and the first party and the second party jointly complete the training of the tree model using the samples they hold.

[0091] ​The first feature and the second feature can be different types of features. In addition, the number of types of the first feature can be more than one, and similarly, the second feature can also include multiple types of features. For example, in the scenario of classifying the financial credit risk of a user, the first feature can include the number of transactions of the user and the number of large-amount transfers of the user with low financial credit risk. The second feature can include the number of users with low financial credit risk among the user's friends and the number of chats between the user and the users with low financial credit risk.

[0092] In addition, the first party and the second party can also hold the primary key corresponding to each sample. The meaning of the primary key is described in the foregoing, and will not be described here. In order to complete the training of the tree model, either of the first party and the second party can also have the label value corresponding to the sample.

[0093] As shown in Figure 2 , Figure 2 is a schematic diagram of a tree model joint training method according to an exemplary embodiment of the present specification, including the following steps:

[0094] Step 201, obtaining multiple intersection samples through joint execution of an anonymous primary key privacy intersection by the first party and the second party, and obtaining the first slice of the feature value corresponding to the second feature, the first slice of the bucket number, and the first slice of the bucket boundary marker value of each intersection sample through the joint execution of the anonymous primary key privacy bucketing protocol by the first party and the second party.

[0095] The bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket.

[0096] Specifically, each intersection sample can be obtained by using the anonymous primary key privacy intersection method in the related art, and the intersection sample can be processed by using the anonymous primary key privacy bucketing protocol to obtain the bucketing information of each feature of each intersection sample.

[0097] The anonymous primary key privacy intersection (Circuit-PSI) is a method for obtaining intersection samples without disclosing the intersection primary key to the participating parties. Specifically, the anonymous primary key privacy intersection further requires protecting the primary key information of the intersection part while extracting the intersection information on the basis of the PSI.

[0098] A method of anonymous primary key privacy intersection in the related art is to reduce the number of intersection data comparison required by using the Cuckoo hash table, and to keep the intersection result as ciphertext by means of private comparison. The ciphertext information of whether all positions on the Cuckoo hash table are intersections is taken as the output result of the anonymous primary key privacy intersection. It should be noted that the above-mentioned example of the anonymous primary key privacy intersection scheme does not represent a limitation of the present specification.

[0099] The privacy feature bucketing of the anonymous primary key is a protocol for completing feature secret bucketing and outputting secret shared bucket numbers in a scenario where a data party does not know a data intersection and feature values are ciphertexts.

[0100] The method of an anonymous primary key privacy bucketing protocol in the related art is specifically: obtaining a first intersection result corresponding to a first data set held by a first party; wherein the first intersection result is an intersection result obtained by performing PSI calculation on data identifiers included in the first data set held by the first party and data identifiers included in a second data set held by a second party in the at least two parties; the first intersection result includes first intersection results corresponding to respective data identifiers included in the first data set; the first intersection result corresponding to any data identifier in the first data set includes at least two secret shares obtained by splitting, based on a secret sharing algorithm, a PSI calculation result corresponding to the data identifier. The first secret share held by the first party is sorted according to the size relationship of the feature values corresponding to the respective data identifiers included in the first data set to obtain a first sequence composed of the sorted first secret share. The prefix sum corresponding to each first secret share included in the first sequence is calculated; and the target number of data identifiers included in the first data set that have an intersection with the data identifiers included in the second data set held by the second party is determined based on the PSI calculation result corresponding to each data identifier in the first data set. Based on the target number and the preset bucket number, the prefix sum corresponding to each first secret share included in the first sequence is mapped to a first bucket number share held by the first party to complete feature bucketing for the feature values corresponding to the respective data identifiers included in the first data set locally; the first bucket number share is one of the bucket number shares corresponding to the bucket numbers to which the feature values corresponding to the respective data identifiers included in the first data set belong and held by the first party. It should be noted that the above examples do not represent a limitation on the present specification.

[0101] Through the above-mentioned privacy intersection of the anonymous primary key and the privacy bucketing of the anonymous primary key, the bucketing information of the feature values corresponding to each sample can be obtained. The bucketing information exists in the form of secret shared shares.

[0102] Secret sharing (secret sharing) is also called secret division, secret sharing. The basic principle is to split the secret into multiple shares (share), which is also called share, and give it to different people. Only more than the threshold number of people will combine their shares to restore the secret; from less than the threshold number of shares, no information can be restored from the secret. In privacy computing, the threshold number is usually the same as the number of participants.

[0103] In the secret sharing scenario, for the second feature, the first party obtains the bucketing information including: the first slice of the feature value, the first slice of the bucket number and the first slice of the bucket boundary marker value. It should be noted that the three first slices are not the same slice, and here the first second is used to distinguish to which party the corresponding slice belongs. It can be understood that, correspondingly, the second party also obtains the second slice of the feature value corresponding to the second feature of the intersection sample, the second slice of the bucket number and the second slice of the bucket boundary marker value.

[0104] Next, the various bucketing information will be described in detail. The feature value included in the bucketing information is the feature value corresponding to the second feature. The bucket number can represent the feature value range corresponding to the feature value of the second feature of the sample. For specific description of the bucket number, please refer to the foregoing, which will not be repeated here. The feature bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucket threshold value of the corresponding bucket. For example, the bucket boundary marker value can take 0 and 1. When 0 is taken, it means that the feature value is not the bucket threshold value corresponding to the bucket, and when 1 is taken, it means that the feature value is the bucket threshold value corresponding to the bucket. The bucket threshold value can be the smallest feature value in the bucket. Alternatively, the bucket threshold value of each bucket can also be the largest feature value in the bucket.

[0105] It should be noted that, Figure 2 In the second feature corresponding bucket threshold extraction method, in the optional embodiment, the first party and the second party in the present application can also use a similar method to obtain the first feature corresponding bucket threshold. Specifically, in step 201, in addition to obtaining the second feature corresponding bucketing information, the first party can also obtain the first feature corresponding bucketing information, that is, the first slice of the feature value, the first slice of the bucket number and the first slice of the bucket boundary marker value.

[0106] Corresponding to step 201, the second party can also obtain the second slice of the feature value corresponding to the first feature of the intersection sample, the second slice of the bucket number and the second slice of the bucket boundary marker value through the anonymous primary key privacy intersection and the anonymous primary key privacy bucketing.

[0107] In the case where the first party and the second party each have the first feature and the second feature corresponding bucketing information, the bucketing information owned by the first party and the second party can be presented in the form of a matrix. Next, the bucketing information owned by the first party and the second party will be described through a specific embodiment, and the following specific examples do not represent a limitation on the present specification.

[0108] For the convenience of description, the angle brackets <x>denotes that the current variable X is secret share encrypted, and P A and P B respectively hold secret share shards <x> A and <x> B .

[0109] Specifically, in one alternative implementation, the first party P A Second party P B A sample set with different characteristics, where P A Having m A One feature (i.e., the first feature), P B Having m B The first feature (i.e., the second feature) and the label information Y. For example... Figure 3 As shown, both parties can obtain the secret share matrix output by the fully anonymous bucketing protocol after jointly computing through secret sharing (i.e., anonymous primary key privacy intersection, anonymous primary key privacy bucketing). <d>= <B1||U1||X1||...||B m ||U m ||X m ||Y>, the matrix includes n rows and 3m+1 columns. n is the total number of intersection samples, m = m A +m B is the total number of features. <B i > represents the slice of the bucket number of the i-th feature, <U i > represents the slice of the bucket boundary marker value of the i-th feature, <X i > represents the slice of the feature value. The first 3m columns of the matrix represent the slices of the bucket number, the slice of the bucket boundary marker value, and the slice of the feature value corresponding to each feature respectively. The last column is the slice of the label value <y>|| represents the connector of each column data in the matrix.

[0110] In addition, when i takes values from 1 to m A , the corresponding slice is the slice corresponding to the first feature, that is, the slice corresponding to the feature owned by the first party P A . Correspondingly, when i takes values from m B +1 to b, the corresponding slice is the slice corresponding to the second feature, that is, the slice corresponding to the feature owned by the second party P B .

[0111] Each row in the matrix corresponds to an intersection sample, and every 3 columns correspond to a feature. For example, for the first row of the matrix owned by the first party P A , the first three elements respectively represent: the first slice of the bucket number corresponding to the feature numbered 1 in the first feature of the first intersection sample, the first slice of the bucket boundary marker value, and the first slice of the feature value.

[0112] In addition, here b represents the number of buckets corresponding to each feature, so all features correspond to m*b buckets. The bucket number can take values from 1 to m*b, wherein the bucket number corresponding to the feature numbered 1 is 1-b, and so on.

[0113] After obtaining the bucket data of the anonymous primary key intersection sample to be processed, the bucket data needs to be extracted, that is, the ciphertext information of the bucket threshold corresponding to each bucket is extracted. The bucket data extraction corresponds to steps 203-207. Next, steps 203-207 will be described in detail.

[0114] Step 203, receiving the second slice of the bucket number corresponding to the second feature of each intersection sample and the second slice of the bucket boundary marker value sent by the second party, and based on the first slice of the bucket number and the first slice of the bucket boundary marker value, the second slice of the bucket number corresponding to the second feature of each intersection sample and the second slice of the bucket boundary marker value are determined by secret sharing decryption.

