Split learning privacy protection method and system based on selective decryption

Abstract

The present application belongs to the technical field of privacy protection of split learning, and provides a privacy protection method of split learning based on selective decryption. In each round of learning: the client maps original data to initial features through a first local model, obtains and uploads initial feature ciphertext and label ciphertext to the server; the server inputs the initial feature ciphertext into a second local model, and when the server abstract judgment algorithm monitors the n-layer intermediate feature ciphertext abstraction output by the n-layer neural network of the N-layer neural network, the n-layer intermediate feature ciphertext is returned to the client; the n-layer intermediate feature plaintext is uploaded to the server; the n-layer intermediate feature plaintext is input into the network after the n-layer neural network to obtain a prediction result, and a noisy gradient is calculated; the client updates the network parameters of the first local model based on the noisy gradient; the present application also provides a system of the privacy protection method of split learning based on selective decryption; the present application better protects the privacy of original data, and improves the calculation efficiency and training efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy protection of federated learning, and particularly relates to a privacy protection method and system of federated learning based on selective decryption. BACKGROUND

[0002] When training an image classification model for a client with limited computing resources, federated learning is used to train the model. Federated learning aims to solve the problems of data privacy and lack of computing resources, and divides the model to be trained into two parts, such as a bottom model (first local model) of the client and a top model (second local model) of the server. As shown in the related art federated learning framework Figure 3 , it has the following characteristics:

[0003] Model and data distribution: the client has original data and a bottom model, and the server has a top model and labels shared directly by the client. In the training process, the client maps the original data x0to high-dimensional features (activation information) x k using the bottom model, that is, x k =Forward(x0,w c ), which can also be expressed as x k =f1(x0), where f1represents the function corresponding to the bottom model. Then the client uses a homomorphic encryption algorithm to encrypt the activation information x k to obtain the activation information ciphertext x k ', and uploads the activation information ciphertext to the server.

[0004] Server computation and feedback: after receiving the activation information ciphertext, the server continues forward propagation to calculate y=f2(x k ') using the activation information ciphertext as input, where f2represents the function corresponding to the top model. Then the loss function Loss=CE(y,y true ) (y true represents the true label) is calculated, and the top model w s is updated by back propagation to obtain the gradient g k =BackProp(x k ,w s ) of the back propagation of the segmentation layer (i.e. the first layer of neural network of the top model), and the gradient g k is sent to the client.

[0005] Client model update: after receiving the gradient g k sent by the server, the client continues the back propagation process and updates the bottom model w c . In this way, one round of training is completed, and the model converges through multiple rounds of training.

[0006] Related segmentation learning uses a homomorphic encryption algorithm to encrypt activation information. The server performs calculations on the ciphertext, and the decrypted calculation results are consistent with the plaintext calculation results, thereby protecting data privacy. However, there are still the following deficiencies in privacy protection:

[0007] First, privacy protection vulnerabilities: During the relevant segmentation learning and training process, the intermediate results transmitted between the client and the server contain private information such as original data and labels, making them extremely vulnerable to original data reconstruction attacks and label inference attacks. In terms of original data reconstruction attacks, such as model inversion attacks, the server can reconstruct the original data by optimizing the shadow model to invert the intermediate results. There are also feature space hijacking attacks. Malicious servers use public datasets to train encoders and decoders, tampering with the client update process so that the client model output space overlaps with the encoder output space, thereby reconstructing the original data and seriously threatening data privacy security. In label inference attacks, attacks based on data distribution use data distribution characteristics or model classification capabilities to infer labels. For example, when the client's underlying model is well trained, it can use some labeled data to fine-tune the model for label inference. These attacks seriously undermine data privacy.

[0008] Second, computational inefficiency: To protect privacy, existing technologies often employ homomorphic encryption, but this comes with significant computational overhead. In segmented learning scenarios, the server must perform complex calculations on the encrypted data, each involving numerous ciphertext operations. This results in slow computation and significantly increases model training time. This makes segmented learning inefficient in practical applications, making it difficult to meet the demands of demanding real-time tasks and limiting its widespread adoption in real-world scenarios.

[0009] Therefore, how to improve the privacy security of segmentation learning, reduce the computational overhead during training, and improve training efficiency is a technical problem that needs to be solved urgently. Summary of the Invention

[0010] This application aims to at least solve the technical problems existing in the prior art and provide a segmentation learning privacy protection method and system based on selective decryption.

