Data processing method, system, device, medium and computer program product

Abstract

The present application relates to the field of computer technology and discloses a data processing method, system, device, medium and computer program product. The computing device receives the model parameter shards sent by the first device through secure multi-party computing, receives the first ciphertext of the inference input data sent by the user device through homomorphic encryption computing, and performs calculations based on the model parameter shards and the first ciphertext to implement a hybrid encryption mechanism based on the computing device, which can effectively avoid the leakage of model privacy parameters or user inference data. For the remaining calculations, the computing device encrypts the ciphertext of the intermediate calculation result shards and sends them to the user device for aggregate decryption, so that the remaining calculations of the model inference calculation can be performed based on the plaintext of the intermediate calculation result. Compared with performing the remaining calculations based on the ciphertext, the amount of calculation is reduced, and the leakage of model privacy parameters to the user device is avoided, thereby improving the efficiency of model inference while ensuring data confidentiality.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data processing method, system, device, medium and computer program product. Background Art

[0002] With the development of artificial intelligence (AI) technology, AI models are increasingly being used, and the number of model parameters is increasing. For model inference tasks that require high inference performance and a large number of model parameters, these models must be deployed on large-scale computing clusters to meet performance requirements. In this scenario, AI may collect users' private information without their knowledge, posing security risks.

[0003] How to ensure the security of user data during the reasoning process of artificial intelligence models is a technical problem that technical personnel in this field need to solve. Summary of the Invention

[0004] The present invention provides a data processing method, system, device, medium and computer program product to at least solve the problem in the related art that user privacy information may be leaked during the artificial intelligence model reasoning process.

[0005] The present invention provides a data processing method, applied to a computing device, comprising:

[0006] Obtaining a ciphertext of an intermediate calculation result shard by calculating the ciphertext of the intermediate calculation result shard based on the model parameter shard sent by the first device and the first ciphertext of the inference input data sent by the user device;

[0007] Encrypting the ciphertext of the intermediate calculation result fragment to obtain a second ciphertext;

[0008] Sending the second ciphertext to the user device, so that the user device aggregates the second ciphertexts of the plurality of computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext;

[0009] receiving the third ciphertext and decrypting it to obtain a plaintext of the intermediate calculation result;

[0010] Utilize the plaintext of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain local output result fragments;

[0011] The output result slices are sent to the user device, so that the user device aggregates the output result slices of multiple computing devices to obtain a data processing result.

[0012] The present invention also provides a data processing system, comprising: a plurality of computing devices and user devices;

[0013] The computing device is used to calculate the ciphertext of the intermediate calculation result slice based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device; encrypt the ciphertext of the intermediate calculation result slice to obtain a second ciphertext; send the second ciphertext to the user device; receive and decrypt the third ciphertext sent by the user device to obtain the plaintext of the intermediate calculation result; use the plaintext of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain a local output result slice; and send the output result slice to the user device;

[0014] The user device is used to aggregate the second ciphertext of multiple computing devices and decrypt it using a homomorphic encryption algorithm to obtain the third ciphertext, and is also used to aggregate the output result shards of multiple computing devices to obtain data processing results.

[0015] The present invention also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any one of the above-mentioned data processing methods when executing the computer program.

[0016] The present invention also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned data processing methods are implemented.

[0017] The present invention also provides a computer program product, comprising a computer program, which implements the steps of any of the above data processing methods when executed by a processor.

[0018] Through the present invention, the computing device receives the model parameter shards sent by the first device through secure multi-party computing, receives the first ciphertext of the inference input data sent by the user device through homomorphic encryption computing, and performs computing based on the model parameter shards and the first ciphertext, thereby realizing a hybrid encryption mechanism based on the computing device, which can effectively avoid the leakage of model privacy parameters or user inference data. For the remaining calculations, the computing device encrypts the ciphertext of the intermediate calculation result shards and sends them to the user device for aggregate decryption, so that the remaining calculations of the model inference calculation can be performed based on the plaintext of the intermediate calculation result. Compared with performing the remaining calculations based on the ciphertext, the amount of calculation is reduced and the leakage of model privacy parameters to the user device is avoided. Therefore, the present invention can not only avoid the leakage of model privacy parameters or user inference data during model inference, but also make full use of computing resources. The user device only needs to perform encryption and decryption calculations and a small amount of simple calculations without performing model calculations. Through the mixed plaintext and ciphertext computing method, the communication volume between computing devices is also reduced, and the efficiency of model inference is improved while ensuring data confidentiality. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 An architectural diagram of a data processing system provided by an embodiment of the present invention;

[0021] Figure 2 A flowchart of a data processing method provided by an embodiment of the present invention;

[0022] Figure 3 This is a diagram of the encoder structure in a Transformer model;

[0023] Figure 4 A schematic diagram of attention calculation. DETAILED DESCRIPTION

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0025] It should be noted that, in the description of the present invention, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. The terms "first," "second," etc., in the present invention are used to distinguish similar objects, and are not used to describe a particular order or precedence.

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0027] Here, some key terms used in the embodiments of the present invention are explained.

[0028] Model privacy reasoning is a technology that performs reasoning while protecting data and model privacy, aiming to prevent user data and model parameters from being leaked during the reasoning process.

[0029] Model privacy reasoning mainly involves two aspects of privacy protection: data privacy protection, which prevents user input data from being leaked during the reasoning process; and model privacy protection, which prevents model parameters from being obtained by malicious users or competitors.

[0030] Homomorphic encryption and secure multi-party computation are important technical means to achieve data security and privacy protection. They have provable security and are applied to model privacy reasoning in related technologies.

[0031] Specifically, homomorphic encryption (HE) supports calculations on ciphertext data without prior decryption. The result of the calculation remains encrypted, and after decryption, it is the result the user wants, which is the same as the result of "performing the corresponding calculation on the plaintext data."

[0032] Secure Multi-Party Computation (MPC) enables multiple parties to collaboratively compute arbitrary functions on secret data without leaking any other secret information except the function output.

[0033] However, using provably secure privacy-preserving computation methods often implies extremely high protocol communication and computational overhead. For example, secure multi-party computation relies heavily on communication and interaction, resulting in high communication costs and latency. Homomorphic encryption also has a high computational cost; the amount of computation performed on encrypted data is significantly higher than on plaintext data, which also results in longer computation times.

