Segmentation learning privacy protection method and system based on selective decryption

Abstract

The invention belongs to the technical field of segmentation learning privacy protection, and provides a segmentation learning privacy protection method based on selective decryption, and in each round of learning, a client maps original data into an initial feature through a first local model, and obtains and uploads an initial feature ciphertext and a label ciphertext to a server; the server inputs the initial feature ciphertext into a second local model, and returns an nth layer of intermediate feature ciphertext to the client when it is monitored that the nth layer of intermediate feature ciphertext output by the nth layer of neural network of the N layers of neural networks is abstract based on a server abstract judgment algorithm; uploading the nth layer of intermediate feature plaintext to a server; inputting the nth layer of intermediate feature plaintext to a network behind the nth layer of neural network to obtain a prediction result, and calculating a noise adding gradient; the client updates a first local model network parameter based on the noise adding gradient; the invention further provides a system of the segmentation learning privacy protection method based on selective decryption. According to the method, the privacy of the original data is better protected, and the calculation efficiency and the training efficiency are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection for split learning, and particularly to a privacy protection method and system for split learning based on selective decryption. Background Art

[0002] When training an image classification model for a client with limited computing resources, split learning is used to train the model. Split learning aims to solve the problems of data privacy and lack of computing resources. It divides the model to be trained into two parts, such as the underlying model (the first local model) of the client and the top-level model (the second local model) of the server. The framework of split learning in related technologies is as Figure 3 shown and has the following characteristics:

[0003] Model and data distribution: The client has the original data and the underlying model, and the server has the top-level model and the labels directly shared by the client. During the training process, the client uses the underlying model to map the original data x0 to high-dimensional features (activation information) x k , that is, x k = Forward(x0, w c ), which can also be expressed as x k = f1(x0), where f1 represents the function corresponding to the underlying model. Then the client uses the homomorphic encryption algorithm to encrypt the activation information x k to obtain the ciphertext x k ' of the activation information, and the client uploads the ciphertext of the activation information to the server.

[0004] Server calculation and feedback: After receiving the ciphertext of the activation information, the server continues the forward propagation calculation y = f2(x k ') with it as the input, where f2 represents the function corresponding to the top-level model. Then calculate the loss function Loss = CE(y, y true ) (y true represents the true label), and backpropagate to update the top-level model w s , obtain the gradient g k = BackProp(x k , w s ) of the backpropagation of the split layer (i.e., the first neural network layer of the top-level model), and then send the gradient g k to the client.

[0005] Client model update: After receiving the gradient g k sent by the server, the client continues to execute the backpropagation process and update the underlying model w c , and completes one round of training in this way. The model converges through multiple rounds of training.

[0006] The related split learning encrypts the activation information using the homomorphic encryption algorithm. The server calculates on the ciphertext, and the calculation result is consistent with the result calculated on the plaintext after decryption, thereby protecting data privacy. However, there are still the following deficiencies in privacy protection:

[0007] First, privacy protection vulnerabilities: During the training process of related split learning, the intermediate results transmitted between the client and the server contain privacy information such as raw data and labels, which are extremely vulnerable to raw data reconstruction attacks and label inference attacks. In terms of raw data reconstruction attacks, such as model inversion attacks, the server can reverse the intermediate results through an optimized shadow model to reconstruct the raw data. There is also a feature space hijacking attack. A malicious server uses a public dataset to train the encoder and decoder, tampering with the client update process to make the output space of the client model overlap with the output space of the encoder, thereby reconstructing the raw data, seriously threatening data privacy and security; in terms of label inference attacks, attacks based on data distribution use the characteristics of data distribution or the classification ability of the model to infer labels. For example, when the underlying model of the client is well-trained, a partial labeled dataset can be used to fine-tune the model for label inference. These attack behaviors seriously damage the privacy of the data.

[0008] Second, low computational efficiency: To protect privacy, existing technologies often use homomorphic encryption methods, but the computational overhead of homomorphic encryption is extremely large. In the split learning scenario, the server needs to perform complex calculations on encrypted data, and each step of the calculation involves a large number of ciphertext operations, resulting in a slow calculation speed and a significant extension of the model training time. This makes split learning inefficient in practical applications and difficult to meet the requirements of tasks with high real-time requirements, restricting its wide application in practical scenarios.

[0009] Therefore, how to improve the privacy and security of split learning, reduce the computational overhead during the training process, and improve the training efficiency are technical problems that need to be solved urgently. Summary of the Invention

[0010] This application aims to at least solve the technical problems existing in the prior art and provides a privacy protection method and system for split learning based on selective decryption.