[0115] Specifically, the first party will perform secret sharing decryption on the bucket number and the bucket boundary marker value of the second feature (that is, the feature owned by the second party) corresponding to each sample. In this way, the first party can use the bucket number and the bucket boundary marker value of the second feature of each sample to determine which intersection sample has a feature value taking the bucket threshold value of the corresponding bucket, so as to extract the bucket threshold plaintext corresponding to each bucket in step 207.

[0116] Specifically, for each intersection sample, since the first party already has the first shard of the bucket number corresponding to the second feature of the intersection sample, after obtaining the second shard of the bucket number corresponding to the second feature of the intersection sample, the first shard and the second shard can be used to perform secret sharing decryption. Similarly, the bucket boundary marker value corresponding to each intersection sample can also be decrypted by secret sharing.

[0117] It should be further noted that since the second feature is a feature held by the second party, even if the first party obtains the bucket boundary marker and the bucket number corresponding to the second feature of each sample, it cannot obtain any additional information (such as the primary key of the intersection sample, the feature value of the second feature, etc.) according to the bucket boundary marker value and the bucket number. Therefore, the first party assists the second party to extract the bucket number and the bucket boundary marker value of each sample, and this process can protect data privacy.

[0118] In order to enable the first party to determine which shard the received data corresponds to, the second party can transmit the second shard of the bucket number of the second feature of each intersection sample in the form of a matrix or an array, so that the corresponding first shard can be determined according to the position of each second shard in the matrix or array. In addition, the intersection sample can be renumbered after the intersection sample is determined, and the correspondence between the shards can be identified according to the number, such as the shard of the bucket number corresponding to the first intersection sample. The number is also identification information, but the original primary key of the sample generally includes an identification (such as a mobile phone number, etc.) that can uniquely identify a sample, and the above renumbering does not reveal any data privacy.

[0119] Here, the specific example mentioned in step 201 will be further described. Specifically, P B From <d> B extracting the fragments and sending them to P A . P A decrypts the received fragments and the corresponding fragments held by P secretly at home. As Figure 3 shown, P A obtains the bucket number and the bucket boundary marker value of the m B second features of the intersection sample after decryption and

[0120] Correspondingly, the second party can also obtain the bucket number and the bucket boundary marker value of the first feature of each intersection sample through similar operations.

[0121] Specifically, P A extracts the fragments <d> A Extracting fragments Send it to P B P B Locally utilize the received fragments and the corresponding fragments held by the user. To conduct secret sharing and decryption. For example... Figure 3 As shown, P B The first m can be obtained by decryption. A Bucket numbering of intersecting data features and bucket boundary marker values

[0122] Step 205: Receive the homomorphic ciphertext of the second fragment of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the feature value of the second feature of each intersection sample based on the homomorphic sum of the second fragment and the feature value.

[0123] Specifically, the first party can determine the homomorphic ciphertext of the second feature of each intersection sample based on the homomorphic ciphertext of the second segment of the feature value and the homomorphic sum of the first segment.

[0124] First, let's explain homomorphic encryption. Homomorphic encryption algorithms are a common encryption method used in privacy-preserving computing. Compared to ordinary encryption, homomorphic encryption possesses the property of homomorphism, meaning that computation can be performed on data in its encrypted state. For example, performing a homomorphic addition operation on the homomorphically encrypted ciphertext [a] of 'a' and the unencrypted data 'b' yields the ciphertext [a+b] of 'a+b', and the operation does not reveal 'a', 'b', or 'a+b', nor does it require the use of a decryption key.

[0125] The aforementioned homomorphic sum, which is the result of homomorphic addition of the second fragment's homomorphic ciphertext with the first fragment, is obtained through homomorphic addition. Furthermore, homomorphic addition is not a direct summation of plaintext and ciphertext; rather, it is achieved through a different method where the result is equivalent to adding the corresponding plaintexts of the two data points and then encrypting them.

[0126] To prevent privacy leaks, the homomorphic ciphertext of the second segment can be encrypted using the second party's public key. Based on the characteristics of asymmetric encryption, this homomorphic ciphertext can only be decrypted by the second party's private key. Therefore, even if the first party obtains the homomorphic ciphertext of the second feature values ​​of all intersection samples, it cannot decrypt it, and no privacy is leaked in the above process.

[0127] The specific embodiments described above will still be used for illustration.

[0128] For ease of explanation, this specification uses brackets [X] to indicate that the variable is homomorphically encrypted. Where [X]... A The A in the upper right corner indicates that the ciphertext was sent by P. A public key encryption, the corresponding private key belongs to P A Only P A can decrypt the ciphertext. Correspondingly, [X] B The B in the upper right corner of indicates that the ciphertext can only be decrypted by P B .

[0129] Specifically, P B from <d> B extracting the fragments obtained by using homomorphic encryption and send them to P A . P A At home, using the received fragments and the corresponding fragments held by oneself, homomorphic addition operation is performed to obtain ciphertext under homomorphic encryption only

[0130] Correspondingly, the first party can also homomorphically encrypt the first fragments of the feature values corresponding to the first features of each intersection sample held by oneself and send them to the second party. The second party uses the homomorphic ciphertext of the first fragments and the homomorphic sum of the second fragments to obtain the homomorphic ciphertext of the feature values corresponding to the first features of each intersection sample.

[0131] Specifically, P A from <d> A Extracting fragments Obtain using homomorphic encryption Send it to P B P B Locally utilize the received fragments and the corresponding fragments held by the user. Perform an accumulation operation to obtain the ciphertext under homomorphic encryption only.

[0132] The above process is as follows Figure 3 As shown, the first party and the second party respectively hold the homomorphic ciphertext of the feature values ​​of the features held by the other party.

[0133] Step 207: Determine the bucket threshold homomorphic ciphertext for each bucket corresponding to the second feature based on the bucket number, bucket boundary marker value, and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample.

[0134] Specifically, through step 203, the first party can determine the bucket number and bucket boundary marker value corresponding to the second feature of each intersection sample. Through step 205, the first party can obtain the homomorphic ciphertext of the feature value corresponding to the second feature of each intersection sample. Then, the first party can traverse the bucket numbers of each sample, and in the intersection samples corresponding to each bucket, determine the bucket boundary marker value to represent the sample whose feature value is the corresponding bucket threshold, and use the homomorphic ciphertext of the feature value of the determined sample as the homomorphic ciphertext of the bucket threshold corresponding to that bucket.

[0135] We will continue with the specific examples from the previous text. A according to and After m can be obtained B The positions of the bucket boundary marker values ​​corresponding to the second feature in the aforementioned eigenvalue matrix can then be extracted. The homomorphic ciphertext value at the corresponding position in the middle is used as the homomorphic ciphertext for the corresponding bucketing threshold. Among them, each S j The array size is b, which is the number of buckets corresponding to this feature.

[0136] Correspondingly, the second party can also obtain the bucket threshold homomorphic ciphertext of each bucket of the first feature based on the bucket number and bucket boundary marker value of the first feature of each intersection sample obtained by secret sharing and decryption, as well as the homomorphic ciphertext of the feature value.

[0137] Specifically, P B according to and It is possible to obtain the top m A Each feature is defined as a bucket number and its corresponding position in the feature value array. Then, the features are extracted. The ciphertext value of the corresponding position is taken as a secret share of each bucket threshold Each array S i has a size of b.

[0138] The above steps 203-207 provide a tree model training method for non-feature parties to extract bucket information for efficient auxiliary calculation. Specifically, for the second feature held by the second party, the first party extracts the ciphertext of the corresponding bucket threshold. In this way, the second party cannot obtain any information about the intersection sample second feature in the above process. Even if the first party obtains the bucket number of each intersection sample second feature (i.e., knows the distribution information of the sample), the first party cannot obtain any privacy data because the first party cannot obtain the distribution data of the second feature value. The second feature value held by the first party is also protected by homomorphic encryption to protect data privacy.

[0139] In addition, the above method also provides a batch ciphertext element extraction method based on homomorphic encryption and secret sharing ciphertext conversion technology. The above process can be abstracted as a batch private information retrieval (PIR) in a secret sharing ciphertext array. The above method can perform infinite secure extraction operations. This method makes the data holder unaware of the position of the extracted or queried element in the array (i.e., the second party cannot know the position of the bucket threshold in the feature value array), and the extractor cannot know the plaintext information of the extraction result (i.e., the information of the feature value and the bucket threshold). Specifically, in step 205, the homomorphic encryption extraction table is initialized, and through this method, the bucket boundary value fragments are extracted in step 207. In an optional implementation, in the subsequent process, the homomorphic ciphertext of the above bucket threshold can be output to the corresponding fragment through the homomorphic encryption conversion secret sharing protocol to extract the information of the split point. The specific implementation of this example will be described below.

[0140] Next, the method of how to use the bucket threshold homomorphic ciphertext to train the tree model after extracting the bucket threshold homomorphic ciphertext will be described. Specifically, see steps 209-211.

[0141] Step 209, using the plurality of intersection samples, and the second party jointly performing joint training of the tree model to determine the split point of each non-leaf node in the tree model.

[0142] The split point is indicated by the bucket number of the feature.