[0034] Furthermore, as the number of model parameters continues to increase and user demands for inference performance increase, encrypting all or part of the model parameters and deploying them on user devices for edge computing is no longer sufficient. Privacy-preserving model inference inevitably requires the use of large-scale computing clusters to provide computing resources. In this scenario, ensuring the security of user data during AI model inference becomes even more pressing.

[0035] To this end, an embodiment of the present invention provides a privacy inference scheme that combines secure multi-party computation and homomorphic encryption. The computing device receives model parameter shards sent by a first device through secure multi-party computation, receives the first ciphertext of inference input data sent by a user device through homomorphic encryption, and performs calculations based on the model parameter shards and the first ciphertext, thereby implementing a hybrid encryption mechanism based on the computing device, which can effectively prevent the leakage of model privacy parameters or user inference data. For the remaining calculations, the computing device encrypts the ciphertext of the intermediate calculation result shards and sends them to the user device for aggregate decryption. This allows the remaining calculations of the model inference calculation to be performed based on the plaintext of the intermediate calculation result. Compared with performing the remaining calculations based on the ciphertext, the computational complexity is reduced and the leakage of model privacy parameters to the user device is avoided. As a result, the present invention not only prevents the leakage of model privacy parameters or user inference data during model inference, but also fully utilizes computing resources. The user device only needs to perform encryption and decryption calculations and a small amount of simple calculations without having to perform model calculations. In addition, the communication volume between computing devices is reduced through the mixed plaintext and ciphertext calculations. Therefore, the present invention improves the efficiency of model inference while ensuring data confidentiality.

[0036] It should be noted that the structure of the model used in the embodiment of the present invention can be a convolutional neural network (CNN), a recurrent neural network (RNN), a long short-term memory (LSTM) network, etc., or a model built on an attention network, such as a transformer model, a bidirectional encoder representation from transformers (BERT) model, a contrastive language-image pre-training (CLIP) model, etc., and the present invention is not limited thereto. An attention network refers to a network model that is trained using an attention mechanism. The model extracts more important feature information from the input sequence by assigning different weights to each part of the input sequence, so that the model ultimately obtains a more accurate output.

[0037] Figure 1 An architectural diagram of a data processing system provided by an embodiment of the present invention.

[0038] like Figure 1As shown, the data processing system provided by the embodiment of the present invention may include multiple computing devices 101 and user devices 102. The computing device 101 is used to calculate the ciphertext of the intermediate calculation result shard based on the model parameter shard sent by the first device 103 and the first ciphertext of the inference input data sent by the user device 102; encrypt the ciphertext of the intermediate calculation result shard to obtain the second ciphertext; send the second ciphertext to the user device 102; receive the third ciphertext sent by the user device 102 and decrypt it to obtain the plaintext of the intermediate calculation result; use the plaintext of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain the local output result shard; and send the output result shard to the user device 102. The user device 102 is used to aggregate the second ciphertexts of multiple computing devices 101 and decrypt them using a homomorphic encryption algorithm to obtain a third ciphertext, and is also used to aggregate the output result shards of multiple computing devices 101 to obtain the data processing result.

[0039] In an embodiment of the present invention, the first device 103 is the model owner, the user device 102 is the user inference data owner, and a computing cluster composed of multiple computing devices 101 (inference servers or contracted servers) provides computing resources for model inference calculations.

[0040] Because model training data and trained model parameters are important assets of the model owner, protecting model privacy parameters in distributed inference services is crucial. This embodiment of the present invention implements a secure outsourcing solution for model inference services. First device 103, acting as the model owner, distributes the model parameters of an artificial intelligence model to multiple computing devices 101 through secret sharing. Computing devices 101 then perform secure multi-party computation on the user's inference input data, collaboratively completing the model inference task. Each computing device 101 only possesses a secret share of the model's privacy parameters and cannot infer the complete model parameter information.

[0041] Furthermore, a user's inference input data may contain personal information, privacy, and trade secrets. Entering this plaintext input into the model poses significant security risks. Technologies such as homomorphic encryption and secure multi-party computation can protect the confidentiality of inference data. However, secure multi-party computation relies heavily on communication and interaction, and homomorphic encryption is computationally expensive. Balancing computational complexity with communication complexity is a key challenge for privacy-focused inference in neural networks.

[0042] Because the user's inference input data is relatively small (e.g., a paragraph of text or an image), homomorphic encryption of the user's inference input data requires less computation and subsequent computation than homomorphic encryption of the model's private parameters. In this embodiment of the present invention, the parameter distribution module of the first device 103 distributes the model's private parameters to the computing devices 101 using secret sharing. Each computing device 101 receives a share of the parameters (referred to as a model parameter shard) for joint inference. The encryption and decryption module of the user device 102 encrypts the user's inference input data and sends it to the computing device 101. The computing device 101 performs a plaintext-ciphertext computation using secure multi-party computation and returns the computation result (referred to as an output result shard) to the user device 102. The user device 102 then decrypts the computation result or aggregates the ciphertext data using the encryption and decryption module to obtain the plaintext data processing result (i.e., the plaintext inference result of the model inference task).

[0043] It should be noted that the model privacy parameters sent by the first device 103 to the computing device 101 using secret sharing are not all model parameters. That is, the model parameters also include some parameters that do not need to be kept confidential, such as the model parameters used to perform vectorized encoding calculations on the inference input data, and the parameters of the activation functions of each layer in the model (such as the Softmax function). These model parameters that do not need to be kept confidential can be sent in full in plain text to each computing device 101. Therefore, the model parameters owned by a computing device 101 include the model parameter slices of the model privacy parameters and the full model parameters that do not need to be kept confidential.

[0044] In model inference calculations, to reduce the computational effort involved in steps requiring aggregation of intermediate calculation results, the ciphertext of the intermediate calculation result shards obtained through plaintext-ciphertext calculations is sent to user device 102 for decryption. To prevent user device 102 from inferring model privacy parameters when aggregating the intermediate calculation result shards, computing device 101 locally encrypts the ciphertext of the intermediate calculation result shards to obtain a second ciphertext, which is then sent to user device 102. Consequently, after user device 102 aggregates the second ciphertext and decrypts it using a homomorphic encryption algorithm, it obtains a third ciphertext corresponding to the complete intermediate calculation result, from which it is also impossible to infer model privacy parameters.

[0045] An embodiment of the present invention further provides a data processing method. With reference to the data processing system introduced in the above embodiment and in combination with the execution flow of the data processing method, the method is described in detail below.

[0046] Figure 2 The present invention provides a flowchart of a data processing method.