[0011] In a first aspect, the present application provides a privacy protection method for split learning based on selective decryption, which divides the model to be trained into a first local model and a second local model. The second local model includes N layers of neural networks. In each round of split learning, the following operations are performed: The client maps the original data into initial features through the first local model, and encrypts the initial features using the fully homomorphic encryption algorithm to obtain the ciphertext of the initial features; the client encrypts the label using the asymmetric homomorphic encryption algorithm to obtain the ciphertext of the label; the client uploads the ciphertext of the initial features, the ciphertext of the label, and the public key of the asymmetric homomorphic encryption algorithm to the server; the server inputs the ciphertext of the initial features into the second local model. When it is detected based on the server's abstract judgment algorithm that the ciphertext of the intermediate features of the nth layer of the N layers of neural networks is abstract, the ciphertext of the intermediate features of the nth layer is sent back to the client, where 1 ≤ n < N and N is a positive integer greater than or equal to 2; the client decrypts the ciphertext of the intermediate features of the nth layer to obtain the plaintext of the intermediate features of the nth layer, and uploads the plaintext of the intermediate features of the nth layer to the server; the server continues to input the plaintext of the intermediate features of the nth layer into the network after the nth layer of neural networks in the second local model for processing to obtain the prediction result, and calculates the ciphertext of the loss using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the ciphertext of the label; the network parameters of the second local model are updated based on the ciphertext of the loss and the noisy gradient is obtained; the client updates the network parameters of the first local model based on the noisy gradient.

[0012] In a second aspect, the present application provides a system based on the privacy protection method for split learning based on selective decryption described in the first aspect of the present application, including a client and a server connected to the client for communication.

[0013] The beneficial technical effects of the present application are as follows:

[0014] In terms of privacy protection, the initial features obtained by the first local model of the client are encrypted using fully homomorphic encryption to obtain the ciphertext of the initial features, and the label is encrypted using the asymmetric homomorphic encryption algorithm to obtain the ciphertext of the label. Even if the ciphertext of the initial features and the ciphertext of the label are stolen during transmission, the attacker cannot obtain the content of the original data; before the abstract ciphertext of the intermediate features is detected, that is, in the preliminary calculation of the server, the encryption state of the data processed by the second local model is consistently maintained to continuously protect data privacy; and when the ciphertext of the intermediate features of the nth layer is detected as abstract, the plaintext of the intermediate features of the nth layer decrypted by the client and uploaded to the server is also abstract, and the attacker cannot restore it to the original data through it; the server calculates the ciphertext of the loss using the ciphertext of the label and the ciphertext of the prediction result, so that the server cannot know the content of the label and protects the privacy of the label; the ciphertext of the loss and the noisy gradient sent by the server to the client are both protected in terms of privacy. It can be seen that the present application provides good security protection for the transmission information between the client and the server.

[0015] In terms of computational overhead and training efficiency, in the prior art, the computational overhead of homomorphic encryption is large, resulting in low model training efficiency. In this application, when the server-side abstraction judgment algorithm monitors the abstraction of the ciphertext of intermediate features at a certain level in the N-layer neural network of the second local model (such as the ciphertext of intermediate features at the nth layer), the network after the nth layer no longer extracts features in ciphertext form. Instead, the ciphertext of intermediate features at the nth layer is transmitted to the client for processing to obtain the plaintext of intermediate features at the nth layer, and the plaintext of intermediate features at the nth layer is uploaded to the server. The network after the nth layer in the second local model processes the plaintext of intermediate features at the nth layer to obtain a prediction result. The server performs calculations in plaintext state after the abstraction layer (the layer where the abstraction of ciphertext of intermediate features occurs), avoiding the high computational overhead of full homomorphic encryption and improving computational efficiency and training efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a schematic flowchart of a privacy protection method for split learning based on selective decryption in a preferred embodiment of the present invention;

[0017] Figure 2 is a schematic communication diagram between a client and a server in a system in a preferred embodiment of the present invention;

[0018] Figure 3 is a schematic framework diagram of split learning in the related art. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the drawings, where the same or similar reference numerals indicate the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are only used to explain the present invention and should not be construed as a limitation of the present invention.

[0020] In the description of the present invention, it should be understood that the orientation or positional relationship indicated by the terms "longitudinal", "transverse", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention.

[0021] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected", "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal communication of two elements. It can be directly connected or indirectly connected through an intermediate medium. For those of ordinary skill in the art, the specific meanings of the above terms can be understood according to specific circumstances.

[0022] The present invention provides a privacy protection method for split learning based on selective decryption. In a preferred embodiment, the method includes: splitting the model to be trained into a first local model and a second local model, where the first local model is deployed on the client side and the second local model is deployed on the server side. The second local model includes N layers of neural networks and an output network. After performing multiple rounds of split learning until the training stop condition is reached, the training of the model to be trained is completed. The output network preferably but not limited to includes more than one cascaded fully connected layer. The training stop condition preferably but not limited to is that the number of learning rounds reaches a preset maximum number of learning rounds, or the loss is reduced to a preset loss threshold. Each layer of the N layers of neural networks extracts and transforms features from its input data, and as the calculation progresses, the data is gradually abstracted.