[0143] As described above, after completing the bucketing, the derivatives of the plurality of intersection samples can be calculated, and for each non-leaf node, the bucket accumulation corresponding to the non-leaf node is calculated, and the gain value and the split point are calculated using the bucket accumulation.

[0144] Specifically, the above process can be similar to the execution method in the related art. Here, step 209 will be described through an embodiment, which does not represent a limitation on the present specification.

[0145] 1. Initialize the prediction value array.

[0146] The initialized prediction value array is the initial prediction value of each sample when no tree model is used to process the sample. For a tree other than the first tree, the prediction value used when the tree calculates the derivative value can be obtained according to the prediction value result of the previous trees, but for the first tree, the prediction value needs to be initialized.

[0147] For a specific initialization method, the prediction value array can be simply initialized as an all-0 array. In addition, the label holder can initialize the prediction value array according to the prediction value distribution of all samples.

[0148] After initializing the prediction value array, the prediction value array can be converted into secret share fragments held by the first party and the second party respectively, to facilitate subsequent calculation.

[0149] Following the specific embodiment in the foregoing, this step can be: P B Initialize the prediction value array and encrypt it into secret fragments held by both parties through secret sharing The above step corresponds to Figure 3 in which the two parties obtain the label value fragments, and the second party P B Initialize the prediction value.

[0150] 2. Here, the training process of the kth tree is described.

[0151] (1) The first party and the second party jointly perform the calculation of the derivative value of the intersection sample to obtain the derivative value fragment of each intersection sample; the derivative value is calculated according to the loss function of the tree model.

[0152] That is, the prediction result of the first k-1 trees and the label value fragment are used to calculate the first derivative value g and the second derivative value h of each intersection sample by using the gradient derivation formula in formula (3).

[0153] The prediction result of the first k-1 trees here, in the case of k greater than 1, can be the prediction value fragment obtained by the first k-1 trees trained to predict each intersection sample. In the case of k being 1, the prediction result can be the prediction value array initialized in 1.

[0154] The prediction result and the label value used above are both in the form of a shard because the method of the present specification shows a method of jointly training a tree model by the first party and the second party. In this scenario, in order to protect data privacy, the prediction value and the label value are generally split into secret share shards held by both parties.

[0155] Correspondingly, the first derivative value g and the second derivative value h described above are also data obtained by joint calculation by both parties using secret share multiplication, division, and other operations in a secret share scenario. The first derivative value g and the second derivative value h obtained by both parties also exist in the form of a shard. As can be known from the definition of the first derivative value and the second derivative value, the size of the label value can be inferred from the first derivative value and the second derivative value, especially in the process of processing the first tree, and therefore encryption in the form of secret sharing can be used here to protect data privacy.

[0156] Specifically, continuing with the example above, this step can be: both parties use the prediction value shard and the label value shard held by both parties to calculate the first derivative value g and the second derivative value h of the kth tree in the form of a secret share. and the gradient derivation formula g = σ (p k ) - y, h = (1 - σ (p k )) · σ (p k ), to calculate the derivative value {<g i >, <h i >} i∈[1,n] in a secret share scenario. This step corresponds to the content of the middle box in the red dashed box in Figure 3 , which is the process of deriving the first derivative value array and the second derivative value array of the kth tree by sigmoid according to the prediction value shard and the label value shard held by both parties. Figure 3 The red line at the bottom of the box in Figure 3 connects this step, that is, the prediction value array used in this step is derived from the prediction value calculated according to the k-1th tree.

[0157] wherein is the prediction value of the first k-1 trees, and has the same meaning as in formula (3). The meanings of other elements are described above and will not be described here.

[0158] It should be noted that this step does not involve the use of bucketing information and can be the same as the implementation method in related technologies. The above example is only an optional implementation manner and does not represent a limitation of the present specification.

[0159] (2) Optionally, in order to facilitate calculation, the sample distribution of the root node (i.e., the first node of the tree) can be initialized first.

[0160] The sample distribution is equivalent to regarding the root node as having a previous node before the root node, and determining which intersection samples fall into the root node after processing the split condition of the previous node split. According to the definition of the sample distribution, the sample distribution of the root node can be initialized as data representing all nodes falling into the current node.

[0161] For example, in the case where 1 represents that an intersection sample falls into the current node, and 0 represents that an intersection sample does not fall into the current node, the initialized sample distribution can be an array of all 1s.

[0162] Specifically, following the example in the foregoing, it can be P A Initialize the sample distribution of the root node locally is a full 1 vector of size n. Similarly, P B Initialize a full 1 vector of size n locally Here corresponds to Figure 3 the sample distribution initialized by both parties in

[0163] This initialization is because, in subsequent steps, the sample distribution is used to determine which samples fall into the current node when performing bucket accumulation. By initializing the sample distribution of the root node, similar to initializing the prediction value matrix, all non-leaf nodes can be processed by the same set of processing logic, which facilitates training.

[0164] In addition, in an optional implementation, for the sample distribution of each node, the first party and the second party can jointly own the sample distribution in the form of "and calculation secret sharing".

[0165] Specifically, for the lth node, the two parties hold These two arrays are ciphertext arrays. For the jth sample, only in the case of , it can be determined that the jth sample falls into the lth node.

[0166] (3) For each (for example, the lth) non-leaf node, perform:

[0167] (3.1) The first party obtains the homomorphic ciphertext of the derivative value of the first intersection sample according to the secret sharing conversion homomorphic encryption protocol jointly executed by the first party and the second party. The first intersection sample is an intersection sample falling into the non-leaf node.

[0168] Correspondingly, the second party also performs a similar method to obtain the homomorphic ciphertext of the derivative value of the first intersection sample.

[0169] In specific implementation, the derivative value homomorphic ciphertext corresponding to all intersection samples can be obtained. Specifically, the first party and the second party jointly execute a secret sharing to homomorphic encryption protocol to obtain the derivative value homomorphic ciphertext of each intersection sample. The derivative value homomorphic ciphertext obtained by the first party can be encrypted by the private key of the second party, and the derivative value homomorphic ciphertext obtained by the second party can be decrypted by the private key of the first party.

[0170] For the method of obtaining the derivative value homomorphic ciphertext corresponding to the first intersection sample, the distribution of the intersection sample corresponding to each node will be updated by using the split point in the following text. The first-order derivative value slice and the second-order derivative value slice are updated by using the secret sharing product of the sample distribution and the slice of the first-order derivative value and the second-order derivative value. In this way, for any node, the derivative value of the intersection sample not falling into the node is set to 0. Further, the derivative value slice of the same intersection sample in different nodes can be different, so the step needs to be executed once in each node.

[0171] In addition, in the above step, the sample distribution can be determined by the "and calculation secret sharing" method as described above. In this case, the above method can ensure that the derivative value slice is updated when both parties cannot obtain the accurate sample in which the intersection sample falls, and the security is stronger.

[0172] The secret sharing to homomorphic encryption protocol can be that the second party locally homomorphic encrypts the slice of the derivative value and sends it to the first party. The first party calculates the homomorphic ciphertext of the derivative value slice and the homomorphic sum of the locally held derivative value slice to obtain the derivative value homomorphic ciphertext of each intersection sample.

[0173] Here, the specific example in the foregoing is still used for illustration. B Locally homomorphic encrypting {<g i > B , <h i ) B} i∈[1，n] Performing homomorphic encryption to obtain {[<g i > B ] B , [<h i > B ] B} i∈[1，n] and sending it to P A . P A Local {<g i > A , <h i > A} i∈[1，n] and {[<g i > B ] B , [h i > B ] B} i∈[1，n] Add up, get ciphertext array of homomorphic encryption only {[g i ] B , [h i ] B} i∈[1，n] The method for the second party to obtain the derivative value homomorphic ciphertext is similar to here, and will not be described here. Here corresponds to the A2H process in Figure 3 , that is, the process of secret sharing conversion to homomorphic encryption.

[0174] (3.2) Obtain the derivative cumulative value corresponding to each sub-bucket.

[0175] The derivative cumulative value corresponding to each sub-bucket, that is, the sum of the derivative values corresponding to the sub-bucket falling into the intersection sample of the node.

[0176] The specific obtaining method can be that the first party sends the sub-bucket number of the second feature of each intersection sample obtained in the above step to the second party, and the second party locally adds the derivative value of the sub-bucket corresponding to the second feature according to the sub-bucket number of the intersection sample and the sample distribution of each node. At the same time, the first party also adds the derivative value of each sub-bucket corresponding to the second feature according to the sub-bucket number of the second feature of each intersection sample and the sample distribution corresponding to each node. In this way, for the second feature, the first party and the second party can simultaneously obtain the derivative cumulative value of each sub-bucket corresponding to the second feature.

[0177] The processing method for the first feature is similar, and will not be described here.

[0178] In addition, the derivative cumulative value (here the homomorphic ciphertext of the derivative cumulative value) can also be obtained by the method in the following example.