[0047] like Figure 2As shown, the data processing method provided by the embodiment of the present invention, applied to a computing device, includes:

[0048] S201: Obtain a ciphertext of an intermediate calculation result shard based on a model parameter shard sent by a first device and a first ciphertext of inference input data sent by a user device.

[0049] S202: Encrypt the ciphertext of the intermediate calculation result fragment to obtain a second ciphertext.

[0050] S203: Send the second ciphertext to the user device, so that the user device aggregates the second ciphertexts of multiple computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext.

[0051] S204: Receive the third ciphertext and decrypt it to obtain the plaintext of the intermediate calculation result.

[0052] S205: Use the plain text of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain local output result fragments.

[0053] S206: Send the output result slices to the user device, so that the user device aggregates the output result slices of multiple computing devices to obtain the data processing result.

[0054] It should be noted that the encryption and decryption mechanism in the model inference calculation provided by the embodiment of the present invention can be a single sequential execution step, or a cyclic execution of some or all of the steps, so as to solve the data confidentiality problems of different types of calculations in models with different structures.

[0055] In S201, the first device distributes the model's private parameters to the computing devices using secret sharing. This means that each computing device has a model parameter shard, which refers only to a shard of the model's private parameters. This means that each computing device has all the model parameters that do not need to be kept confidential. Thus, the model parameters owned by a computing device include both the model parameter shards of the model's private parameters and the full model parameters that do not need to be kept confidential.

[0056] For example, when the model is a Transformer model, the model privacy parameters involved are mainly weight matrices, including the query weight matrix used for attention calculation in the attention layer. , key weight matrix Sum weight matrix , a matrix used to merge multi-head outputs in multi-head attention calculations , the linear transformation parameters of the fully connected layer 、 、 、 For these parameters, the first device uses secret sharing to send the model parameter slices to the computing devices, and each computing device holds a copy of the model parameter slices.

[0057] The word embedding matrix and position encoding matrix of the vector encoding layer of the Transformer model are model parameters that do not need to be kept confidential. For these parameters, the first device sends all model parameters to the computing device, meaning that each computing device can hold all model parameters that do not need to be kept confidential.

[0058] The user device encrypts the inference input data using a homomorphic encryption algorithm, records the resulting ciphertext as a first ciphertext, and sends the first ciphertext to each computing device.

[0059] remember is a homomorphic encryption plaintext encoding algorithm, is the homomorphic encryption plaintext decoding algorithm, and are the homomorphic encryption and decryption algorithms respectively, and m is the inference input data of the user device.

[0060] The user device uses the homomorphic encryption plaintext encoding algorithm to encode the inference input data, and then uses the homomorphic encryption algorithm to encrypt it (this process can be recorded as ), obtains the first ciphertext, and the user device then sends the first ciphertext to each computing device.

[0061] Taking the fully homomorphic encryption algorithm (Cheon-Kim-Kim-Song, CKKS) as an example, the homomorphic encryption plaintext encoding algorithm Encoding a vector as a cyclotomic integer ring The polynomial on , the ciphertext is Polynomial pairs on .

[0062] set up For vectors, homomorphic encryption supports plaintext-ciphertext calculations and ciphertext-ciphertext calculations:

[0063] , represents plaintext-ciphertext addition calculation, represents ciphertext polynomial addition, Represents the element-by-element addition of a vector. That is, the result of adding the ciphertext of the homomorphically encrypted plaintext of m to the plaintext of the homomorphically encrypted plaintext of a, decrypting and decoding, and the result is the same as The results are the same.

[0064] , represents the plaintext-ciphertext multiplication calculation, represents the ciphertext polynomial multiplication, Represents vector element-by-element multiplication. That is, the result of multiplying the ciphertext after homomorphic encryption of m and the plaintext after homomorphic encryption of a, decrypting and decoding, the result is the same as The results are the same.

[0065] , represents ciphertext-ciphertext addition, 、 represents the inference input data, and Corresponding to and The homomorphic encryption plaintext encoding of represents ciphertext polynomial addition, Represents element-by-element addition of vectors. The ciphertext and the homomorphic encryption of the plaintext encoding are The result of multiplying the ciphertext after homomorphic encryption is decrypted and decoded. The results are the same.

[0066] The above vector operations can be extended to matrix operations. Because the model parameter slices are in plaintext form, the computing device only needs to perform plaintext-ciphertext addition, plaintext-ciphertext multiplication, ciphertext-ciphertext addition, and ciphertext shift calculations.

[0067] It should be noted that the homomorphic encryption algorithm used by the user device is not limited to CKKS.

[0068] Based on the above principles, the computing device performs a plaintext-ciphertext calculation based on the model parameter shards and the first ciphertext, obtaining the ciphertext of the intermediate calculation result shards. For any calculations in model inference that require direct use of the model's private parameters and inference input data, the plaintext-ciphertext calculation method provided in S201 can be used.

[0069] If the ciphertext of the intermediate calculation result shard is not decrypted, the computing device can also perform the remaining calculations of the model reasoning calculation based on the ciphertext of the intermediate calculation result shard. However, the calculations performed on the basis of the homomorphically encrypted ciphertext are much more computationally intensive than the same calculations performed on the basis of the plaintext. In order to save computing resources and improve the efficiency of the model reasoning calculation, in an embodiment of the present invention, the computing device sends the ciphertext of the intermediate calculation result shard to the user device for homomorphic encryption decryption, so as to perform the remaining calculations of the model reasoning calculation based on the plaintext of the intermediate calculation result shard.

[0070] However, if the computing device directly sends the ciphertext of the intermediate calculation result fragments to the user device, the user device aggregates and decrypts it, and after obtaining the complete intermediate calculation result, it can infer the model privacy parameters (such as model weight parameters) based on the local inference input data, which will cause the model privacy parameters to be leaked to the user device.

[0071] For S202, the computing device encrypts the ciphertext of the intermediate calculation result shard to obtain a second ciphertext, and in S203, sends the second ciphertext to the user device. At this time, the user device performs aggregation and homomorphic encryption decryption. After removing the homomorphic encryption, the user device cannot know what the intermediate calculation result is, so it is impossible to infer the model privacy parameters through the obtained third ciphertext.

[0072] At S204, the computing device receives the third ciphertext sent by the user device and decrypts it using a local encryption / decryption algorithm to obtain the plaintext intermediate calculation result. It should be noted that while the computing device can obtain the complete plaintext intermediate calculation result at this point, it cannot infer the model's private parameters based on the plaintext intermediate calculation result because it only holds the model parameter slices of the model's private parameters and lacks the plaintext input data for inference.