[0023] In one example, the model to be trained is an image classification model. The network structure of the image classification model preferably but not limited to adopts a convolutional neural network, and the convolutional neural network is an architecture of multiple layers of convolution + pooling + fully connected layers, such as the VGGNet convolutional neural network, which generally includes 13 to 19 layers of convolution (small kernel stacking) and 3 fully connected layers. The VGGNet convolutional neural network can adopt VGG-16 or VGG-19. Split the multiple layers of convolution in the convolutional neural network to obtain a first part of the multiple layers of convolution and a second part of the multiple layers of convolution. The first part of the multiple layers of convolution is deployed on the client side as the first local model, and the second part of the multiple layers of convolution + pooling + fully connected layers is deployed on the server side as the second local model. The second part of the multiple layers of convolution is the N layers of neural networks and includes N layers of convolution. The original data on the client side is image data, and the client has an image data set. The image data preferably but not limited to is RGB image or grayscale image or medical image (such as CT image, MT image, etc.). Each image data has a class label, and the class label can be an object class label (such as apple size grade classification label, disease diagnosis label, etc.). The client preferably but not limited to is a personal computer or a hardware server. The server preferably but not limited to is a hardware server or a cloud server or a computer cluster capable of providing computing power.

[0024] Please refer to Figure 1 and Figure 2 and perform in each round of split learning:

[0025] Step S1, including: Step S11, the client maps the original data to initial features through the first local model, and encrypts the initial features using the fully homomorphic encryption algorithm to obtain the initial feature ciphertext; Step S12, the client encrypts the label using the asymmetric homomorphic encryption algorithm to obtain the label ciphertext. Steps S11 and S12 can be executed synchronously or asynchronously.

[0026] In this embodiment, the client or the third-party key management center or the key distribution center (KDC) constructs a key group for the fully homomorphic encryption algorithm (FHE) and a key pair for the asymmetric homomorphic encryption algorithm (AHE). The third-party key management center or the key distribution center sends the key group of the fully homomorphic encryption algorithm and the key pair of the asymmetric homomorphic encryption algorithm to the client, and sends the public key in the key pair of the asymmetric homomorphic encryption algorithm to the server.

[0027] In this embodiment, please refer to Figure 2 , in step S11, the client maps the original data to the initial feature A through the first local model, and the client encrypts the initial feature A using the public key of the fully homomorphic encryption algorithm to obtain the initial feature ciphertext C. In step S12, the client encrypts the label y true using the public key pk of the asymmetric homomorphic encryption algorithm true to obtain the label ciphertext Enc(y

[0028] In the above example, the client extracts features from the image data through the first local model (i.e., the first part of the multi-layer convolution) to obtain the initial feature, that is, maps the image data to the initial feature, and encrypts the initial feature using the public key of the fully homomorphic encryption algorithm to obtain the initial feature ciphertext. The client encrypts the classification label of the image data using the public key of the asymmetric homomorphic encryption algorithm to obtain the label ciphertext.

[0029] Step S2, the client uploads the initial feature ciphertext, the label ciphertext, and the public key of the asymmetric homomorphic encryption algorithm to the server. Please refer to Figure 2 , where C, pk, and Enc(y true ) are uploaded to the server.

[0030] Step S3, the server inputs the initial feature ciphertext into the second local model. When it is monitored by the server-side abstraction judgment algorithm that the nth intermediate feature ciphertext C n output by the nth neural network of the N-layer neural network is abstract, the nth intermediate feature ciphertext C n is sent back to the client, where 1 ≤ n < N and N is a positive integer greater than or equal to 2.

[0031] In this embodiment, during the process of the N-layer neural network in the second local model processing features layer by layer, it is monitored in real time whether the intermediate feature ciphertext output by each layer of the neural network is abstract. If the nth intermediate feature ciphertext C n output by the nth neural network is abstract, the subsequent N - n layers of the N-layer neural network stop processing, and the nth intermediate feature ciphertext C nto the client; if the ciphertext C of the intermediate features of the n-th layer output by the n-th layer neural network n is not abstract, then continue to send the ciphertext C of the intermediate features of the n-th layer n to the (n + 1)-th layer neural network for processing, and perform the abstraction judgment on the ciphertext C of the intermediate features of the (n + 1)-th layer n+1 When the ciphertext C of the intermediate features of the n-th layer n is abstract, it is difficult for the malicious server to infer the original data from C n .

[0032] In this embodiment, preferably, to improve the server-side abstraction judgment speed, the server-side abstraction judgment algorithm in step S3 adopts one of the following three methods:

[0033] Method 1: If the feature dimension of the ciphertext C of the intermediate features of the n-th layer n is less than or equal to the preset dimension threshold, then it is considered that the ciphertext C of the intermediate features of the n-th layer n is abstract. If the feature dimension of the ciphertext C of the intermediate features of the n-th layer n is higher than the preset dimension threshold, then it is considered that the ciphertext C of the intermediate features of the n-th layer n is not abstract.

[0034] Method 2: If the information entropy of the ciphertext C of the intermediate features of the n-th layer n is less than or equal to the preset entropy threshold, then it is considered that the ciphertext C of the intermediate features of the n-th layer n is abstract. If the information entropy of the ciphertext C of the intermediate features of the n-th layer n is greater than the preset entropy threshold, then it is considered that the ciphertext C of the intermediate features of the n-th layer n is not abstract.