[0011] In a first aspect, the application provides a privacy protection method for split learning based on selective decryption. The method divides a model to be trained into a first local model and a second local model, and the second local model includes an N-layer neural network. In each round of split learning, the following steps are performed: a client maps original data to initial features through the first local model, and encrypts the initial features using a fully homomorphic encryption algorithm to obtain initial feature ciphertext; the client encrypts labels using an asymmetric homomorphic encryption algorithm to obtain label ciphertext; the client uploads the initial feature ciphertext, the label ciphertext, and a public key of the asymmetric homomorphic encryption algorithm to a server; the server inputs the initial feature ciphertext into the second local model, and when an nth intermediate feature ciphertext abstraction output by an nth layer of the neural network is monitored based on a server-side abstraction judgment algorithm, the nth intermediate feature ciphertext is returned to the client, 1≤n

[0012] In a second aspect, the application provides a system based on the privacy protection method for split learning based on selective decryption according to the first aspect of the application. The system includes a client and a server connected to the client.

[0013] The application has the following beneficial technical effects:

[0014] In terms of privacy protection, the initial features obtained by the first local model of the client are fully homomorphically encrypted to obtain initial feature ciphertext, and the labels are encrypted using an asymmetric homomorphic encryption algorithm to obtain label ciphertext. Even if the initial feature ciphertext and the label ciphertext are stolen during transmission, an attacker cannot obtain the original data content. Before the intermediate feature ciphertext abstraction is monitored, i.e., in the preliminary calculation of the server, the encryption state of the data processed by the second local model is consistently maintained, thereby continuously protecting the data privacy. When the nth intermediate feature ciphertext abstraction is monitored, the nth intermediate feature plaintext decrypted by the client and uploaded to the server also has abstraction, and an attacker cannot restore the original data therefrom. The server calculates the loss ciphertext based on the label ciphertext and the prediction result ciphertext, so that the server cannot know the label content, thereby protecting the privacy of the labels. The loss ciphertext and the noisy gradient issued by the server to the client are both subjected to privacy protection. Therefore, the application provides good security protection for the transmission information between the client and the server.

[0015] In terms of computing overhead and training efficiency, the homomorphic encryption in the prior art has large computing overhead, resulting in low model training efficiency. In the application, when the server abstractly judges the algorithm to monitor the intermediate feature ciphertext of a certain level in the N-layer neural network of the second local model (such as the n-layer intermediate feature ciphertext), the network after the n-layer no longer extracts features in the form of ciphertext, but transmits the n-layer intermediate feature ciphertext to the client for processing to obtain the n-layer intermediate feature plaintext, uploads the n-layer intermediate feature plaintext to the server, and the network after the n-layer in the second local model processes the n-layer intermediate feature plaintext to obtain the prediction result. The server calculates in the plaintext state after the abstraction layer (the level of the intermediate feature ciphertext abstraction), avoiding the high computing overhead of the full homomorphic encryption, and improving the computing efficiency and the training efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 is a flowchart of a privacy protection method based on selective decryption in a preferred embodiment of the application;

[0017] Figure 2 is a communication diagram of the client and the server in a system in a preferred embodiment of the application;

[0018] Figure 3 is a framework diagram of the related art segmentation learning. DETAILED DESCRIPTION

[0019] The embodiments of the application are described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar reference signs represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are only used to explain the application, and cannot be understood as a limitation of the application.

[0020] In the description of the application, it should be understood that the terms "longitudinal", "transverse", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only used to facilitate the description of the application and simplify the description, and therefore cannot be understood as indicating or implying that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the application.

[0021] In the description of the application, unless otherwise specified and limited, it should be noted that the terms "mounting", "connection", "connection" should be understood broadly, for example, it can be a mechanical connection or an electrical connection, or a communication between two elements, or a direct connection, or an indirect connection through an intermediate medium, and the specific meaning of the above terms can be understood by a person of ordinary skill in the art according to the specific circumstances.