[0073] For S205, the computing device can perform the remaining calculations of the model inference calculation based on the plaintext of the intermediate calculation results, thereby using a smaller amount of calculation while ensuring the confidentiality of the model privacy parameters and the confidentiality of the inference input data, and obtaining efficient model inference calculation performance.

[0074] In model inference calculations, if the model used includes a multi-layer network structure, each layer of the network structure can select the encryption and decryption mechanism described in S201-S205 based on the calculation type. For network results in non-first layers, whose input is the output of the previous layer, S201 can be replaced by: Calculate the intermediate calculation result slices based on the model parameter slices and the output of the previous layer of the network.

[0075] For S206, the computing device sends the output result slices output by the last layer of the model to the user device, and the user device aggregates the output result slices sent by each computing device to obtain a complete data processing result.

[0076] In a data processing method provided by an embodiment of the present invention, a computing device receives a model parameter shard sent by a first device through secure multi-party computation, receives a first ciphertext of inference input data sent by a user device through homomorphic encryption computation, and performs computation based on the model parameter shard and the first ciphertext, thereby implementing a hybrid encryption mechanism based on the computing device, which can effectively prevent the leakage of model privacy parameters or user inference data. For the remaining computation, the computing device encrypts the ciphertext of the intermediate computation result shard and sends it to the user device for aggregate decryption, thereby performing the remaining computation of the model inference computation based on the plaintext of the intermediate computation result. This reduces the computational effort compared to performing the remaining computation based on the ciphertext and prevents the leakage of model privacy parameters to the user device. As a result, the present invention not only prevents the leakage of model privacy parameters or user inference data during model inference, but also fully utilizes computing resources. The user device only needs to perform encryption and decryption computations and a small amount of simple computations without having to perform model computations. The hybrid plaintext and ciphertext computation also reduces the communication volume between computing devices, improving the efficiency of model inference while ensuring data confidentiality.

[0077] In the above embodiment, the first device can send all model parameters that do not need to be kept confidential to the computing device. The computing device can then perform model inference calculations other than model privacy inference based on the full set of model parameters that do not need to be kept confidential, eliminating the need to perform additional model inference calculations on the user device or other devices.

[0078] Then, in S201, the ciphertext of the intermediate calculation result segment is obtained according to the model parameter segment sent by the first device and the first ciphertext of the inference input data sent by the user device, which may include: performing vector coding calculation on the first ciphertext according to the model vector coding calculation parameters sent by the first device to obtain a first vector coding result; and obtaining the ciphertext of the intermediate calculation result segment according to the model parameter segment and the first vector coding result.

[0079] For a model vector coding layer of a model such as a Transformer model, the model vector coding calculation parameters may include a word embedding model and a position coding matrix. Performing a vector coding calculation on the first ciphertext based on the model vector coding calculation parameters sent by the first device to obtain a first vector coding result may include: performing a word embedding calculation on the first ciphertext using the word embedding model, and adding the calculation result to the position coding matrix to obtain the first vector coding result.

[0080] In a specific implementation, the first device sends the word embedding model and position encoding matrix of the model to the computing device. After receiving the first ciphertext of the inference input data from the user device, the computing device first performs word embedding calculation on the first ciphertext and then adds it to the position encoding matrix to obtain the input X for the attention calculation.

[0081] Based on the above embodiment, the embodiment of the present invention continues to explain the steps of transmitting intermediate calculation results between the computing device and the user device.

[0082] In the embodiment of the present invention, encrypting the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext in S202 may include: adding a locally corresponding random number to the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext.

[0083] In a specific implementation, the computing device uses a locally generated random number to encrypt the ciphertext of the intermediate calculation result shard, generating the second ciphertext. The user device then receives the ciphertext of the intermediate calculation result shard with the random number added. Even when decrypted using a homomorphic encryption algorithm, the resulting shard is still the intermediate calculation result shard with the random number added. After aggregation, the intermediate calculation result is still the random number added. The user device cannot deduce the model's privacy parameters based on this ciphertext.

[0084] In some optional implementations of the embodiments of the present invention, when the user device sends the intermediate calculation result with the addition of a random number to the computing device, a secret sharing method may be adopted, that is, the user device aggregates the second ciphertexts of multiple computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext, which may include: the user device aggregates the second ciphertexts of multiple computing devices and shards the result of decryption using a homomorphic encryption algorithm to obtain a third ciphertext.

[0085] It should be noted that the user device's use of secret sharing to send the plaintext slices of the intermediate calculation result (i.e., the third ciphertext) to each computing device is independent of the first device's use of secret sharing to send the model parameter slices of the model's private parameters to each computing device. After receiving the third ciphertext, each computing device removes the local random number from the third ciphertext and then aggregates the results of the removal of the random number from each computing device to obtain the complete plaintext intermediate calculation result.

[0086] At this time, receiving the third ciphertext in S204 and decrypting it to obtain the plaintext of the intermediate calculation result may include: removing the locally corresponding random number from the third ciphertext to obtain the first intermediate calculation result; aggregating the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation result.

[0087] In an embodiment of the present invention, to facilitate calculation, when aggregating the first intermediate calculation results, the computing device may select one or more target computing devices for performing the aggregate calculation.

[0088] For a computing device, aggregating the first intermediate computation results from multiple computing devices to obtain the plaintext intermediate computation results may include: a target computing device in the computing device aggregating the first intermediate computation results from the multiple computing devices; and receiving the plaintext intermediate computation results from the target computing device. In other words, the computing device may utilize one or more target computing devices to complete the aggregation operation to obtain the plaintext intermediate computation results, and then the computing device may utilize the plaintext intermediate computation results to perform the remaining model inference computations using the plaintext intermediate computation results.

[0089] Alternatively, aggregating the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation results may also include: a target computing device in the computing device aggregating the first intermediate calculation results of the multiple computing devices to obtain the plaintext of the intermediate calculation results. Using the plaintext of the intermediate calculation results to perform the remaining calculations of the model inference calculation to obtain local output result slices may include: the target computing device performing, based on the plaintext of the intermediate calculation results, an activation function calculation after obtaining the ciphertext of the intermediate calculation result slice based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, and broadcasting the activation function calculation result to the computing device; and the computing device performing the remaining calculations of the model inference calculation based on the activation function calculation result to obtain local output result slices. That is to say, after the computing device can use one or more target computing devices to complete the aggregation to obtain the plaintext of the intermediate calculation result, the target computing device can also perform the activation function calculation using the plaintext of the intermediate calculation result. For example, if the ciphertext of the intermediate calculation result slice obtained by calculating the first ciphertext of the model parameter slice sent by the first device and the inference input data sent by the user device in S201 is the calculation of the attention layer, then the intermediate calculation result obtained is the attention weight parameter, then the target computing device can perform the activation function calculation of the attention layer based on the attention weight parameter, and then broadcast the activation function calculation result to each computing device, and then the computing device performs the remaining calculations in the model inference calculation.