[0035] Method 3: If the feature dimension of the ciphertext C of the intermediate features of the n-th layer n is less than or equal to the preset dimension threshold, and the information entropy of the ciphertext C of the intermediate features of the n-th layer n is less than or equal to the preset entropy threshold, then it is considered that the ciphertext C of the intermediate features of the n-th layer n is abstract, otherwise it is considered that the ciphertext C of the intermediate features of the n-th layer n is not abstract.

[0036] In the above embodiment, step S3 is expressed as: The server inputs the initial feature ciphertext into the second local model. When it is monitored by the server-side abstraction judgment algorithm that the ciphertext C of the intermediate features of the n-th layer output by the n-th layer convolution of the second part of the multi-layer convolution is n abstract, the ciphertext C of the intermediate features of the n-th layer is returned n to the client.

[0037] Step S4, the client decrypts the ciphertext of the intermediate features of the n-th layer to obtain the plaintext of the intermediate features of the n-th layer, and uploads the plaintext of the intermediate features of the n-th layer to the server.

[0038] In this embodiment, the client can directly decrypt the ciphertext C of the intermediate features of the nth layer by using the private key of the fully homomorphic encryption algorithm n to obtain the plaintext P of the intermediate features of the nth layer n , and then upload the plaintext P of the intermediate features of the nth layer n to the server

[0039] Step S5: The server continues to input the plaintext of the intermediate features of the nth layer into the network after the nth layer neural network of the second local model for network processing to obtain a prediction result (i.e., continue forward propagation calculation), calculate the loss ciphertext by using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the label ciphertext, and update the network parameters of the second local model and obtain the noisy gradient based on the loss ciphertext

[0040] In this embodiment, the server inputs the plaintext P of the intermediate features of the nth layer n into the network after the nth layer neural network of the second local model (the (n + 1)th layer neural network,..., the Nth layer neural network, and the output network) for processing. In the above example, the plaintext P of the intermediate features of the nth layer n is input into the (n + 1)th layer convolution,..., the Nth layer convolution, and 3 cascaded fully connected layers for processing to obtain a predicted classification result

[0041] In this embodiment, preferably, to ensure that the server cannot obtain the real label information and strengthen the privacy protection of the label, in step S5, calculating the loss ciphertext by using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the label ciphertext includes

[0042] Step S51: Encrypt the prediction result y by using the public key pk of the asymmetric homomorphic encryption algorithm to obtain the ciphertext Enc(y) of the prediction result

[0043] Step S52: Calculate the loss ciphertext Enc(loss) through the ciphertext Enc(y) of the prediction result and the ciphertext Enc(y true ). The loss calculation function is preferably but not limited to the existing cross-entropy loss function. Directly calculate the loss by using the ciphertext of the prediction result and the corresponding real label ciphertext. Due to the properties of the homomorphic encryption algorithm, the calculation result of the ciphertext is consistent with the calculation result of the plaintext, so that the server can calculate the loss without knowing the real content of the label. This label protection method effectively prevents the server from knowing the label content, enhances the privacy protection of the label, and solves the defect of the prior art in label privacy protection

[0044] In this embodiment, preferably, to improve the privacy protection of gradient information and loss, in step S5, updating the network parameters of the second local model and obtaining the noisy gradient based on the loss ciphertext includes

[0045] Step S53, the server sends the loss ciphertext to the client or the third-party key management center. Step S54, the client or the third-party key management center decrypts the loss ciphertext Enc(loss) to obtain the loss plaintext loss, and uploads the loss plaintext loss to the server. Specifically, the client or the third-party key management center uses the private key of the asymmetric homomorphic encryption to decrypt the loss ciphertext Enc(loss) to obtain the loss plaintext loss.

[0046] Step S55, the server updates the network parameters of the second local model according to the loss plaintext and generates the gradient to be sent back to the client. After obtaining the loss plaintext, the server calculates the gradient of each layer of the network according to the loss plaintext, and obtains the gradient of the last layer of the neural network of the first local model that needs to be sent back. In the above example, the server obtains the gradient of the last convolution layer of the first part of the multi-layer convolution of the image classification model deployed on the client.

[0047] Step S56, the differential privacy technology is used to add noise to the gradient to obtain the noise-added gradient, and the noise-added gradient is sent to the client.

[0048] In this embodiment, to improve the problem that the privacy protection of gradient information is not perfect enough in the model update and feedback process of the existing split learning, the differential privacy technology is used to add an appropriate amount of noise to the gradient information to obtain the processed noise-added gradient G. The application of the differential privacy technology effectively protects the gradient information during the transmission process. Even if the gradient information is stolen, it is difficult for the attacker to obtain the accurate original gradient information.

[0049] Step S6, the client updates the network parameters of the first local model based on the noise-added gradient.

[0050] In this embodiment, after receiving the noise-added gradient G, the client updates the network parameters of the local first local model according to the noise-added gradient G, and completes one round of split learning. Through the privacy protection of the gradient information, the security of the entire split learning process is further improved.