[0179] Considering that the second party has the distribution of all samples, there is a possibility that the intersection sample can be inferred from the sub-bucket number corresponding to the intersection sample. Therefore, in order to further improve security, the first party can also add the derivative value homomorphic ciphertext of the first intersection sample belonging to each sub-bucket corresponding to the second feature to obtain the derivative cumulative value homomorphic ciphertext corresponding to each sub-bucket of the second feature. Correspondingly, the second party can also obtain the derivative cumulative value homomorphic ciphertext corresponding to each sub-bucket corresponding to the first feature.

[0180] Specifically, for the samples falling into the node in the sample distribution, the first party can perform homomorphic addition operation on the homomorphic ciphertext of the derivative value of the intersection sample of each bucket according to the bucket number corresponding to the second feature of each intersection sample obtained in the above steps, to obtain the derivative accumulation value homomorphic ciphertext of each bucket. The second party handles the method similarly, and will not be described here.

[0181] Still using the example in the above, the specific implementation of this step can be: P A Initialize the all-0 gradient bucket accumulation matrix Then, P A According to the bucket information And the sample distribution information Satisfy The corresponding [g j ] B ,[h j ] B Accumulate to , where B i,j is the bucket number corresponding to the i-th feature of the j-th sample. Here, it corresponds to the process of calculating the secret sharing of the derivative accumulation value ciphertext [G] and [H] by the two parties in Figure 3 .

[0182] It needs to be explained that in the case where the sample distribution is represented in the form of "and calculation secret sharing" ciphertext, does not mean that the corresponding intersection sample falls into the node. However, since the derivative value slice is updated by using the "and calculation secret sharing", for But the j-th intersection sample does not fall into the l-th non-leaf node, the plaintext of the derivative value ciphertext [g j ] B ,[h j ] B is actually updated to 0. In this way, even if the ciphertext is accumulated only for the corresponding derivative accumulation value, it will not affect the correctness of the result of the bucket accumulation matrix.

[0183] (3.3) Calculate the split point using the derivative accumulation value corresponding to each bucket.

[0184] The specific meaning of the split point is described in the foregoing description, and here the calculation method of the split point will be described by taking the information gain method as an example. The specific calculation and derivation process of the information gain method is shown in formula (8), which will not be described here.

[0185] Specifically, this step can be that both parties use the derivative accumulation value slice obtained in the example of 3.2 to jointly calculate the split point by using the information gain method. The process is similar to the specific implementation process of related technologies, and will not be described here.

[0186] In the case of the homomorphic ciphertext of the derivative cumulative value obtained in the second example of 3.2, the step can be: according to the homomorphic ciphertext of the derivative cumulative value corresponding to each sub-bucket, using the information gain method, and the second party jointly determines the split point of the non-leaf node; the second party has the homomorphic ciphertext of the derivative cumulative value of each sub-bucket corresponding to the first feature.

[0187] Next, the above process will be described in detail.

[0188] In this example, although the homomorphic ciphertext of the derivative cumulative value is held, considering that the division operation of the homomorphic ciphertext is not easy to implement for the homomorphic ciphertext, the derivative cumulative value homomorphic ciphertext can be converted into the form of secret sharing fragments first. And using the four arithmetic operations of the secret sharing multiplication and division of the two parties, the gain value corresponding to each sub-bucket is determined by using formula (8). And based on this, the split point is determined.

[0189] In other words, the above process specifically includes: first, the first and second parties jointly execute the homomorphic encryption to secret sharing protocol to obtain the derivative cumulative value fragments corresponding to each sub-bucket.

[0190] Among them, the sub-buckets obtained here can include: sub-buckets corresponding to the first feature, and sub-buckets corresponding to the second feature.

[0191] The specific implementation of the homomorphic encryption to secret sharing protocol can refer to the implementation in the related art. The homomorphic encryption to secret sharing can complete the conversion of the two encryption protocols while ensuring that the specific plaintext is not leaked. Here, the process of homomorphic encryption to secret sharing will be illustrated through a specific example, which does not represent a limitation of the present specification.

[0192] The first party has the homomorphic ciphertext of the first data. The two parties generate random numbers f1 and f2 respectively, the second party homomorphically encrypts f2, and sends the homomorphic ciphertext of f2 to the first party. The first party generates two secret sharing fragments of f1, and sends the fragments to the other party. For example, the first party generates fragment 1 and fragment 2 of f1, can hold fragment 1 itself, and sends fragment 2 to the second party.

[0193] The first party can calculate the homomorphic sum of the homomorphic ciphertext of the first data, the homomorphic ciphertext of f2, and f1, and send the homomorphic sum to the second party for decryption. The second party obtains the plaintext of the sum of the first data, f1 and f2. Further, the second party can obtain the plaintext of the sum of the first data and f1 according to the locally held plaintext of f2, which is referred to as the second data here. Further, the second party can generate two fragments of the second data, and send the corresponding fragments to the first party. Further, the two parties use the fragments of the second data held by each party to subtract the fragments of f1, and obtain the fragments of the first data held by each party.

[0194] Still using the specific example above to illustrate this step:

[0195] First, P A Using homomorphic encryption to secret sharing protocol, joint P B Will Become a secret share of both parties holding Similarly, both parties can also get the first feature of each bucket derivative cumulative value share This step corresponds to Figure 3 H2A (Homomorphic Encryption to Arithmetic Secret Sharing) process, that is, from the homomorphic ciphertext of the derivative cumulative value matrix held by both parties, through the homomorphic encryption to secret sharing protocol, get the derivative cumulative value share (also known as derivative sum) of each bucket.

[0196] Second, merge two gradient bucket cumulative matrices (that is, the derivative cumulative value share corresponding to each bucket), obtain {<G i,q >,<H j,q >} i∈[1,m],q∈[1,b] .

[0197] Second, using the information gain method, according to the derivative cumulative value share corresponding to each bucket, and the second party jointly executes secret sharing four arithmetic operations to determine the gain value corresponding to each bucket.

[0198] Here will use the specific example above for further illustration.

[0199] Both parties use decision tree calculation rules and tree model gain value calculation formula under MPC scenario Obtain the {<Gain i,q >} corresponding to each bucket boundary value i∈[1,m],q∈[1,b] , Where Here corresponds to Figure 3 In, both parties jointly obtain <gl> 、 <gr> 、 <hl>, <hr> and calculates a gain value <gain>the process of claim 1.

[0200] <gl>For the qth bucket of the ith feature, the derivative value slice of the second intersection sample is. The second intersection sample is: the intersection sample falling into the non-leaf node, the intersection sample belonging to the bucket, and the intersection sample belonging to the number value less than the bucket. It can be understood as the derivative cumulative value slice of the intersection sample corresponding to the bucket threshold value left of the bucket.

[0201] <gr>the meaning of <gl>Similarly, it will not be repeated here.

[0202] It should be noted that, {(Gain i,q} i∈[1,m],q∈[1,b] It is obtained by both parties using secret sharing four arithmetic joint calculation, rather than local calculation of both parties.

[0203] Third, according to the secret comparison method, the gain value corresponding to each bucket is compared, and the split point of the non-leaf node is determined.

[0204] Specifically, the maximum gain value in the gain value can be determined according to the secret comparison, and the bucket threshold of the bucket corresponding to the maximum gain value is taken as the split point of the leaf node. The split point specifically includes the feature and the feature value.

[0205] Among them, the secret comparison can refer to the scheme for comparing the size of the ciphertext by using secret sharing in the related art. For example, the secret comparison scheme based on the confusion circuit, the secret comparison scheme based on the GMW (Goldreich-Micali-Wigderson) protocol, etc. In addition, in the case of paying more attention to efficiency, the accuracy of the split point can also be reduced to improve the efficiency. Specifically, among the larger number of gain values obtained through several secret comparisons, a gain value corresponding to a bucket is randomly selected as a split point. For example, there are four gain values in total. After two comparisons, it is determined that the larger gain value in the first gain value and the second gain value is the first gain value, and the larger gain value in the third gain value and the fourth gain value is the fourth gain value. Then, a gain value corresponding to a bucket is randomly selected or selected through a specific selection logic as a split point.

[0206] Here, the specific example in the foregoing will be used to illustrate this step. Specifically, both parties can use the privacy extreme value solving method to obtain the secret shard <max_idx> of the bucket number corresponding to the maximum value in {<Gain i,q} i∈[1,m],q∈[1,nb]}

[0207] In addition, after the above step is executed, it can also be determined whether the split point corresponds to the first feature bucket or the second feature bucket. Here, a specific embodiment will be used to illustrate the above process, which does not represent a limitation on the present specification.

[0208] As described above, the split point can be indicated by the shard of the bucket number, and the number of the bucket corresponding to each feature can be a sequential number. Then, it can be determined that the first number of the bucket number corresponds to the first feature bucket.

[0209] Then, by the privacy comparison method jointly performed with the second party, the size relationship between the split point corresponding to the bucket number and the first quantity is determined by using the held split of the bucket number corresponding to the split point; in the case where the split point is greater than the first quantity, the split point is determined to be the bucket number corresponding to the second feature. Correspondingly, in the case where the split point does not exceed the first quantity, it can be determined that the split point is the bucket number corresponding to the first feature.

[0210] The method of privacy comparison can refer to the method in the related art, which will not be repeated here.

[0211] Here, the step will be described by following the specific example in the foregoing.

[0212] For a specific method, the two parties can first determine the size relationship between the split of the split point and m A ×nbby the privacy comparison method. Thus, it is determined whether the feature of the split point is the first feature or the second feature.