[0090] On this basis, if the ciphertext of the intermediate calculation result slice obtained by calculating the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device in S201 is a multi-head calculation, then the target computing device can correspond to the computing head of the multi-head calculation. The target computing device performs the activation function calculation after the ciphertext of the intermediate calculation result slice is obtained by calculating the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device based on the plaintext of the intermediate calculation result, and broadcasts the activation function calculation result to the computing device. This may include: multiple target computing devices perform the activation function calculation based on the plaintext of the intermediate calculation result in parallel, and broadcast the activation function calculation result to the computing device. The computing device performs the remaining calculations of the model inference calculation based on the activation function calculation result to obtain a local output result slice. This may include: the computing device splices the activation function calculation results of multiple computing devices, and performs the remaining calculations of the model inference calculation according to the spliced ​​result of the activation function calculation results to obtain a local output result slice.

[0091] That is to say, when using the target computing device to perform the activation function calculation of the multi-head attention calculation, the activation function calculation of each attention head can be calculated in parallel, and then each target computing device broadcasts the local activation function calculation results to each computing device, and each computing device splices the activation function calculation results and uses the fully connected layer weight slicing of the local attention layer Perform a linear transformation on the concatenated results to obtain the attention layer output result slices, and then perform the remaining calculations in the model inference calculation based on the attention layer output result slices.

[0092] The data processing method provided by an embodiment of the present invention may further include re-determining a target computing device before executing different layers of model inference calculation. That is, each time the ciphertext of the intermediate computation result shard is sent to the user device for decryption and a third ciphertext is obtained, the target computing device may be re-selected from the computing devices.

[0093] In a specific implementation, re-determining the target computing device may include: determining the current target computing device based on the target computing device selected last time and the status parameters of each computing device at the current moment. Furthermore, a scoring method can be set for these two factors. For a computing device, if it was used as the target computing device in the last calculation, a larger penalty parameter can be set; if the status parameters of the current computing device indicate that the computing device has better performance and a smaller load, a larger priority value can be set; the priority value of the computing device is subtracted from the penalty parameter of the computing device to obtain the score of the computing device, and the score is sorted from large to small according to the score, and the corresponding number of computing devices at the front are selected as the target computing devices according to the number of computing heads in the multi-head calculation. In this way, it is possible to avoid repeatedly selecting the same computing device as the target computing device many times, and to select computing devices with better performance and smaller load as the target computing devices, thereby ensuring the computing performance and security of each multi-head calculation.

[0094] In other optional implementations of the embodiments of the present invention, after the user device aggregates the second ciphertexts of multiple computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext, the computing device in S204 receives the third ciphertext and decrypts it to obtain the plaintext of the intermediate calculation result. It can also include: removing random numbers from the third ciphertext based on the random numbers of multiple computing devices to obtain the plaintext of the intermediate calculation result. That is to say, after obtaining the intermediate calculation result decrypted by the user device through homomorphic encryption, the computing device can collect random numbers from other computing devices, thereby locally removing all random numbers from the third ciphertext to obtain the plaintext of the intermediate calculation result. At this time, the computing device does not need to use the target computing device to complete the calculation of removing random numbers, and can directly obtain the plaintext of the intermediate calculation result and perform the remaining calculations in the model inference calculation based on the plaintext of the intermediate calculation result.

[0095] In order to enable a computing device to easily obtain random numbers from other computing devices, each computing device can be pre-configured to use the same random number generation algorithm so that the computing device can calculate the random numbers of other computing devices based on the random number generation algorithm and the number of computing devices.

[0096] Alternatively, the selected target computing device may generate a random number and broadcast it to each computing device, so that after obtaining the third ciphertext, each computing device can calculate all the random numbers added to the third ciphertext based on the locally stored random numbers and the number of computing devices.

[0097] In an embodiment of the present invention, S205 uses the plain text of the intermediate calculation result to execute the remaining calculations of the model inference calculation to obtain a local output result slice, which may include: receiving the inference input data slice sent by the user device; executing the remaining calculations of the model inference calculation according to the inference input data slice, the plain text of the intermediate calculation result and the model parameter slice to obtain a local output result slice.

[0098] In the specific implementation, if the remaining calculations in the model inference calculation still require inference input data, the user device can use secret sharing to send the inference input data shards to each computing device. Each computing device uses secure multi-party computing to perform the remaining calculations of the model inference calculation based on the inference input data shards, the plaintext of the intermediate calculation results and the model parameter shards to obtain local output result shards.

[0099] Specifically, the remaining calculations of the model inference calculation are performed according to the inference input data shards, the plaintext of the intermediate calculation results, and the model parameter shards to obtain local output result shards, which may include: using the fully connected layer linear transformation parameter shards in the model parameter shards and the activation function calculation results obtained according to the plaintext of the intermediate calculation results to obtain the local first fully connected layer output shards; performing residual connection calculations and normalization calculations according to the inference input data shards and the first fully connected layer output shards to obtain normalized calculation result shards; performing feedforward neural network calculations according to the normalized calculation result shards and the feedforward neural network parameter shards in the model parameter shards to obtain the secret sharing share of the current layer output; if the current layer is not the last layer of the model, the secret sharing share output by the current layer is used as the input data of the next layer of the model; if the current layer is the last layer of the model, the output layer calculation is performed according to the secret sharing share output by the previous layer to obtain the local output result shards.

[0100] Since models typically include multi-layer network structures, such as Transformers that may include multiple encoding layers and multiple decoding layers, and CNNs that may include multiple convolutional layers, the input for network results in non-first layers is the output of the previous layer, meaning the steps provided in the embodiments of the present invention are looped until the last layer. The last layer of a model is typically called the output layer. If the current layer is the last layer of the model, the output layer calculation is performed based on the secret sharing share output by the previous layer to obtain a local output result slice.

[0101] Based on the above embodiments, the embodiment of the present invention provides a specific model privacy reasoning solution using the Transformer model as an example.