[0051] In this embodiment, after multiple rounds of iterative split learning until the training stop condition is reached, the first local model of the client and the second local model of the server form a trained complete model. In actual testing, after the client obtains the original data to be tested, it inputs the data into the first local model to obtain initial features, encrypts the initial features using the fully homomorphic encryption algorithm to obtain initial feature ciphertext, and uploads the initial feature ciphertext to the server. The server inputs the initial feature ciphertext into the second local model, and at the same time uses the server-side abstraction judgment algorithm to monitor whether the intermediate feature ciphertext output by each layer in the N-layer neural network is abstract. If the intermediate feature ciphertext of the nth layer is monitored to be abstract, the intermediate feature ciphertext of the nth layer is sent back to the client. The client decrypts the intermediate feature ciphertext of the nth layer to obtain the intermediate feature plaintext of the nth layer, and uploads the intermediate feature plaintext of the nth layer to the server. The server sends the intermediate feature plaintext of the nth layer to the (n + 1)th layer neural network and the subsequent network processing to obtain a prediction result. The server uses the public key of the asymmetric homomorphic encryption algorithm to encrypt the prediction result ciphertext to obtain the prediction result ciphertext, and sends the prediction result ciphertext back to the client. The client decrypts the prediction result ciphertext to obtain the prediction result corresponding to the original data to be tested.

[0052] Similarly, for the above example, after multiple rounds of iterative split learning until the training stop condition is reached, the first local model of the client and the second local model of the server form an image classification model. In actual testing, after the client obtains the image to be tested, it inputs the image into the first local model to obtain initial features, encrypts the initial features using the fully homomorphic encryption algorithm to obtain initial feature ciphertext, and uploads the initial feature ciphertext to the server. The server inputs the initial feature ciphertext into the second local model, and at the same time uses the server-side abstraction judgment algorithm to monitor whether the intermediate feature ciphertext output by each layer in the second part of the multi-layer convolution is abstract. If the intermediate feature ciphertext of the nth layer is monitored to be abstract, the intermediate feature ciphertext of the nth layer is sent back to the client. The client decrypts the intermediate feature ciphertext of the nth layer to obtain the intermediate feature plaintext of the nth layer, and uploads the intermediate feature plaintext of the nth layer to the server. The server sends the intermediate feature plaintext of the nth layer to the (n + 1)th layer convolution and the subsequent network processing to obtain a predicted classification result. The server uses the public key of the asymmetric homomorphic encryption algorithm to encrypt the predicted classification result to obtain the predicted classification result ciphertext, and sends the predicted classification result ciphertext back to the client. The client decrypts the predicted classification result ciphertext to obtain the predicted classification result corresponding to the image to be tested.

[0053] In a preferred embodiment, to improve data security and avoid data leakage caused by incorrect unilateral abstraction judgment by the server or malicious judgment due to an attack on it, in step S4, when the client decrypts the intermediate feature ciphertext of the nth layer to obtain the intermediate feature plaintext of the nth layer, it includes:

[0054] Step S411, the client uses the key of the fully homomorphic encryption algorithm to decrypt the intermediate feature ciphertext of the nth layer to obtain the intermediate feature plaintext of the nth layer;

[0055] Step S412: When the client determines the ciphertext abstraction of the intermediate features at the nth layer based on the client-side abstraction judgment algorithm, upload the plaintext of the intermediate features at the nth layer to the server.

[0056] In this embodiment, the client-side abstraction judgment algorithm can refer to the server-side abstraction judgment algorithm scheme, that is, any one of the above-mentioned Method 1, Method 2, and Method 3 is selected to perform the ciphertext abstraction judgment of the intermediate features based on the preset dimension threshold and / or the preset entropy threshold.

[0057] In the client-side abstraction judgment algorithm of the previous preferred embodiment, the preset dimension threshold and the preset entropy threshold are mostly set according to experience. As the number of split learning rounds increases and the difference of the original data, there is a possibility of premature or lagging abstraction layers when performing abstraction judgment according to the preset dimension threshold and the preset entropy threshold. Therefore, it is very necessary to adaptively and dynamically determine the abstraction layer accurately. Therefore, in a preferred embodiment, an adversarial verification network is deployed on the client, and the adversarial verification network includes a feature reconstructor, an attack discriminator, and an abstraction determiner. In step S4, the client-side abstraction judgment algorithm includes:

[0058] Step S421: Input the plaintext of the intermediate features at the nth layer into the feature reconstructor to obtain the reconstructed original data at the nth layer. The feature reconstructor preferably but not limited to adopts a GAN generator or a variational autoencoder VAE. In this embodiment, input the plaintext P of the intermediate features at the nth layer n to the feature reconstructor to obtain the reconstructed original data at the nth layer

[0059] Step S422: The attack discriminator calculates one or more discriminant metrics based on the reconstructed original data at the nth layer and the original data P. One or more discriminant metrics include the structural similarity between the reconstructed original data at the nth layer and the original data the change rate of the peak signal-to-noise ratio of the neural network at the nth layer and the historical attack success rate at the nth layer at least one of the discriminant metrics.

[0060] In this embodiment, represents the structural similarity index between the reconstructed original data at the nth layer and the original data, which can be calculated according to the existing structural similarity index.