[0022] The application provides a split learning privacy protection method based on selective decryption. In a preferred embodiment, the method comprises: splitting a to-be-trained model into a first local model and a second local model, the first local model being deployed on a client, and the second local model being deployed on a server. The second local model comprises an N-layer neural network and an output network, and the training of the to-be-trained model is completed after a plurality of rounds of split learning are performed until a training stop condition is reached. The output network preferably but not limitedly comprises one or more than one fully connected layer in cascade. The training stop condition is preferably but not limitedly that the number of learning rounds reaches a preset maximum number of learning rounds, or the loss is reduced to a preset loss threshold. Each layer of the N-layer neural network extracts and transforms the input data, and the data is gradually abstracted as the calculation proceeds.

[0023] In an example, the to-be-trained model is an image classification model, and the network structure of the image classification model preferably but not limitedly adopts a convolutional neural network, which is a multi-layer convolution + pooling + fully connected layer architecture, such as a VGGNet convolutional neural network, which generally comprises 13 to 19 layers of convolution (small kernel stacking) and three fully connected layers. The VGGNet convolutional neural network can adopt VGG-16 or VGG-19, and the multi-layer convolution of the convolutional neural network is split to obtain a first part of the multi-layer convolution and a second part of the multi-layer convolution. The first part of the multi-layer convolution is deployed on the client as the first local model, and the second part of the multi-layer convolution + pooling + fully connected layer is deployed on the server as the second local model, and the second part of the multi-layer convolution is the N-layer neural network, which comprises N layers of convolution. The original data of the client is image data, and the client has a set of image data. The image data is preferably but not limitedly an RGB image or a grayscale image or a medical image (such as a CT image, an MRI image, etc.). Each image data has a class label, which can be an object class label (such as an apple size classification label, a disease diagnosis label, etc.). The client is preferably but not limitedly a personal computer or a hardware server. The server is preferably but not limitedly a hardware server or a cloud server or a computer cluster capable of providing computing power.

[0024] Please refer to Figure 1 and Figure 2 In each round of learning of split learning, the following steps are performed:

[0025] Step S1 comprises: step S11, the client maps the original data to initial features by the first local model, and encrypts the initial features by a fully homomorphic encryption algorithm to obtain initial feature ciphertext; and step S12, the client encrypts the label by an asymmetric homomorphic encryption algorithm to obtain label ciphertext. Steps S11 and S12 can be performed synchronously or asynchronously.

[0026] In the embodiment, the client or the third-party key management center or the key distribution center (KDC) constructs a key group of a fully homomorphic encryption algorithm (FHE) and a key pair of an asymmetric homomorphic encryption algorithm (AHE). The third-party key management center or the key distribution center sends the key group of the fully homomorphic encryption algorithm and the key pair of the asymmetric homomorphic encryption algorithm to the client, and sends the public key in the key pair of the asymmetric homomorphic encryption algorithm to the server.

[0027] In the embodiment, please refer to Figure 2 , in step S11, the client maps the original data to initial features A through a first local model, and encrypts the initial features A by using the public key of the fully homomorphic encryption algorithm to obtain initial feature ciphertext C. In step S12, the client encrypts the label y true by using the public key pk of the asymmetric homomorphic encryption algorithm to obtain label ciphertext Enc(y true ).

[0028] In the above example, the client extracts initial features from image data through a first local model (i.e., a first partial multi-layer convolution) to obtain initial features, i.e., maps the image data to the initial features, and encrypts the initial features by using the public key of the fully homomorphic encryption algorithm to obtain initial feature ciphertext. The client encrypts the classification label of the image data by using the public key of the asymmetric homomorphic encryption algorithm to obtain label ciphertext.

[0029] In step S2, the client uploads the initial feature ciphertext, the label ciphertext, and the public key of the asymmetric homomorphic encryption algorithm to the server. Please refer to Figure 2 , C, pk, and Enc(y true ) are uploaded to the server.

[0030] In step S3, the server inputs the initial feature ciphertext into a second local model. When it is monitored that the n-th intermediate feature ciphertext C n abstracted from the output of the n-th neural network of the N-layer neural network based on a server abstract judgment algorithm, the n-th intermediate feature ciphertext C n is returned to the client, 1≤n<N, and N is a positive integer greater than or equal to 2.