[0213] Step 211, in the case where the split point is the bucket number corresponding to the second feature, the bucket threshold homomorphic ciphertext corresponding to the bucket number is obtained to determine the split condition corresponding to the split point according to the bucket threshold homomorphic ciphertext and the second party, and the calculation of the leaf node weight value is performed based on this.

[0214] Specifically, since the bucket threshold of each bucket of the second feature is held by the first party in the form of homomorphic ciphertext, the first party can use the homomorphic ciphertext held to determine the split point, determine the sample distribution of the subsequent node of the node, and perform the calculation of the leaf node weight value in the subsequent step.

[0215] Step 211 can include two steps, one is to generate the split condition of the tree model non-leaf node, that is, to update the sample distribution of the next node; and the other is to perform the calculation of the leaf node weight value. Here, the two processes will be described respectively.

[0216] For the determination of the split condition, two specific embodiments will be described here, which do not represent the limitation of the present specification.

[0217] In the case where the feature of the split point is the second feature, belongs to the second party, and the two parties hold the split of the split point, the first implementation manner can be:

[0218] Since in the tree model under the general MPC scenario, if the split condition corresponding to the non-leaf node is the second party's feature, the second party will hold the split condition of the node. Therefore, the corresponding <max_idx> plaintext can be disclosed to the second party here, that is, the first party sends the <max_idx> to the second party in fragments, and the second party decrypts it. Further, according to max_idx = i x b + j, it is known that the split boundary of the first node is the jth bucket of the ith feature.

[0219] Further, since the second feature's bucketing threshold value held by the second party is held by the first party, the second party can input max_idx from the homomorphic ciphertext of the bucketing threshold value of each bucket of the second feature held by the first party to obtain the bucketing threshold value homomorphic ciphertext corresponding to max_idx. The private key held by the second party is used to decrypt it to obtain the corresponding split condition.

[0220] <max_idx) is less than m A The case of <max_idx) is greater than m x b is similar and will not be repeated.

[0221] In addition, considering that if the second party obtains the bucketing threshold value corresponding to a specific bucket of the second feature, there is: the second party can infer which samples are intersection samples according to the bucketing threshold value. For example, the bucketing threshold value of a certain bucket of a certain feature is 1, and only a certain sample of the second party has a value of 1 for the feature, so it can be determined that the sample is definitely an intersection sample. For example, a certain feature is divided into 10 buckets, and the bucketing threshold value of the fifth bucket is 5 (which can be obtained according to max_idx), and all samples are bucketed according to the values of the feature. The bucketing threshold value of the fifth bucket may be 6, so it can be determined that some samples with large feature values are not intersection samples, which may leak some information.

[0222] Therefore, a second implementation method is also proposed in the specification: specifically, if <max_idx) is greater than m A x b, if <max_idx) is less than m x b, it means that the feature is the second feature, and the sample distribution information and the bucketing threshold value are managed by the first party P A . The <max_idx) can be disclosed to P A specifically, the second party can send the bucket number corresponding to the split point held by the second party in fragments, and the bucket number corresponding to the split point is decrypted by secret sharing. Conversely, the <max_idx) is disclosed to P B . In combination Figure 3 , this step corresponds to the process of obtaining <max_idx) by SS comparison (i.e., secret comparison) in Figure 3 , and disclosing the split point to whom the bucket information of the split point belongs.

[0223] Assume P B Obtain max_idx, then P B The first node's split boundary can be known by max_idx = i x b + j, which is the jth bucket of the ith feature. B The distribution of n samples is determined by the bucket number j Update to determine the sample distribution information of the left and right child nodes 21 and 21+1 of the first node, that is Here corresponds to Figure 3 The process of updating the sample distribution of the node by both parties. Since the bucket number of the split point is only disclosed to the second party, the first party updates the locally stored sample distribution according to the "secret sharing" method mentioned above.

[0224] Then extract the ciphertext of the bucket threshold value corresponding to the first feature [S i,j ] A Convert it to a secret sharing shard value <T k,l > as the split threshold of the current node. Here it corresponds to the process of extracting the split point threshold value shown in Figure 4

[0225] In other words, the bucket threshold value corresponding to the split point can be processed into a bucket threshold value shard by a homomorphic encryption to secret sharing protocol jointly executed by the second party, and the bucket threshold value shard is used as the split condition of the non-leaf node. It should be noted that if both parties hold the plaintext of the split point, the bucket threshold value shard can also be obtained by a homomorphic encryption to secret sharing protocol jointly executed by the second party, and the split condition of the first leaf node is obtained.

[0226] Through the above steps, both parties finally obtain the split condition of the node, and <T k,l > and the corresponding feature number (plaintext or ciphertext). Due to the different split conditions of the node in this method and related technologies, the prediction method used in the tree model also needs to be changed here. For each node, both parties need to jointly predict.

[0227] Finally, after obtaining the bucket threshold value of the split point (i.e. the split point threshold value), both parties can jointly update the derivative value array through their respective sample distribution. The process is described in detail in the previous description of the derivative cumulative value array, and will not be repeated here. In order to facilitate calculation, the joint calculation of the two parties And The secret sharing product operation of <g l > array is performed to obtain the respective <g 2l > shard array. For <g 2l+1 >, the derivative value array can be calculated according to <g​ l >and <g 2l The secret is obtained through subtraction. <h 2l >and <h 2l+1 The calculation method for > is similar and will not be repeated here. This step corresponds to the process of updating the derivative value array in the last joint calculation box within the blue dashed box.

[0228] Here, although the second party can update based on the split point. and However, since the split point of the node preceding this node may not be owned by the second party, it can only be achieved through... and It cannot obtain accurate information about the intersection samples of that node. Therefore, it is necessary to utilize the first-party... The derivative value is updated through secret sharing and computation performed jointly.

[0229] The following section explains the calculation method for leaf nodes, specifically for the l-th leaf node:

[0230] First, determine the intersection samples falling into the leaf node, and the ciphertext of the derivative values ​​of these intersection samples. For details on how to obtain these values, please refer to the previous step. After obtaining the ciphertext of the derivative values ​​of the leaf node, you can accumulate the ciphertext of the derivative values ​​of each intersection sample falling into the leaf node to obtain the cumulative derivative value corresponding to the leaf node. Then, use this cumulative derivative value to calculate the weight value of the leaf node.

[0231] It's important to note that in privacy-preserving scenarios involving anonymous primary keys, revealing which intersection samples fall into the current leaf node could potentially leak the primary key information of those intersection samples. Therefore, to protect data privacy, the aforementioned accumulation of the ciphertext derivative values ​​of each intersection sample falling into the leaf node can specifically involve retrieving the updated ciphertext array of derivative values ​​and accumulating all values ​​within that array. The length of the ciphertext array is equal to the number of intersection samples. When updating the ciphertext array, based on the sample distribution, the plaintext derivative values ​​of intersection samples not falling into the current node are set to 0. This ensures that accumulating all contents of the ciphertext array does not affect the accuracy of the final result. This achieves weight accumulation while maintaining privacy.

[0232] We will continue to use the specific examples from the previous text for illustration:

[0233] Based on the results obtained by both parties in the previous step <g l >and <h l >(here) l It refers to the first l (each leaf node) calculates the cumulative derivative value of that leaf node locally. <g1>and <h1>, in particular, P A computing <g1> A =∑ i∈[n] < g l [i] A and <h1> A =∑ i∈[n] <h l [i]> A , P B Compute <g1> B =∑ i∈[n] < g l [i] B and <h1> B =∑ i∈[n] < h l [i] B .

[0234] Further, both parties jointly use secret sharing addition, division calculation, and the respective holding of {x <g1> ， <h1>Input leaf node weight ciphertext value calculation formula Obtain the leaf node calculation weight value

[0235] In addition, considering that, for the leaf node, the updated <g l > and <h l > only participate in the calculation of the calculation of the leaf node weight value, and are not used in other steps. While the <g l > and <h l > of the updated leaf node require a large number of secret shared multiplication operations, specifically, the multiplication operation of the calculated sample distribution situation ciphertext and the <g <g>and <h>Multiplication and secret sharing are time-consuming, which wastes computing resources.

[0236] Therefore, the present specification also provides another way to obtain the leaf node weight value. One party that does not hold the parent node split point first obfuscates the derivative accumulation value slice array. And through the passive transmission, the other party obtains the obfuscated derivative accumulation value slice corresponding to the split point, and obtains the first slice according to the locally held derivative accumulation value slice corresponding to the split point and the obfuscated slice. The party that does not hold the split point uses the random number used during obfuscation as the second new slice. The two parties jointly use the first new slice and the second new slice to calculate the weight value.

[0237] Specifically, the above process of calculating the leaf node weight value can include: based on the bucket number of the parent node split point, the first slice of the derivative accumulation value of the bucket threshold corresponding to the split point, and the derivative accumulation value slice array held by the second party, and based on the passive transmission, the second party jointly obtains the first new slice of the derivative accumulation value corresponding to the bucket threshold of the parent node split point; the derivative accumulation value slice array includes a plurality of derivative accumulation value slices corresponding to the bucket threshold used when calculating the split point, and each derivative accumulation value slice corresponding to the bucket threshold includes the sum of the derivative value slice of the intersection sample whose characteristic value is less than or greater than the bucket threshold; the derivative value slice is calculated by the second party jointly according to the loss function of the tree model; and the first new slice is used to jointly calculate the leaf node weight value with the second party.