[0061] In this embodiment, PSNR represents the peak signal-to-noise ratio, which is a common metric for the reconstruction quality of the original data and the reconstructed original data, and is calculated by comparing the mean square error (MSE) between the original data and the reconstructed original data. Denotes the partial derivative of PSNR with respect to the number of layers \(n\) in an \(N\)-layer neural network, indicating the changing trend of PSNR as the number of layers increases. If PSNR rises significantly as the number of layers increases It shows that the reconstruction quality is improving while the degree of data abstraction is insufficient; conversely, if the change rate approaches zero It indicates that the reconstruction quality tends to be stable and the attacker cannot further optimize the reconstruction result through deeper calculations. Since the number of layers \(n\) is a discrete variable, Through first-order forward difference approximation:

[0062]

[0063] That is, the change rate of PSNR for each layer is equal to the difference in PSNR between adjacent layers. PSNR(,) represents the existing peak signal-to-noise ratio calculation function based on mean squared error. Denotes the reconstruction of the original data for the \((n - 1)\)-th layer.

[0064] In this embodiment, the historical attack success rate of the \(n\)-th layer The acquisition process includes:

[0065] Step a, there is a pre-set attack record for the \(n\)-th layer. The attack record for the \(n\)-th layer records the historical attack times index of the \(n\)-th layer neural network and the corresponding attack results for each historical attack. The attack results include success and failure.

[0066] Step b, simulate an attack: calculate If is greater than or equal to the pre-set SSIM threshold, it is considered that the reconstruction of the original data for the \(n\)-th layer is successfully attacked. If is less than the pre-set SSIM threshold, it is considered that the reconstruction of the original data for the \(n\)-th layer is unsuccessfully attacked. Add the number index of this simulated attack and the attack result at the end of the attack record for the \(n\)-th layer.

[0067] Step c, calculate the success rate of the most recent \(m\) simulated attacks in the updated attack record for the \(n\)-th layer, and use this success rate as the historical attack success rate of the \(n\)-th layer \(m\) is a positive integer, such as 10.

[0068] Step S423, the abstraction discriminator determines whether one or more discriminant indicators meet the abstraction conditions. If they meet the abstraction conditions, it is considered that the intermediate feature ciphertext of the \(n\)-th layer is abstract; otherwise, it is considered that the intermediate feature ciphertext of the \(n\)-th layer is not abstract.

[0069] In this embodiment, preferably, the abstraction conditions include at least one of Condition 1, Condition 2, and Condition 3. Condition 1 corresponds to corresponds to Condition 2, and corresponds, condition three and corresponds.

[0070] Condition 1: The structural similarity between the reconstructed original data of the nth layer and the original data is less than a pre-determined structural similarity threshold δ ssim . Specifically:

[0071] In this embodiment, the value range of SSIM is [0, 1], and the larger the value, the more similar the structures of the two are. When , it is considered that the similarity between the reconstructed data and the original data P has fallen below the safe structural similarity threshold, and the attacker cannot effectively infer the original data. The structural similarity threshold δ ssim can be calibrated through adversarial experiments: By simulating attack experiments (such as model inversion attacks, GAN reconstruction attacks), statistically calculate the data reconstruction success rates corresponding to different SSIM values, and select the maximum SSIM value that makes the attack success rate lower than a preset safety level (such as 5%) as δ ssim .

[0072] Condition 2: The historical attack success rate of the nth layer is less than the dynamic attack success rate threshold τ of the nth layer n , wherein, the dynamic attack success rate threshold τ of the nth layer n is determined according to the dynamic attack success rate threshold of the (n - 1)th layer and the historical attack success rate of the nth layer. Specifically: η is the adaptive step size.

[0073] Condition 3: The change rate of the peak signal-to-noise ratio of the neural network of the nth layer is less than a pre-determined peak signal-to-noise ratio change rate threshold ∈. Specifically:

[0074] In this embodiment, the peak signal-to-noise ratio change rate threshold ∈ can be obtained by statistically calculating the distribution corresponding to different layers i, and selecting its 95% quantile (i.e., 95% of the PSNR change rates are lower than this value) as ∈.

[0075] In a preferred embodiment, for quickly and dynamically determining the abstraction layer, in step S4, the client-side abstraction judgment algorithm includes:

[0076] Step S431, obtaining the statistical features of the intermediate feature plaintext P of the nth layer n .

[0077] In this embodiment, the statistical features of the original data P are obtained synchronously or in advance. Preferably, the statistical features include multi-order moment features and distribution form features. The multi-order moment features are not limited to: mean μ, variance σ 2, skewness γ1, kurtosis γ2; the distribution shape characteristics are not limited to: fitting P through kernel density estimation (KDE) n and the probability density function p of P data (x).

[0078] Step S432: Conduct a statistical feature hypothesis test on the statistical features of the plaintext of the intermediate features of the nth layer and the statistical features of the original data, and determine whether the ciphertext of the intermediate features of the nth layer is abstract according to the results of the statistical feature hypothesis test.

[0079] In this embodiment, step S432 includes:

[0080] Step A: Design the hypothesis testing framework:

[0081] Null hypothesis H0: There is no significant difference between the statistical features of the plaintext of the intermediate features of the nth layer P n and the statistical features of the original data P (i.e., it has not reached secure abstraction);

[0082] Alternative hypothesis H1: There is a significant difference between the statistical features of the plaintext of the intermediate features of the nth layer P n and the statistical features of the original data P (i.e., it has reached secure abstraction).