[0031] In the embodiment, in the process of processing features layer by layer by the N-layer neural network of the second local model, it is monitored in real time whether the intermediate feature ciphertext output by each level of neural network is abstracted. If the n-th intermediate feature ciphertext C n abstracted from the output of the n-th neural network, the subsequent N-n neural networks of the N-layer neural network stop processing, and the n-th intermediate feature ciphertext C nto the client; if the n-th layer intermediate feature ciphertext C n is not abstracted, the n-th layer intermediate feature ciphertext C n is continuously input to the (n+1)-th layer neural network for processing, and the (n+1)-th layer intermediate feature ciphertext C n+1 is obtained. n is abstracted, the malicious server is difficult to infer the original data from C n .

[0032] In the embodiment, preferably, to improve the speed of the server-side abstraction judgment, the server-side abstraction judgment algorithm in step S3 adopts one of the following three ways:

[0033] Way one: if the feature dimension of the n-th layer intermediate feature ciphertext C n is less than or equal to a preset dimension threshold, it is considered that the n-th layer intermediate feature ciphertext C n is abstracted; if the feature dimension of the n-th layer intermediate feature ciphertext C n is higher than the preset dimension threshold, it is considered that the n-th layer intermediate feature ciphertext C n is not abstracted.

[0034] Way two: if the information entropy of the n-th layer intermediate feature ciphertext C n is less than or equal to a preset entropy threshold, it is considered that the n-th layer intermediate feature ciphertext C n is abstracted; if the information entropy of the n-th layer intermediate feature ciphertext C n is greater than the preset entropy threshold, it is considered that the n-th layer intermediate feature ciphertext C n is not abstracted.

[0035] Way three: if the feature dimension of the n-th layer intermediate feature ciphertext C n is less than or equal to a preset dimension threshold, and the information entropy of the n-th layer intermediate feature ciphertext C n is less than or equal to a preset entropy threshold, it is considered that the n-th layer intermediate feature ciphertext C n is abstracted; otherwise, it is considered that the n-th layer intermediate feature ciphertext C n is not abstracted.

[0036] In the above embodiment, step S3 is represented as: the server inputs the initial feature ciphertext into the second local model, and when it is monitored that the n-th layer intermediate feature ciphertext C n output by the n-th layer convolution of the second part of the multi-layer convolution is abstracted based on the server-side abstraction judgment algorithm, the n-th layer intermediate feature ciphertext C n is fed back to the client.

[0037] Step S4: the client decrypts the n-th layer intermediate feature ciphertext to obtain the n-th layer intermediate feature plaintext, and uploads the n-th layer intermediate feature plaintext to the server.

[0038] In this embodiment, the client can directly use the private key of the fully homomorphic encryption algorithm to decrypt the n-th layer intermediate feature ciphertext C n Get the n-th layer intermediate feature plaintext P n , and then the n-th layer intermediate feature plaintext P n Upload server.

[0039] In step S5, the server continues to input the n-th layer intermediate feature plaintext to the network processing after the n-th layer neural network in the second local model to obtain the prediction result (that is, continue the forward propagation calculation), and uses the asymmetric homomorphic encryption algorithm public key, the prediction result and the label ciphertext to calculate the loss ciphertext, and updates the network parameters of the second local model based on the loss ciphertext and obtains the noisy gradient.

[0040] In this embodiment, the server sends the nth layer intermediate feature plaintext P n Input to the network after the nth layer of neural network in the second local model (n+1th layer of neural network, ... Nth layer of neural network and output network) for processing. In the above example, the nth layer of intermediate feature plaintext P n The input is processed by the n+1th convolution layer, ... Nth convolution layer and three cascaded fully connected layers to obtain the predicted classification results.

[0041] In this embodiment, preferably, in order to ensure that the server cannot obtain the real label information and strengthen the privacy protection of the label, in step S5, the loss ciphertext is calculated using the asymmetric homomorphic encryption algorithm public key, the prediction result and the label ciphertext, including:

[0042] Step S51: Use the public key pk of the asymmetric homomorphic encryption algorithm to encrypt the prediction result y to obtain the prediction result ciphertext Enc(y).

[0043] Step S52: The prediction result ciphertext Enc(y) and the label ciphertext Enc(y true ) calculates the loss ciphertext Enc(loss). The loss calculation function is preferably, but not limited to, the existing cross-entropy loss function. The loss is directly calculated using the predicted ciphertext and the corresponding true label ciphertext. Due to the properties of the homomorphic encryption algorithm, the calculation result of the ciphertext is consistent with the calculation result of the plaintext. This allows the server to calculate the loss without knowing the true content of the label. This label protection method effectively prevents the server from knowing the label content, enhances label privacy protection, and addresses the shortcomings of existing technologies in label privacy protection.