[0102] Figure 3 This is a diagram of the encoder structure in a Transformer model; Figure 4 A schematic diagram of attention calculation.

[0103] The Transformer, a deep learning model architecture for natural language processing (NLP) tasks, features a key innovation: its self-attention mechanism. This mechanism allows the model to assign different attention weights to different parts of the input sequence, thereby better capturing semantic relationships and excelling at processing sequential data. This embodiment of the present invention uses the Transformer model as an example to illustrate the steps for model privacy inference based on a hybrid encryption mechanism. This method can be extended to other neural network models.

[0104] In models based on the Transformer architecture, information such as the weight matrices in the encoder and decoder are private assets of the model owner (i.e., the first device in the above embodiment). To protect the privacy of model parameters, the first device sends shares of weight information (i.e., the model parameter shards in the above embodiment) to multiple computing devices using additive secret sharing.

[0105] The structure of the encoder in the Transformer model is as follows Figure 3 As shown in the figure. First, a multi-head attention calculation is performed on the inference input data. Second, the output of the multi-head attention calculation is added to the input data and then normalized. Then, the fully connected layer is calculated on the output of the normalized calculation. Finally, the output of the normalized calculation is added to the output of the fully connected layer and normalized to obtain the output.

[0106] The first device needs to use secret sharing to send the model parameter fragments to the computing device, including the weight matrix in the attention mechanism 、 、 、 and the linear transformation parameters in the fully connected layer 、 、 、 .

[0107] Assume the number of inference servers is , the first device randomly selects the matrix ,calculate , the secret share Send to A computing device.

[0108] Weight Matrix 、 、 、 、 and vectors 、 is handled similarly.

[0109] In addition, the first device sends the word embedding model and the position encoding matrix to all computing devices.

[0110] After the computing device receives the first ciphertext of the inference input data sent by the user device, it first performs word embedding calculation on the first ciphertext, and then adds it to the position encoding matrix to obtain the input of the attention operation. .

[0111] The computing device performs plaintext-ciphertext attention calculation using the attention weight matrix slices in the model parameter slices. computing devices , computing devices Perform matrix multiplication calculations, and the ciphertext of the intermediate calculation result shards includes the share of the query matrix , the share of the bond matrix , the share of the value matrix .

[0112] like Figure 3 As shown, the calculation of the Transformer's attention layer includes using the weight matrix 、 、 Perform matrix multiplication, scaling, Softmax function calculation, etc.

[0113] because , , ,so 、 、 . Due to the fragmented ciphertext of the intermediate calculation results 、 、 They are all ciphertexts, and it takes a lot of computing and communication overhead for multiple computing devices to perform secure multi-party computation of the Softmax function on the homomorphic ciphertext. Therefore, the embodiment of the present invention adopts the method of decryption first and then calculation to reduce the communication and computing workload of the computing devices.

[0114] computing devices Randomly select a plaintext matrix 、 、 As a random number, perform plaintext-ciphertext matrix addition 、 、 , and record the result as the second ciphertext and send it to the user device.

[0115] After receiving the second ciphertext, the user device performs an addition calculation 、 、 ,get 、 、 ,in 、 、 .

[0116] Then, the user device 、 、 Perform the decryption operation to obtain the query matrix in plain text with the random number added , key matrix Sum Matrix , which is the third ciphertext in the above embodiment. The existence of random numbers makes it impossible for the user device to infer the information of the model weight matrix.

[0117] User equipment query matrix , key matrix Sum Matrix After performing additive secret sharing, send to computing devices, each computing device gets a share 、 and ,in 、 、 Note that the sharding method here has nothing to do with the sharding method of the first device.

[0118] Each computing device obtains a query matrix , key matrix Sum Matrix share 、 and Then, calculate locally 、 、 .

[0119] Afterwards, the computing device Will 、 、 Send to target computing device ,in for A value agreed upon by all computing devices.

[0120] Target computing device Perform addition calculations to obtain the query matrix in plain text without random numbers , key matrix Sum Matrix , which is the plain text of the intermediate calculation result.

[0121] Since the target computing device Only has the model weight matrix share, so it cannot be based on 、 and Inferring the inference input data of the user device. And because the target computing device It does not have the plain text of the inference input data, so it cannot be based on 、 and Infer the complete model weight matrix.

[0122] Target computing device according to 、 and The remaining calculation of attention is done in plain text, i.e., ,in is a matrix The number of columns, Indicates the Attention calculation, Indicates the The result of activation function calculation.

[0123] The above steps are for one attention calculation. In multi-head attention calculation, the above steps are performed t times, where t is the number of attention heads. Different attention calculations can be negotiated to select different target computing devices to perform, thus achieving distributed computing. After the multi-head attention calculation is completed, each target computing device broadcasts the activation function calculation results. , all computing devices get the spliced ​​matrix .

[0124] The computing device then uses the matrix share calculate ,get Additive Secret Sharing .

[0125] The computing device performs the remaining calculations in the model inference calculation, including residual connections, normalization, and secure multi-party computation of the fully connected layer.

[0126] Specifically, the computing device uses the addition secret sharing share and Calculated using secure multi-party computing , get the additive secret sharing share ,in , , the first encoder The secret share of the inference input data (inference input data shard) sent by the user device to the computing device.

[0127] The computing device uses the additive secret sharing share 、 、 、 、 Calculated using secure multi-party computing , get the secret sharing share of the encoder output .

[0128] The above steps complete the privacy protection calculation of one encoder, and repeat the above steps to complete the superposition calculation of multiple encoders.

[0129] The calculation process of the decoder is similar.

[0130] The computing device sends the final secret share of the Softmax function's predicted output (output result shard) to the user device. The user device aggregates the secret shares of each computing device to obtain the inference result (data processing result).

[0131] It is understandable that, in addition to the Transformer model, the data processing methods provided in the above embodiments of the present invention can also be applied to distributed reasoning calculations based on other models.

[0132] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0133] An embodiment of the present invention further provides a data processing apparatus, applied to a computing device, comprising:

[0134] A first computing unit, configured to compute a ciphertext of an intermediate computing result shard based on the model parameter shard sent by the first device and the first ciphertext of the inference input data sent by the user device;

[0135] A first encryption unit is used to encrypt the ciphertext of the intermediate calculation result fragment to obtain a second ciphertext;

[0136] A first sending unit, configured to send the second ciphertext to a user device, so that the user device aggregates the second ciphertexts of multiple computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext;

[0137] a first decryption unit, configured to receive and decrypt the third ciphertext to obtain a plaintext of the intermediate calculation result;

[0138] The second computing unit is used to perform the remaining calculations of the model inference calculation using the plain text of the intermediate calculation result to obtain a local output result fragment;

[0139] The second sending unit is used to send the output result slices to the user device, so that the user device aggregates the output result slices of multiple computing devices to obtain the data processing result.