[0083] Step B: Conduct a dimension-wise KS test or Mahalanobis distance test or Bayesian posterior probability test, and determine whether the ciphertext of the intermediate features of the nth layer is abstract according to the test results.

[0084] 1. Dimension-wise KS test, including:

[0085] Conduct a one-dimensional KS test on each dimension of the multi-dimensional data P n and P respectively. If any dimension satisfies D KS > D critical , then reject the null hypothesis H0.

[0086] D KS represents the difference between the cumulative distribution functions (CDFs) of P n and P: where sup represents the supremum, means taking the maximum value among all possible x values . x represents a data within the data interval of P n and P. represents the cumulative distribution function (CDF) of P n , which represents the probability that the data in P n is less than or equal to x. F P (x) represents the cumulative distribution function (CDF) of the original data P. The cumulative distribution function is expressed as:

[0087] D critical Represents the critical value, which is obtained by looking up the KS test critical value table according to the significance level α = 0.01 and the sample size n.

[0088] Decision rule: If D KS > D critical , then reject the null hypothesis H0, and consider that there is a significant difference between the distributions of P n and P.

[0089] Applicable scenarios:

[0090] Low-dimensional data (d ≤ 5): Independent tests for each dimension are efficient and intuitive;

[0091] Resource-constrained environment: After dimensionality reduction, the test balances efficiency and information retention.

[0092] 2. Mahalanobis distance test, including:

[0093] Calculate the Mahalanobis distance between P n and P in the multi-dimensional feature space:

[0094]

[0095] Decision rule: If (with degrees of freedom equal to the feature dimension d and α = 0.01), then reject H0.

[0096] where μ P is the mean vector of the original data P; is the mean vector of the intermediate result P n . Σ P is the covariance matrix of the original data P. is the inverse matrix of the covariance matrix Σ P . represents the critical value of the chi-square distribution, with a confidence level of 1 - α, which can be obtained by looking up the chi-square distribution table.

[0097] Applicable scenarios:

[0098] Medium and low-dimensional data (d ≤ 100): The covariance matrix is invertible and the calculation is controllable;

[0099] The data distribution is approximately Gaussian: The Mahalanobis distance is sensitive to the Gaussian distribution.

[0100] 3. Bayesian posterior probability test, including:

[0101] Construct the likelihood function based on the KL divergence:

[0102]

[0103] Calculate the posterior probability P(H1|P i) If P(H1|P i ) > 0.99, it is determined as the secure abstraction level.

[0104] Among them, λ represents the Bayesian adjustment parameter, which controls the weight of the KL divergence on the likelihood function and can be set according to experience. represents the Kullback-Leibler divergence (KL Divergence), which measures the probability distribution of P n and the difference between the probability distribution p of the original data P and the probability distribution p of the original data P P between them. The probability density function (PDF) of the intermediate result P n describes the data distribution form of P n and can be estimated by kernel density estimation (KDE) or histogram method. p P (x) represents the probability density function (PDF) of the original data P, which describes the benchmark data distribution form of P and can be estimated by kernel density estimation (KDE) or histogram method and used as a comparison standard.

[0105] Applicable scenarios: Small sample data: Bootstrap resampling to improve robustness; Complex distribution forms: such as multimodal distribution, asymmetric distribution.

[0106] The comparison table of the adversarial verification network and the statistical feature hypothesis test adopted by the client abstraction judgment algorithm in the present invention is shown in Table 1 below.

[0107] Table 1 Comparison of the adversarial verification network and the statistical feature hypothesis test

[0108]

[0109] The comparison of three statistical feature hypothesis tests is shown in Table 2:

[0110] Table 2 Comparison of three statistical feature hypothesis tests

[0111]

[0112]

[0113] The present invention also discloses a system based on the above-mentioned privacy protection method for split learning based on selective decryption. Please refer to Figure 2 , and this system includes a client and a server connected and communicating with the client.

[0114] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", "one implementation manner", "one preferred implementation manner" or "some examples", etc. mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in a suitable manner in any one or more embodiments or examples.

[0115] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A privacy protection method for split learning based on selective decryption, characterized in that The model to be trained is divided into a first local model and a second local model. The second local model includes N layers of neural networks. In each round of split learning, the following operations are performed: The client maps the original data to initial features through the first local model, and encrypts the initial features using the fully homomorphic encryption algorithm to obtain the ciphertext of the initial features. The client encrypts the label using the asymmetric homomorphic encryption algorithm to obtain the ciphertext of the label. The client uploads the ciphertext of the initial features, the ciphertext of the label, and the public key of the asymmetric homomorphic encryption algorithm to the server. The server inputs the ciphertext of the initial features into the second local model. When it is detected based on the server-side abstraction judgment algorithm that the ciphertext of the intermediate features of the nth layer of the N layers of neural networks is abstract, the ciphertext of the intermediate features of the nth layer is sent back to the client, where 1 ≤ n < N and N is a positive integer greater than or equal to 2. The client decrypts the ciphertext of the intermediate features of the nth layer to obtain the plaintext of the intermediate features of the nth layer, and uploads the plaintext of the intermediate features of the nth layer to the server. The server continues to input the plaintext of the intermediate features of the nth layer into the network after the nth layer of neural networks in the second local model for processing to obtain the prediction result. Using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the ciphertext of the label, the loss ciphertext is calculated, and the network parameters of the second local model are updated based on the loss ciphertext and the noisy gradient is obtained. The client updates the network parameters of the first local model based on the noisy gradient.