[0044] In this embodiment, preferably, in order to improve the privacy protection of gradient information and loss, in step S5, updating the network parameters of the second local model and obtaining the noisy gradient based on the loss ciphertext include:

[0045] Step S53, the server sends the loss ciphertext to the client or the third-party key management center.

[0046] Step S54, the client or the third-party key management center decrypts the loss ciphertext Enc(loss) to obtain the loss plaintext loss, and uploads the loss plaintext loss to the server. Specifically, the client or the third-party key management center decrypts the loss ciphertext Enc(loss) using the private key of the asymmetric homomorphic encryption to obtain the loss plaintext loss.

[0047] Step S55, the server updates the network parameters of the second local model according to the loss plaintext and generates the gradient returned to the client. After obtaining the loss plaintext, the server calculates the gradient of each layer network according to the loss plaintext, and obtains the gradient of the last layer neural network of the first local model that needs to be returned. In the above example, the server obtains the gradient of the last layer convolution of the first part of the multi-layer convolution deployed by the image classification model on the client.

[0048] Step S56, the differential privacy technology is used to add noise to the gradient to obtain a noisy gradient, and the noisy gradient is sent to the client.

[0049] In the present embodiment, in order to improve the problem that the existing split learning is not perfect in the privacy protection of gradient information in the model updating and feedback process, the differential privacy technology is used to add appropriate noise to the gradient information in the present embodiment to obtain the processed noisy gradient G. The application of the differential privacy technology makes the gradient information effectively protected in the transmission process. Even if the gradient information is stolen, it is difficult for the attacker to obtain accurate original gradient information.

[0050] Step S6, the client updates the network parameters of the first local model based on the noisy gradient.

[0051] In the present embodiment, after the client receives the noisy gradient G, the network parameters of the local first local model are updated according to the noisy gradient G, and one round of split learning is completed. Through the privacy protection of the gradient information, the security of the entire split learning process is further improved.

[0052] In the present embodiment, after a plurality of rounds of iterative split learning until a training stopping condition is reached, the first local model of the client and the second local model of the server constitute a training completed model. In actual testing, after the client obtains original data to be tested, the original data to be tested is input into the first local model to obtain initial features, the initial features are encrypted by using a fully homomorphic encryption algorithm to obtain initial feature ciphertext, and the initial feature ciphertext is uploaded to the server. The server inputs the initial feature ciphertext into the second local model, and simultaneously monitors whether intermediate feature ciphertext output by each layer of the N-layer neural network is abstracted by using a server abstract judgment algorithm. If it is monitored that the intermediate feature ciphertext of the nth layer is abstracted, the intermediate feature ciphertext of the nth layer is returned to the client. The client decrypts the intermediate feature ciphertext of the nth layer to obtain intermediate feature plaintext of the nth layer, and uploads the intermediate feature plaintext of the nth layer to the server. The server inputs the intermediate feature plaintext of the nth layer into the neural network of the (n+1)th layer and subsequent network processing to obtain a prediction result. The server uses an asymmetric homomorphic encryption algorithm public key to encrypt the prediction result ciphertext to obtain prediction result ciphertext, and returns the prediction result ciphertext to the client. The client decrypts the prediction result ciphertext to obtain a prediction result corresponding to the original data to be tested.

[0053] Similarly, for the above example, after a plurality of rounds of iterative split learning until a training stopping condition is reached, the first local model of the client and the second local model of the server constitute an image classification model. In actual testing, after the client obtains an image to be tested, the image is input into the first local model to obtain initial features, the initial features are encrypted by using a fully homomorphic encryption algorithm to obtain initial feature ciphertext, and the initial feature ciphertext is uploaded to the server. The server inputs the initial feature ciphertext into the second local model, and simultaneously monitors whether intermediate feature ciphertext output by each layer of the second part of the multi-layer convolution is abstracted by using a server abstract judgment algorithm. If it is monitored that the intermediate feature ciphertext of the nth layer is abstracted, the intermediate feature ciphertext of the nth layer is returned to the client. The client decrypts the intermediate feature ciphertext of the nth layer to obtain intermediate feature plaintext of the nth layer, and uploads the intermediate feature plaintext of the nth layer to the server. The server inputs the intermediate feature plaintext of the nth layer into the convolution of the (n+1)th layer and subsequent network processing to obtain a prediction classification result. The server uses an asymmetric homomorphic encryption algorithm public key to encrypt the prediction classification result to obtain prediction classification result ciphertext, and returns the prediction classification result ciphertext to the client. The client decrypts the prediction classification result ciphertext to obtain a prediction classification result corresponding to the image to be tested.