[0140] In an embodiment of the present invention, the first computing unit calculates the ciphertext of the intermediate calculation result segment based on the model parameter segment sent by the first device and the first ciphertext of the inference input data sent by the user device, which may include: performing vector coding calculation on the first ciphertext according to the model vector coding calculation parameters sent by the first device to obtain a first vector coding result; and calculating the ciphertext of the intermediate calculation result segment based on the model parameter segment and the first vector coding result.

[0141] In an embodiment of the present invention, the model vector encoding calculation parameters may include a word embedding model and a position encoding matrix; the first calculation unit performs vector encoding calculation on the first ciphertext according to the model vector encoding calculation parameters sent by the first device to obtain a first vector encoding result, which may include: using the word embedding model to perform word embedding calculation on the first ciphertext, adding the calculation result to the position encoding matrix to obtain the first vector encoding result.

[0142] In an embodiment of the present invention, the first encryption unit encrypts the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext, which may include: adding a locally corresponding random number to the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext.

[0143] In an embodiment of the present invention, a user device aggregating second ciphertexts from multiple computing devices and decrypting them using a homomorphic encryption algorithm to obtain a third ciphertext may include: the user device sharding the result of aggregating the second ciphertexts from the multiple computing devices and decrypting them using the homomorphic encryption algorithm to obtain the third ciphertext. A first decryption unit receives the third ciphertext and decrypts it to obtain a plaintext of an intermediate calculation result, which may include: removing a locally corresponding random number from the third ciphertext to obtain a first intermediate calculation result; and aggregating the first intermediate calculation results from the multiple computing devices to obtain the plaintext of the intermediate calculation result.

[0144] In an embodiment of the present invention, the first decryption unit aggregates the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation results, which may include: a target computing device in the computing device aggregates the first intermediate calculation results of multiple computing devices; and receives the plaintext of the intermediate calculation results sent by the target computing device.

[0145] In an embodiment of the present invention, the first decryption unit aggregates the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation results, and may also include: a target computing device in the computing device aggregates the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation results. The second computing unit uses the plaintext of the intermediate calculation results to perform the remaining calculations of the model inference calculation to obtain a local output result slice, which may include: the target computing device performs an activation function calculation based on the plaintext of the intermediate calculation result after calculating the ciphertext of the intermediate calculation result slice based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, and broadcasts the activation function calculation result to the computing device; the computing device performs the remaining calculations of the model inference calculation based on the activation function calculation result to obtain a local output result slice.

[0146] In an embodiment of the present invention, the first computing unit calculates the ciphertext of the intermediate calculation result slice based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, which is a multi-head calculation; the target computing device corresponds to the computing head of the multi-head calculation. Then, the target computing device performs the activation function calculation after the ciphertext of the intermediate calculation result slice is calculated based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device based on the plaintext of the intermediate calculation result, and broadcasts the activation function calculation result to the computing device. This may include: multiple target computing devices perform the activation function calculation based on the plaintext of the intermediate calculation result in parallel, and broadcast the activation function calculation result to the computing device. The computing device performs the remaining calculations of the model inference calculation based on the activation function calculation result to obtain a local output result slice. This may include: the computing device splices the activation function calculation results of multiple computing devices, and performs the remaining calculations of the model inference calculation based on the spliced ​​result of the activation function calculation results to obtain a local output result slice.

[0147] The data processing apparatus provided by an embodiment of the present invention may further include: a determination unit configured to redetermine a target computing device before executing different layers of calculation of the model inference calculation.

[0148] In an embodiment of the present invention, the second computing unit uses the plain text of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain a local output result slice, which may include: receiving the inference input data slice sent by the user device; performing the remaining calculations of the model inference calculation according to the inference input data slice, the plain text of the intermediate calculation result and the model parameter slice to obtain a local output result slice.

[0149] In an embodiment of the present invention, the second computing unit performs the remaining calculations of the model inference calculation based on the inference input data slice, the plaintext of the intermediate calculation result, and the model parameter slice to obtain a local output result slice, which may include: using the fully connected layer linear transformation parameter slice in the model parameter slice and the activation function calculation result obtained according to the plaintext of the intermediate calculation result to obtain the local first fully connected layer output slice; performing residual connection calculation and normalization calculation based on the inference input data slice and the first fully connected layer output slice to obtain a normalized calculation result slice; performing feedforward neural network calculation based on the normalized calculation result slice and the feedforward neural network parameter slice in the model parameter slice to obtain the secret sharing share output by the current layer; if the current layer is not the last layer of the model, the secret sharing share output by the current layer is used as the input data of the next layer of the model; if the current layer is the last layer of the model, the output layer calculation is performed according to the secret sharing share output by the previous layer to obtain a local output result slice.

[0150] For the description of the features in the embodiments corresponding to the data processing device, reference can be made to the relevant description of the embodiments corresponding to the data processing method, which will not be repeated here.

[0151] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above data processing method embodiments.

[0152] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above data processing method embodiments when running.

[0153] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0154] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above data processing method embodiments are implemented.

[0155] An embodiment of the present invention further provides another computer program product, comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above-mentioned data processing method embodiments are implemented.

[0156] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0157] The above is a detailed introduction to a data processing method, system, device, medium and computer program product provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, the present invention can also be improved and modified, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: Applied to computing devices, including: Performing a matrix multiplication calculation based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device to obtain a ciphertext of the intermediate calculation result slice; Encrypting the ciphertext of the intermediate calculation result fragment to obtain a second ciphertext; Sending the second ciphertext to the user device, so that the user device aggregates the second ciphertexts of the plurality of computing devices and decrypts them using a homomorphic encryption algorithm to obtain a third ciphertext; receiving the third ciphertext and decrypting it to obtain a plaintext of the intermediate calculation result; Utilize the plaintext of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain local output result fragments; Sending the output result slices to the user device, so that the user device aggregates the output result slices of multiple computing devices to obtain a data processing result; The encrypting of the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext includes: adding a locally corresponding random number to the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext; The user device aggregates the second ciphertexts of the plurality of computing devices and decrypts the aggregated second ciphertexts using a homomorphic encryption algorithm to obtain a third ciphertext, including: the user device aggregates the second ciphertexts of the plurality of computing devices and shards the result of decrypting the aggregated second ciphertexts using a homomorphic encryption algorithm to obtain the third ciphertext; The third ciphertext is received and decrypted to obtain the plaintext of the intermediate calculation result, including: removing the locally corresponding random number from the third ciphertext to obtain the first intermediate calculation result; and aggregating the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation result.