[0238] Among the above passive transmission, the first party can input the corresponding bucket number, and the second party can input the obfuscated derivative accumulation value slice array. So that the first party can obtain the obfuscated derivative accumulation value slice corresponding to the bucket number.

[0239] It should be noted that the derivative accumulation value slice array mentioned here is different from the meaning of the derivative accumulation value slice corresponding to each bucket calculated in the foregoing. Here, the derivative value accumulation value slice corresponding to each bucket threshold can include a left derivative accumulation value slice and a right derivative accumulation value slice, and the left derivative accumulation value slice is the derivative accumulation value slice mentioned in the foregoing. <gl>, the right derivative cumulative value segment, i.e. the aforementioned <gr>.

[0240] The above-mentioned confusion method can be specifically confusion using random numbers. Specifically, when obtaining the first new shard, the specific steps performed by the first party include: taking the bucket number of the parent node split point as input, jointly performing oblivious transfer with the second party to obtain the shard data corresponding to the bucket number from the plurality of shard data of the second party; the plurality of shard data of the second party includes the difference between each shard of the derivative cumulative value shard array and the first random number; and taking the sum of the first shard of the derivative cumulative value and the shard data corresponding to the bucket number as the first new shard.

[0241] Correspondingly, the process performed by the second party includes: generating a first random number and determining the difference between each shard of the derivative cumulative value shard array and the first random number; based on the difference between each shard of the derivative cumulative value shard array and the first random number, and based on the oblivious transfer with the second party, so that the second party obtains the first new shard; and taking the second random number as the third new shard and jointly performing the calculation of the leaf node weight value with the second party.

[0242] When the second party holds the corresponding bucket number, the execution method is similar to the above, which can be that the first party generates a second random number and calculates the difference between each shard of the derivative cumulative value shard array and the second random number. The second party takes the bucket number of the split point as the input of the oblivious transfer, and the first party takes the difference between each shard of the derivative cumulative value shard array and the second random number as the input of the oblivious transfer, and the two parties jointly perform the oblivious transfer, so that the second party finally obtains the third new shard, which is the difference between the derivative cumulative value shard corresponding to the bucket number of the split point held by the first party and the second random number. Then the first party takes the second random number as the fourth new shard, and the two parties jointly use the third new shard and the fourth new shard to calculate the weight value of the leaf node using the formula (7) in the foregoing.

[0243] Among them, the first shard, the second new shard, the third new shard and the fourth new shard can respectively include a new shard of the first derivative value and a new shard of the second derivative value. When calculating the split point, the first derivative value and the second derivative value can be combined for calculation. When obtaining the first new shard of the first derivative value and the second derivative value, different random numbers can be used for confusion.

[0244] In addition, in the above example, the left derivative cumulative value shard and the right derivative cumulative value shard corresponding to the split point of the parent node are involved. Taking the first derivative value as an example, the maximum gain value in the left derivative cumulative value shard gain value corresponds to >Gl>, which is used to calculate the weight value of the leaf node on the left side corresponding to the parent node. Correspondingly, the maximum gain value is calculated as <gr>Used to calculate the weight value of the right leaf node corresponding to the parent node.

[0245] Taking the first derivative value as an example, the first new slice obtained by the above method can be as described above. <gl>The corresponding new shard can also be the above <gr>corresponding new shard. In addition, the first new shard described above can also include the first shard described above <gl>and the above <gr>corresponding new shards. In the first new shard only the above <Gl) or the above <gr>In the case of a corresponding new shard, due to <gl>and <gr>the sum of the derivative values of all intersection samples falling into the parent node, which is a fixed value, so that the fixed value can be used to subtract the first new shard by using a secret sharing subtraction operation, to obtain a new shard for calculating the first derivative value of another leaf node.

[0246] Next, the above process will be described along with the specific embodiments described above.

[0247] First, assume that the split point of the parent node of the lth leaf node is P B holds, then P B The leaf node weight formula can be directly obtained by max_idx obtained in the above steps In the above formula, the required <g>and <h>In {<Gl i，q >, <Hl i，q >} i∈[1，m]，q∈[1，nb] corresponding position d. In an optional embodiment, d and max-idx can be the same.

[0248] Second, since P A does not know the corresponding feature information and the maximum gain value of the parent node in {<Gl i，q >, <Hl i，q >} i∈[1，m]，q∈[1，nb] . Therefore, both parties obtain <g>and <h>, both parties get <g>and <h>corresponding third and fourth new shards, respectively. Specifically, first P A generate two random numbers rgand rh, and locally compute {<Gl i，q -rg> A , <Hl i，q -rh> A} i∈[1，m]，q∈[1，nb] , and then input this array as input to the OT protocol; at the same time, P B input d in the OT protocol, and obtain the OT protocol output <Gl d -rg> A , <Hl d -rh> A . Then, P B locally compute <g> B <Gl d -rg> A +<Gl d B <h> B ← <Hl d -rg> A + <Hl d > B ;P A Use rg and rh directly as secret fragments <g> A ←rg， <h> A ← rh.

[0249] Thirdly, the two parties obtain the weight value of the leaf node of the tree model through the formula

[0250] Through the above method, the calculation result obtained during the calculation of the parent node is used, and the number of secret sharing multiplication operations is greatly reduced through a small number of inadvertent transmissions, thereby improving the calculation efficiency of the weight value.

[0251] After the weight value of the leaf node is calculated, the prediction value segment of each intersection sample can be updated using the tree, and the tree model is output.

[0252] Using the specific example in the foregoing, for each intersection sample i, the two parties update the prediction result through where f k (i) is the leaf node number corresponding to the i-th sample, which can be obtained by multiplying the bit of each leaf node by and obtain the one-hot encoding vector of f k (i), and then the vector is multiplied by <w>Dot product obtains as the weight value of the leaf node. This step also corresponds to Figure 5 the step of updating the prediction value in the formula. Finally, both parties output the feature information of the split point and the split threshold (i.e., the bucketing threshold) of each tree as the model output result of this tree model training. The split threshold output here can exist in the form of a slice.

[0253] The above method proposes a decision tree model training method for two-party anonymous primary key intersection. This method can protect data and data primary key ID while achieving fast and low-communication full-anonymous decision tree model. It solves the problem of not being able to use existing local plaintext for decision tree modeling in the full-anonymous encryption scene and the anonymous primary key intersection information scene.

[0254] Since the full-anonymous tree model needs to ensure that the feature holder cannot know the feature distribution information, the above method uses the feature that the non-feature holder cannot infer the non-feature holder's feature value and primary key ID information through the bucketing information when extracting the bucketing threshold homomorphic ciphertext. The non-feature holder is regarded as an efficient auxiliary computing party in model training, thereby solving the problem of securely and efficiently training a decision tree model in the anonymous primary key ID scene.

[0255] In addition, the above method also improves the calculation efficiency of the leaf node weight value through the inadvertent transmission method.

[0256] In addition, the present specification also provides a bucketing threshold extraction method applied to a first party, which also involves a second party, and the first party and the second party respectively hold samples including first features and second features. The flowchart of the method is as shown in Figure 6 , which includes:

[0257] Step 401: Obtain a plurality of intersection samples through joint execution of anonymous primary key privacy intersection with the second party, and obtain the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucketing number, and the first slice of the bucketing boundary marker value through the joint execution of the anonymous primary key privacy bucketing protocol with the second party. The bucketing boundary marker value is used to indicate whether the feature value of the intersection sample is the bucketing threshold of the corresponding bucket.

[0258] Step 403: Receive the second slice of the bucketing number corresponding to the second feature of each intersection sample and the second slice of the bucketing boundary marker value sent by the second party, and perform secret sharing decryption based on the first slice of the bucketing number and the first slice of the bucketing boundary marker value to determine the bucketing number and the bucketing boundary marker value corresponding to the second feature of each intersection sample.

[0259] Step 405, receiving the homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determining the feature value homomorphic ciphertext of the second feature of each intersection sample based on the homomorphic sum of the first shard of the feature value and the second shard;

[0260] Step 407, determining the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number corresponding to the second feature of each intersection sample, the bucket boundary marker value and the feature value homomorphic ciphertext; the bucket threshold homomorphic ciphertext is used for the first party and the second party to jointly train the model.

[0261] The specific implementation of steps 401-407 can be referred to the description of steps 201-207. The extracted bucket threshold can be used when the two parties jointly train other models, that is, the method can be used to complete the training as long as the training sample needs to be binned.