2. The privacy protection method for split learning based on selective decryption according to claim 1, wherein The server-side abstraction judgment algorithm includes: If the feature dimension of the ciphertext of the intermediate features of the nth layer is less than or equal to the preset dimension threshold, and / or the information entropy of the ciphertext of the intermediate features of the nth layer is less than or equal to the preset entropy threshold, then the ciphertext of the intermediate features of the nth layer is considered abstract; otherwise, the ciphertext of the intermediate features of the nth layer is considered non-abstract.

3. The method for privacy protection of split learning based on selective decryption according to claim 1 or 2, characterized in that, The client decrypts the ciphertext of the intermediate features of the nth layer to obtain the plaintext of the intermediate features of the nth layer, which includes: The client decrypts the ciphertext of the intermediate features of the nth layer using the key of the fully homomorphic encryption algorithm to obtain the plaintext of the intermediate features of the nth layer. When the client determines based on the client-side abstraction judgment algorithm that the ciphertext of the intermediate features of the nth layer is abstract, the plaintext of the intermediate features of the nth layer is uploaded to the server.

4. The privacy protection method for split learning based on selective decryption according to claim 3, wherein The client deploys an adversarial verification network, and the adversarial verification network includes a feature reconstructor, an attack discriminator, and an abstraction determiner. The client-side abstraction judgment algorithm includes: The plaintext of the intermediate features of the nth layer is input into the feature reconstructor to obtain the reconstructed original data of the nth layer. The attack discriminator calculates one or more discriminant metrics based on the reconstructed original data of the nth layer and the original data. The one or more discriminant metrics include at least one of the structural similarity between the reconstructed original data of the nth layer and the original data, the peak signal-to-noise ratio change rate of the nth layer of neural networks, and the historical attack success rate of the nth layer. The abstraction determiner determines whether the one or more discriminant metrics meet the abstraction conditions. If they meet the abstraction conditions, then the ciphertext of the intermediate features of the nth layer is considered abstract; otherwise, the ciphertext of the intermediate features of the nth layer is considered non-abstract.

5. The privacy protection method for split learning based on selective decryption according to claim 4, characterized in that, The abstraction conditions include at least one of condition one, condition two, and condition three. Condition one: The structural similarity between the reconstructed original data of the nth layer and the original data is less than the pre-determined structural similarity threshold. Condition 2: The historical attack success rate of the nth layer is less than the dynamic attack success rate threshold of the nth layer, and the dynamic attack success rate threshold of the nth layer is determined according to the dynamic attack success rate threshold of the (n - 1)th layer and the historical attack success rate of the nth layer; Condition 3: The change rate of the peak signal-to-noise ratio of the neural network in the nth layer is less than the pre-determined peak signal-to-noise ratio change rate threshold.

6. The privacy protection method for split learning based on selective decryption according to claim 3, characterized in that The client-side abstract judgment algorithm includes: Obtaining the statistical features of the plaintext of the intermediate features in the nth layer; Performing a statistical feature hypothesis test on the statistical features of the plaintext of the intermediate features in the nth layer and the statistical features of the original data, and determining whether the ciphertext of the intermediate features in the nth layer is abstract according to the result of the statistical feature hypothesis test.

7. The privacy protection method for split learning based on selective decryption according to claim 1 or 2 or 4 or 5 or 6, characterized in that, The calculation of the loss ciphertext using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the label ciphertext includes: Encrypting the prediction result using the public key of the asymmetric homomorphic encryption algorithm to obtain the prediction result ciphertext; Calculating the loss ciphertext through the prediction result ciphertext and the label ciphertext.

8. The privacy protection method for split learning based on selective decryption according to claim 1 or 2 or 4 or 5 or 6, characterized in that, The update of the network parameters of the second local model based on the loss ciphertext and the obtaining of the noisy gradient include: The server sends the loss ciphertext to the client or the third-party key management center; The client or the third-party key management center decrypts the loss ciphertext to obtain the loss plaintext, and uploads the loss plaintext to the server; The server updates the network parameters of the second local model according to the loss plaintext and generates a gradient to be sent back to the client; Adding noise to the gradient using differential privacy technology to obtain a noisy gradient, and sending the noisy gradient to the client.

9. The privacy protection method for split learning based on selective decryption according to claim 1 or 2 or 4 or 5 or 6, characterized in that, The model to be trained is an image classification model, and the original data is image data.

10. A system for the privacy protection method of split learning based on selective decryption according to any one of claims 1-9, characterized in that, It includes a client and a server connected to the client for communication.

Images