2. The data processing method according to claim 1, wherein: Performing a matrix multiplication calculation based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device to obtain the ciphertext of the intermediate calculation result slice, including: performing vector encoding calculation on the first ciphertext according to the model vector encoding calculation parameters sent by the first device to obtain a first vector encoding result; Matrix multiplication calculation is performed according to the model parameter slice and the first vector encoding result to obtain the ciphertext of the intermediate calculation result slice.

3. The data processing method according to claim 2, characterized in that: The model vector encoding calculation parameters include a word embedding model and a position encoding matrix; Performing vector encoding calculation on the first ciphertext according to the model vector encoding calculation parameters sent by the first device to obtain a first vector encoding result includes: The word embedding model is used to perform word embedding calculation on the first ciphertext, and the calculation result is added to the position encoding matrix to obtain the first vector encoding result.

4. The data processing method according to claim 1, wherein: Aggregating the first intermediate calculation results of the plurality of computing devices to obtain a plain text of the intermediate calculation result includes: A target computing device among the computing devices aggregates the first intermediate computing results of a plurality of the computing devices; Receive the plain text of the intermediate calculation result sent by the target computing device.

5. The data processing method according to claim 1, wherein: Aggregating the first intermediate calculation results of the plurality of computing devices to obtain a plain text of the intermediate calculation result includes: A target computing device among the computing devices aggregates the first intermediate computing results of a plurality of the computing devices to obtain a plain text of the intermediate computing results; The remaining calculations of the model inference calculation are performed using the plain text of the intermediate calculation result to obtain local output result fragments, including: The target computing device performs, based on the plaintext of the intermediate computing result, an activation function calculation after the ciphertext of the intermediate computing result slice is obtained by calculating the ciphertext of the intermediate computing result slice according to the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, and broadcasts the activation function calculation result to the computing device; The computing device performs the remaining calculations of the model inference calculation based on the activation function calculation result to obtain the local output result fragment.

6. The data processing method according to claim 5, characterized in that: Performing a matrix multiplication calculation based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, to obtain the ciphertext of the intermediate calculation result slice as a multi-head calculation; The target computing device corresponds to a computing head of the multi-head computing; The target computing device performs, based on the plaintext of the intermediate calculation result, an activation function calculation after the ciphertext of the intermediate calculation result slice is obtained by calculating the ciphertext of the intermediate calculation result slice according to the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device, and broadcasts the activation function calculation result to the computing device, including: The plurality of target computing devices execute the activation function calculation in parallel based on the plain text of the intermediate calculation result, and broadcast the activation function calculation result to the computing device; The computing device performs the remaining calculations of the model inference calculation based on the activation function calculation result to obtain the local output result fragment, including: The computing device splices the activation function calculation results of multiple computing devices, performs the remaining calculations of the model inference calculation according to the splicing results of the activation function calculation results, and obtains the local output result fragment.

7. The data processing method according to any one of claims 4 to 6, characterized in that: Also includes: Before executing different layers of calculation of the model inference calculation, the target computing device is re-determined.

8. The data processing method according to claim 1, wherein: The remaining calculations of the model inference calculation are performed using the plain text of the intermediate calculation result to obtain local output result fragments, including: receiving an inference input data slice sent by the user equipment; The remaining calculations of the model inference calculation are performed according to the inference input data slice, the plain text of the intermediate calculation result and the model parameter slice to obtain the local output result slice.

9. The data processing method according to claim 8, characterized in that: Performing the remaining calculations of the model inference calculation according to the inference input data slice, the plain text of the intermediate calculation result, and the model parameter slice to obtain the local output result slice, including: Calculate a local first fully connected layer output slice using the fully connected layer linear transformation parameter slice in the model parameter slice and the activation function calculation result obtained according to the plain text of the intermediate calculation result; Performing residual connection calculation and normalization calculation according to the inference input data slice and the first fully connected layer output slice to obtain a normalized calculation result slice; Performing feedforward neural network calculation based on the normalized calculation result slice and the feedforward neural network parameter slice in the model parameter slice to obtain a secret sharing share output by the current layer; If the current layer is not the last layer of the model, the secret sharing share output by the current layer is used as the input data for the next layer of the model; If the current layer is the last layer of the model, the output layer calculation is performed according to the secret sharing share output by the previous layer to obtain the local output result fragment.

10. A data processing system, characterized in that: include: multiple computing devices and user devices; The computing device is configured to perform a matrix multiplication calculation based on the model parameter slice sent by the first device and the first ciphertext of the inference input data sent by the user device to obtain the ciphertext of the intermediate calculation result slice; Encrypting the ciphertext of the intermediate calculation result fragment to obtain a second ciphertext; Sending the second ciphertext to the user equipment; receiving and decrypting the third ciphertext sent by the user equipment to obtain a plaintext of the intermediate calculation result; Utilize the plaintext of the intermediate calculation result to perform the remaining calculations of the model inference calculation to obtain local output result fragments; Sending the output result slices to the user equipment; The user device is used to aggregate the second ciphertexts of the plurality of computing devices and decrypt them using a homomorphic encryption algorithm to obtain the third ciphertext, and is also used to aggregate the output result shards of the plurality of computing devices to obtain a data processing result; The encrypting of the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext includes: adding a locally corresponding random number to the ciphertext of the intermediate calculation result fragment to obtain the second ciphertext; The user device aggregates the second ciphertexts of the plurality of computing devices and decrypts the aggregated second ciphertexts using a homomorphic encryption algorithm to obtain a third ciphertext, including: the user device aggregates the second ciphertexts of the plurality of computing devices and shards the result of decrypting the aggregated second ciphertexts using a homomorphic encryption algorithm to obtain the third ciphertext; The third ciphertext is received and decrypted to obtain the plaintext of the intermediate calculation result, including: removing the locally corresponding random number from the third ciphertext to obtain the first intermediate calculation result; and aggregating the first intermediate calculation results of multiple computing devices to obtain the plaintext of the intermediate calculation result.

11. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the data processing method according to any one of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 9 are implemented.

13. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the data processing method according to any one of claims 1 to 9 are implemented.

Images