[0262] The present specification also provides a tree model joint training device, applied to a first party, and the first party and a second party hold samples including first features and second features respectively; as shown in the figure, Figure 1 The device comprises:

[0263] The bucketing module 510 is configured to obtain a plurality of intersection samples by performing an anonymous primary key privacy intersection in cooperation with the second party, and obtain the first shard of the feature value corresponding to the second feature of each intersection sample, the first shard of the bucket number and the first shard of the bucket boundary marker value by performing an anonymous primary key privacy bucketing protocol in cooperation with the second party, and the bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucket threshold of the corresponding bucket;

[0264] The secret sharing decryption module 520 is configured to receive the second shard of the bucket number corresponding to the second feature of each intersection sample and the second shard of the bucket boundary marker value sent by the second party, and perform secret sharing decryption based on the first shard of the bucket number and the first shard of the bucket boundary marker value to determine the bucket number corresponding to the second feature and the bucket boundary marker value of each intersection sample;

[0265] The homomorphic operation module 530 is configured to receive the homomorphic ciphertext of the second shard of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the feature value homomorphic ciphertext of the second feature of each intersection sample based on the homomorphic sum of the first shard of the feature value and the second shard;

[0266] The bucket threshold extraction module 540 is configured to determine the bucket threshold homomorphic ciphertext of each bucket corresponding to the second feature according to the bucket number corresponding to the second feature of each intersection sample, the bucket boundary marker value and the feature value homomorphic ciphertext;

[0267] The split point determination module 550 is configured to determine a split point of each non-leaf node in the tree model by using the plurality of intersection samples and jointly performing joint training of the tree model with the second party, and the split point is indicated by a bucket number of a feature.

[0268] The weight value calculation module 560 is configured to, in a case where the split point is the bucket number corresponding to the second feature, obtain homomorphic ciphertext of a bucket threshold corresponding to the bucket number, to determine a split condition corresponding to the split point according to the homomorphic ciphertext of the bucket threshold and the second party, and to perform calculation of a leaf node weight value based on this.

[0269] In an optional implementation, the split point determination module 550 is specifically configured to process the homomorphic ciphertext of the bucket threshold corresponding to the split point into a bucket threshold fragment by using a homomorphic encryption to secret sharing protocol jointly executed with the second party, and to use the bucket threshold fragment as the split condition of the non-leaf node.

[0270] In an optional implementation, the split point determination module 550 is specifically configured to jointly perform calculation of derivative values of the intersection samples with the second party to obtain a derivative value fragment of each intersection sample; the derivative value is calculated according to a loss function of the tree model; for each non-leaf node, the following is performed: according to a secret sharing to homomorphic encryption protocol jointly executed with the second party, obtain homomorphic ciphertext of the derivative value of the first intersection sample; the first intersection sample is an intersection sample falling into the non-leaf node; for each bucket corresponding to the second feature, accumulate the homomorphic ciphertext of the derivative value of the first intersection sample belonging to the bucket to obtain homomorphic ciphertext of a derivative accumulation value corresponding to each bucket of the second feature; according to the homomorphic ciphertext of the derivative accumulation value corresponding to each bucket, determine the split point of the non-leaf node with the second party by using an information gain method; the second party has homomorphic ciphertext of the derivative accumulation value of each bucket corresponding to the first feature.

[0271] In an optional implementation, the split point determination module 550 is specifically configured to jointly execute a homomorphic encryption to secret sharing protocol with the second party to obtain a derivative accumulation value fragment corresponding to each bucket; according to the derivative accumulation value fragment corresponding to each bucket, jointly perform secret sharing four arithmetic operations with the second party by using an information gain method to determine a gain value corresponding to each bucket; and according to a secret comparison method, compare the gain value corresponding to each bucket to determine the split point of the non-leaf node.

[0272] In an optional implementation, the split point is indicated by a bucket number slice, and the first quantity of numbers in the bucket number corresponds to the bucket of the first feature. The device further includes a split point disclosure module 570 (not shown in the figure) for determining the size relationship between the split point and the first quantity by using the slice of the bucket number corresponding to the split point held by the device, through a privacy comparison method jointly executed with the second party; in the case where the split point is greater than the first quantity, determining that the split point is the bucket number corresponding to the second feature, and receiving the slice of the bucket number corresponding to the split point held by the second party, and performing secret sharing decryption on the bucket number corresponding to the split point.

[0273] In an optional implementation, the weight value calculation module 560 is specifically configured to obtain, based on the bucket number of the parent node split point, the first slice of the derivative cumulative value of the bucket threshold corresponding to the split point, and the derivative cumulative value slice array held by the second party, and the second party, a first new slice of the derivative cumulative value of the bucket threshold corresponding to the parent node split point based on the oblivious transfer; the derivative cumulative value slice array includes derivative cumulative values corresponding to a plurality of bucket thresholds used when calculating the split point, and each derivative cumulative value slice corresponding to each bucket threshold includes the sum of derivative value slices of intersection samples less than and / or greater than the bucket threshold; the derivative value slice is obtained by the second party jointly calculating according to a loss function of the tree model; and the first new slice is used to jointly execute calculation of the leaf node weight value with the second party.

[0274] In an optional implementation, the weight value calculation module 560 is specifically configured to take the bucket number of the parent node split point as input, and jointly execute the oblivious transfer of one of many with the second party to obtain the slice data corresponding to the bucket number from a plurality of slice data of the second party; the plurality of slice data of the second party includes the difference between each slice of the derivative cumulative value slice array and the first random number; and the sum of the first slice of the derivative cumulative value and the slice data corresponding to the bucket number is taken as the first new slice.

[0275] In an optional implementation, the weight value calculation module 560 is specifically configured to generate a second random number, and determine the difference between each slice of the derivative cumulative value slice array and the second random number; based on the difference between each slice of the derivative cumulative value slice array and the second random number, and the second party, the third new slice is obtained based on the oblivious transfer; and the second random number is taken as the fourth new slice to jointly execute the calculation of the leaf node weight value with the second party.

[0276] The present specification also provides a bucket threshold extraction device applied to a first party, and the first party and a second party hold samples including a first feature and a second feature. As shown in Figure 1 The device includes:

[0277] The bucketing module 610 is configured to obtain a plurality of intersection samples by performing an anonymous primary key privacy intersection obtaining operation jointly with the second party, and obtain a first shard of a feature value corresponding to a second feature of each intersection sample, a first shard of a bucket number, and a first shard of a bucket boundary marker value by performing an anonymous primary key privacy bucketing protocol jointly with the second party. The bucket boundary marker value is used to indicate whether the feature value of the intersection sample is a bucket threshold of the corresponding bucket.

[0278] The secret sharing decryption module 620 is configured to receive a second shard of a bucket number corresponding to a second feature of each intersection sample and a second shard of a bucket boundary marker value sent by the second party, and perform secret sharing decryption based on the second shard of the bucket number and the second shard of the bucket boundary marker value and the first shard of the bucket number and the first shard of the bucket boundary marker value, to determine the bucket number corresponding to the second feature of each intersection sample and the bucket boundary marker value.

[0279] The homomorphic operation module 630 is configured to receive homomorphic ciphertext of a second shard of a feature value corresponding to a second feature of each intersection sample sent by the second party, and determine homomorphic ciphertext of the feature value of the second feature of each intersection sample based on a homomorphic sum of the homomorphic ciphertext of the second shard of the feature value and the first shard of the feature value.

[0280] The bucket threshold extraction module 640 is configured to determine homomorphic ciphertext of a bucket threshold of each bucket corresponding to the second feature according to the bucket number corresponding to the second feature, the bucket boundary marker value, and the homomorphic ciphertext of the feature value. The homomorphic ciphertext of the bucket threshold is used for the first party and the second party to jointly perform training of a model.

[0281] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it themselves, without having to ask a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented using "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is also written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit that implements the logical method flow can be easily obtained.

[0282] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. The skilled person will also appreciate that, in addition to implementing the controller in pure computer readable program code, it is possible to implement the controller in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. to perform the same functions by logically programming the method steps. Such a controller can therefore be considered to be a hardware component, and the means included therein to perform the various functions can also be considered to be structures within the hardware component. Alternatively, or even additionally, the means to perform the various functions can be considered to be both a software module implementing the method and a structure within a hardware component.

[0283] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present specification does not exclude that with the development of computer technology in the future, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, electronic mail devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0284] Although the method operations of the embodiments of the present disclosure are described in a particular, sequential order, one or more of the method operations can be performed concurrently, in different orders, or omitted. The sequence of operations described is merely an example and is not limited by the order of the sequence. One or more of the method operations can be performed in real-time, in set times, or under the control of one or more automated systems. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. The use of "including," "comprising," or "having" and variations thereof herein is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. The use of "consisting of" is meant to exclude any installed elements other than those recited. The use of "consisting essentially of" is meant to include the recited elements plus any non-essential elements that do not materially affect the basic operation or characteristics of the embodiment. The use of "about" in conjunction with a reference to a value is meant to encompass the recited value plus or minus ten percent.

[0285] For the convenience of description, the above apparatus is described by dividing into various modules and describing each module respectively. Of course, when implementing one or more of the present disclosure, the functions of the modules can be implemented in the same or multiple software and / or hardware, or the modules implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The apparatus embodiment described above is only schematic. For example, the division of the units is only a logical function division, and in actual implementation, there can be another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, devices or units, and can be electrical, mechanical or other forms.

[0286] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and a combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions of one or more flows or one or more blocks in the flowcharts and / or block diagrams can be implemented by an apparatus. Figure 1 The functions of one or more flows or one or more blocks in the flowcharts and / or block diagrams can be implemented by an apparatus.