[0054] In a preferred embodiment, in order to improve data security and avoid one-sided abstract judgment errors of the server or malicious judgment of the server under attack, causing data leakage, in step S4, the client decrypts the intermediate feature ciphertext of the nth layer to obtain intermediate feature plaintext of the nth layer, including:

[0055] In step S411, the client uses a fully homomorphic encryption algorithm key to decrypt the intermediate feature ciphertext of the nth layer to obtain intermediate feature plaintext of the nth layer.

[0056] Step S412, when the client judges the intermediate feature ciphertext abstraction in the nth layer based on the client abstraction judgment algorithm, the nth layer intermediate feature plaintext is uploaded to the server.

[0057] In the present embodiment, the client abstraction judgment algorithm can refer to the server abstraction judgment algorithm scheme, that is, any one of the above-mentioned mode one, mode two and mode three is selected, and the intermediate feature ciphertext abstraction judgment is performed based on the preset dimension threshold and / or preset entropy threshold.

[0058] In the client abstraction judgment algorithm of the previous preferred embodiment, the preset dimension threshold and the preset entropy threshold are mostly set according to experience, and with the increase of the segmentation learning rounds and the difference of the original data, there is a possibility that the abstraction layer is advanced or the abstraction layer is lagged when the abstraction judgment is performed according to the preset dimension threshold and the preset entropy threshold. Therefore, it is necessary to accurately determine the abstraction layer adaptively and dynamically. Therefore, in one preferred embodiment, the client is provided with an adversarial verification network, and the adversarial verification network includes a feature reconstructor, an attack discriminator and an abstraction determinator. In step S4, the client abstraction judgment algorithm includes:

[0059] Step S421, inputting the nth layer intermediate feature plaintext into the feature reconstructor to obtain the nth layer reconstructed original data. The feature reconstructor is preferably but not limited to a GAN generator or a variational autoencoder VAE. In the present embodiment, the input nth layer intermediate feature plaintext P n is input into the feature reconstructor to obtain the nth layer reconstructed original data

[0060] Step S422, the attack discriminator calculates a discrimination index based on the nth layer reconstructed original data and the original data P. The discrimination index includes at least one of the structural similarity of the nth layer reconstructed original data and the original data, the peak signal-to-noise ratio change rate of the nth layer neural network, and the historical attack success rate of the nth layer.

[0061] In the present embodiment, represents the structural similarity index of the nth layer reconstructed original data and the original data, which can be calculated according to the existing structural similarity index.

[0062] In the present embodiment, PSNR represents the peak signal-to-noise ratio, which is a commonly used index of the reconstruction quality of the original data and the reconstructed original data, and is calculated by comparing the mean square error (MSE) of the original data and the reconstructed reconstructed original data. represents the partial derivative of PSNR with respect to the layer number n in the nth layer neural network, which represents the change trend of PSNR with the increase of the layer number. If PSNR increases significantly with the increase of the layer number​​ If the reconstruction quality is improving, it indicates that the data abstraction is insufficient; otherwise, if the change rate tends to zero If the reconstruction quality tends to be stable, the attacker cannot further optimize the reconstruction result through deeper calculation. Since the number of layers n is a discrete variable, Through first-order forward difference approximation:

[0063]

[0064] That is, the PSNR change rate of each layer is equal to the PSNR difference between adjacent two layers. PSNR (i, j) represents the existing peak signal-to-noise ratio calculation function based on mean square error. represents the reconstructed original data of the n-1th layer.

[0065] In this embodiment, the n th layer historical attack success rate The acquisition process includes:

[0066] Step a, the n th layer attack record is set in advance, and the n th layer attack record records the historical attack times index of the n th layer neural network and the attack result corresponding to each historical attack, and the attack result includes success and failure.