[0287] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the Figure 1 function specified in the flow or flows and / or blocks Figure 1 of the block or blocks.

[0288] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the ​ function specified in the flow or flows and / or blocks ​ of the block or blocks.

[0289] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0290] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory. The memory is an example of computer-readable media.

[0291] Computer-readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

[0292] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0293] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0294] The various embodiments described in this specification are described in the context of progressive embodiments, with each embodiment building on the previous one. The same or similar parts between embodiments are cross-referenced as appropriate. Each embodiment focuses on the differences between that embodiment and the previous one. In particular, the system embodiments are described relatively simply, as they are substantially similar to the method embodiments. In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" etc. means that the specific feature, structure, material or characteristic being described in connection with that embodiment or example is included in at least one embodiment or example in the specification. Illustrative descriptions of the above terms in the specification do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics being described can be combined in any suitable manner in one or more embodiments or examples. Furthermore, different embodiments or examples described in the specification and the features of different embodiments or examples can be combined and combined by those skilled in the art without contradiction, as appropriate.

[0295] The above description is merely illustrative of the embodiments of the one or more embodiments described in the specification and is not in any way intended to limit the one or more embodiments described in the specification. The one or more embodiments described in the specification can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the specification shall be included in the scope of the claims.< / w> ​< / h> < / g> < / h> ​​< / g> < / h> < / g> < / h> < / g> < / h> < / g> < / gr> < / gl> < / gr> < / gr> < / gl> < / gr> < / gl> < / gr> < / gr> < / gl> < / h> < / g> < / h1> < / g1> < / h1> < / h1> < / h1> < / gl> < / gr> < / gl> < / gain> < / hl> < / gr> < / gl> < / d> ​< / d> < / d> < / d> < / y> < / d> < / x> < / x> < / x>

Claims

1. A tree model joint training method, applied to a first party, the method further involving a second party, wherein the first party and the second party respectively hold samples including a first feature and a second feature; the method includes: Multiple intersection samples are obtained by performing anonymous primary key privacy intersection in conjunction with a second party, and the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary marker value are obtained by performing anonymous primary key privacy bucketing protocol in conjunction with a second party. The bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucketing threshold of the corresponding bucket. Receive the second fragment of the bucket number and the second fragment of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second fragment of the bucket number and the first fragment of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample; Receive the homomorphic ciphertext of the second fragment of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the feature value of the second feature of each intersection sample based on the homomorphic sum of the second fragment and the feature value. Based on the bucket number, bucket boundary marker value, and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample, determine the bucket threshold homomorphic ciphertext for each bucket corresponding to the second feature; Using the multiple intersection samples, and jointly training the tree model with the second party, the split point of each non-leaf node in the tree model is determined, and the split point is indicated by the bucket number of the feature. When the split point is the bucket number corresponding to the second feature, the bucket threshold homomorphic ciphertext corresponding to the bucket number is obtained. Based on the bucket threshold homomorphic ciphertext and the second party, the splitting condition corresponding to the split point is determined, and the leaf node weight value is calculated based on this.

2. The method according to claim 1, wherein determining the splitting condition corresponding to the splitting point based on the homomorphic ciphertext of the bucketing threshold and the second party jointly includes: By using a homomorphic encryption-to-secret-sharing protocol jointly executed with a second party, the homomorphic ciphertext corresponding to the split point is processed into a bucket threshold fragment, and the bucket threshold fragment is used as the splitting condition for the non-leaf node.

3. The method according to claim 1, wherein the step of using the plurality of intersection samples and jointly training the tree model with the second party to determine the split point of each non-leaf node in the tree model includes: The derivative values ​​of the intersection samples are calculated jointly with the second party to obtain derivative value slices for each intersection sample; the derivative values ​​are calculated based on the loss function of the tree model. For each non-leaf node, execute: According to the secret sharing to homomorphic encryption protocol jointly executed by the second party, the derivative value of the first intersection sample is obtained as the homomorphic ciphertext; the first intersection sample is the intersection sample that falls into the non-leaf node; For each bucket corresponding to the second feature, the derivative values ​​of the first intersection samples belonging to that bucket are accumulated in a homomorphic ciphertext to obtain the cumulative derivative values ​​of the second feature for each bucket. Based on the homomorphic ciphertext of the derivative accumulation value corresponding to each bucket, the split point of the non-leaf node is determined jointly with the second party using the information gain method; the second party has the homomorphic ciphertext of the derivative accumulation value of each bucket corresponding to the first feature.

4. The method according to claim 3, wherein determining the split point of the non-leaf node by using the information gain method and in conjunction with the second party based on the homomorphic ciphertext of the derivative accumulation value corresponding to each bucket includes: In conjunction with a second party, a homomorphic encryption-to-secret-sharing protocol is executed to obtain the derivative accumulation value fragments corresponding to each bucket; Using the information gain method, the data is divided according to the cumulative derivative value of each bucket, and the second party jointly performs secret sharing arithmetic operations to determine the gain value of each bucket. The split point of the non-leaf node is determined by comparing the gain values ​​of each bucket using a secret comparison method.

5. The method according to claim 1, wherein the split point is indicated by the segmentation of the bucket number, and the first number of numbers in the bucket number corresponds to the bucket of the first feature; Before obtaining the homomorphic ciphertext of the bucket threshold corresponding to the bucket number, the method further includes: By using a privacy comparison method jointly executed with a second party, the relationship between the bucket number corresponding to the split point and the first quantity is determined by utilizing the fragments of the bucket number corresponding to the split point held. If the number of split points is greater than the first number, the split point is determined to be the bucket number corresponding to the second feature, and the fragment corresponding to the bucket number of the split point held by the second party is received from the second party, and the bucket number corresponding to the split point is secretly shared and decrypted.

6. The method according to claim 5, wherein when the split point of the leaf node's parent node is the bucket number corresponding to the second feature, the calculation of the leaf node weight value based on this includes: Based on the bucket number of the parent node split point, the first slice of the derivative cumulative value of the bucket threshold corresponding to the split point, and the derivative cumulative value slice array held by the second party, and jointly obtained by the second party based on unintentional transmission, the first new slice of the derivative cumulative value corresponding to the bucket threshold of the parent node split point is obtained; the derivative cumulative value slice array includes derivative cumulative value slices corresponding to multiple bucket thresholds used when calculating the split point, and the derivative cumulative value slice corresponding to each bucket threshold includes the sum of derivative value slices of the intersection samples whose feature values ​​are less than and / or greater than the bucket threshold; the derivative value slices are jointly calculated by the second party according to the loss function of the tree model; Using the first new shard, the weight values ​​of the leaf nodes are calculated jointly with the second party.

7. The method according to claim 6, wherein the step of jointly obtaining the first new fragment based on unintentional transmission of the derivative accumulation value corresponding to the bucketing threshold of the parent node split point with the second party includes: Using the bucket number of the parent node's split point as input, and in conjunction with the second party, perform a random transmission of multiple selections to obtain the fragment data corresponding to that bucket number from the second party's multiple fragment data; the second party's multiple fragment data includes the difference between each fragment in the derivative cumulative value fragment array and the first random number; The sum of the first slice of the derivative accumulation value and the slice data corresponding to the bucket number is taken as the first new slice.

8. The method according to claim 5, wherein when the split point of the parent node of a leaf node is the bucket number corresponding to the first feature, the calculation of the leaf node weight value based on this includes: Generate a second random number and determine the difference between each slice in the derivative cumulative value slice array and the second random number; Based on the difference between each slice in the derivative accumulation slice array and the second random number, and in conjunction with the second party based on unintentional transmission, the second party obtains a third new slice. The second random number is used as the fourth new slice, and the leaf node weight value is calculated jointly with the second party.

9. A bucketing threshold extraction method, applied to a first party, the method further relating to a second party, wherein the first party and the second party respectively hold samples including a first feature and a second feature; the method includes: Multiple intersection samples are obtained by performing anonymous primary key privacy intersection in conjunction with a second party, and the first slice of the feature value corresponding to the second feature of each intersection sample, the first slice of the bucket number, and the first slice of the bucket boundary marker value are obtained by performing anonymous primary key privacy bucketing protocol in conjunction with a second party. The bucket boundary marker value is used to indicate whether the feature value of the intersection sample is the bucketing threshold of the corresponding bucket. Receive the second fragment of the bucket number and the second fragment of the bucket boundary marker value corresponding to the second feature of each intersection sample sent by the second party, and perform secret sharing decryption based on the second fragment of the bucket number and the first fragment of the bucket boundary marker value to determine the bucket number and the bucket boundary marker value corresponding to the second feature of each intersection sample; Receive the homomorphic ciphertext of the second fragment of the feature value corresponding to the second feature of each intersection sample sent by the second party, and determine the homomorphic ciphertext of the feature value of the second feature of each intersection sample based on the homomorphic sum of the second fragment and the feature value. Based on the bucket number, bucket boundary marker value, and feature value homomorphic ciphertext corresponding to the second feature of each intersection sample, the bucket threshold homomorphic ciphertext for each bucket corresponding to the second feature is determined; the bucket threshold homomorphic ciphertext is used for joint training of the model by the first and second parties.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-9.

Images