[0067] Step b, simulation attack: calculate If is greater than or equal to the preset SSIM threshold value, it is considered that the n th layer reconstructed original data Attack is successful, if is less than the preset SSIM threshold value, it is considered that the n th layer reconstructed original data Attack fails, and the times index and attack result of this simulation attack are added at the end of the n th layer attack record.

[0068] Step c, calculate the success rate of the last m simulation attacks in the updated n th layer attack record, and take the success rate as the n th layer historical attack success rate m is a positive integer, such as 10.

[0069] Step S423, the abstract determinator determines whether the discrimination index meets the abstraction condition. If the abstraction condition is met, it is considered that the n th layer intermediate feature ciphertext is abstracted, otherwise it is considered that the n th layer intermediate feature ciphertext is not abstracted.

[0070] In this embodiment, preferably, the abstraction condition includes at least one of condition one, condition two and condition three. Condition one corresponds to , condition two corresponds to , and condition three corresponds to .

[0071] Condition one: the structural similarity between the reconstructed original data of the nth layer and the original data is less than a predetermined structural similarity threshold δ ssim In particular:

[0072] In this embodiment, the value range of SSIM is [0, 1], and the larger the value is, the more similar the structures are. When , it is considered that the similarity between the reconstructed data and the original data P has been lower than the safe structural similarity threshold, and the attacker cannot effectively infer the original data. The structural similarity threshold δ ssim may be calibrated through an adversarial experiment: by simulating an attack experiment (such as a model inversion attack, a GAN reconstruction attack), the data reconstruction success rate corresponding to different SSIM values is counted, and the maximum SSIM value that makes the attack success rate lower than a preset safe level (such as 5%) is selected as δ ssim .

[0073] Condition two: the historical attack success rate of the nth layer is less than the dynamic attack success rate threshold τ n , that is wherein the dynamic attack success rate threshold τ n of the nth layer is determined according to the dynamic attack success rate threshold of the (n-1)th layer and the historical attack success rate of the nth layer. In particular: η is an adaptive step size.

[0074] Condition three: the peak signal-to-noise ratio change rate of the neural network of the nth layer is less than a predetermined peak signal-to-noise ratio change rate threshold ∈. In particular:

[0075] In this embodiment, the peak signal-to-noise ratio change rate threshold ∈ can be determined by counting the distribution of the peak signal-to-noise ratio change rate corresponding to different layer numbers i, and selecting the 95% quantile (i.e., 95% of the peak signal-to-noise ratio change rate is lower than this value) as ∈.

[0076] In a preferred embodiment, to dynamically determine the abstraction layer quickly, in step S4, the client abstraction judgment algorithm includes:

[0077] Step S431, the statistical features of the nth layer intermediate feature plaintext P n are obtained.

[0078] In this embodiment, the statistical features of the original data P are obtained synchronously or in advance. Preferably, the statistical features include multi-order moment features and distribution shape features. The multi-order moment features are not limited to mean μ, variance σ 2 , skewness γ1, and kurtosis γ2; and the distribution shape features are not limited to fitting P n ​and P data (x).

[0079] Step S432, statistical feature hypothesis verification is performed on the statistical features of the intermediate feature plaintext in the nth layer and the statistical features of the original data, and whether the intermediate feature ciphertext in the nth layer is abstracted is determined according to a result of the statistical feature hypothesis verification.

[0080] In the embodiment, step S432 includes:

[0081] Step A, a hypothesis test framework is designed:

[0082] A null hypothesis H0: the statistical features of the intermediate feature plaintext P n in the nth layer are not significantly different from the statistical features of the original data P (i.e., safe abstraction is not reached);

[0083] An alternative hypothesis H1: the statistical features of the intermediate feature plaintext P n in the nth layer are significantly different from the statistical features of the original data P.

[0084] Step B, a multi-dimensional KS test or a Mahalanobis distance test or a Bayesian posterior probability test is performed, and whether the intermediate feature ciphertext in the nth layer is abstracted is determined according to a result of the test.

[0085] 1. The multi-dimensional KS test includes:

[0086] A one-dimensional KS test is respectively performed on each dimension of the multi-dimensional data P n and P, and if any dimension satisfies D KS >D critical , the null hypothesis H0 is rejected.

[0087] D KS represents a difference between a cumulative distribution function (CDF) of P n and P.

[0088]

[0089] Wherein, sup represents a supremum, represents a value selected from all possible values of x such that D is the maximum. x represents a data in a data interval of P n and P. F n represents a cumulative distribution function (CDF) of P n , and represents a probability that a data in P P is less than or equal to x. F

[0090] Dcritical denotes the critical value, which is obtained by KS test critical value table according to the significance level α = 0.01 and sample size n.

[0091] Decision rule: if D KS > D critical , reject the null hypothesis H0, and consider that P n is significantly different from the distribution of P.

[0092] Applicable scenarios:

[0093] Low-dimensional data (d ≤ 5): independent test of dimension is efficient and intuitive;

[0094] Resource-constrained environment: dimensionality reduction test, balance efficiency and information preservation.

[0095] 2. Mahalanobis distance test, including:

[0096] Calculate the Mahalanobis distance between P n and P in the multi-dimensional feature space:

[0097]

[0098] Decision rule: if ( degrees of freedom is feature dimension d, α = 0.01), reject H0.

[0099] where μ P is the mean vector of the original data P; is the mean vector of the intermediate result P n . Σ P is the covariance matrix of the original data P. is the inverse matrix of the covariance matrix Σ P . denotes the critical value of the chi-square distribution, with a confidence level of 1-α, which can be obtained by looking up the chi-square distribution table.

[0100] Applicable scenarios:

[0101] Medium and low-dimensional data (d ≤ 100): the covariance matrix is invertible and the calculation is controllable;

[0102] Data distribution is approximately Gaussian: Mahalanobis distance is sensitive to Gaussian distribution.

[0103] 3. Bayesian posterior probability test, including:

[0104] Based on KL divergence to construct the likelihood function:

[0105]

[0106] Calculate the posterior probability P(H1|P i ), if P(H1|Pi If 0.99, then determine that the security abstraction level is safe.

[0107] where, λ represents a Bayesian adjustment parameter, controls the weight of the influence of the KL divergence on the likelihood function, and can be set according to experience. represents the Kullback-Leibler divergence (KLDivergence), measures the difference between P n and the probability distribution p of the original data P. P The probability density function (PDF) of the intermediate result P n , describes the data distribution form of P n , and can be estimated by kernel density estimation (KDE) or histogram method. p P (x) represents the probability density function (PDF) of the original data P, describes the benchmark data distribution form of P, and can be estimated by kernel density estimation (KDE) or histogram method, as a contrast standard.

[0108] Applicable scenarios: small sample data: Bootstrap resampling improves robustness; complex distribution form: such as multimodal distribution, asymmetric distribution. The comparison table of the adversarial verification network and the statistical characteristic hypothesis test used in the client abstraction judgment algorithm in the present application is shown in Table 1.

[0109] Table 1 Comparison of adversarial verification network and statistical characteristic hypothesis test

[0110]

[0111] The comparison of the three statistical characteristic hypothesis tests is shown in Table 2:

[0112] Table 2 Comparison of three statistical characteristic hypothesis tests

[0113]

[0114] The present application also discloses a system based on the above-mentioned privacy protection method based on selective decryption split learning, please see Figure 2 , the system comprises a client and a server connected to the client for communication.

[0115] ​In the description of the specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", "one implementation", "a preferred implementation" or "some examples" etc. means that the particular feature, structure, material or characteristic being described in connection with the embodiment or example is included in at least one embodiment or example of the application. The illustrative appearances of the above-mentioned terms in various places in the specification are not necessarily intended to refer to the same embodiment or example. Moreover, the particular features, structures, materials or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0116] Although embodiments of the present application have been shown and described, it would be appreciated by those skilled in the art that changes, modifications, alternatives and variations to these embodiments could be made without departing from the principles and spirit of the application, the scope of which is defined by the claims and their equivalents.

Claims

1. A privacy protection method for segmentation learning based on selective decryption, characterized by: The to-be-trained model is divided into a first local model and a second local model. The second local model includes N layers of neural networks. In each round of split learning, the following operations are performed: The client maps the original data into initial features through the first local model, and encrypts the initial features using the fully homomorphic encryption algorithm to obtain the initial feature ciphertext. The client encrypts the label using the asymmetric homomorphic encryption algorithm to obtain the label ciphertext; The client uploads the initial feature ciphertext, the label ciphertext, and the public key of the asymmetric homomorphic encryption algorithm to the server; The server inputs the initial feature ciphertext into the second local model. When it is monitored by the server-side abstraction judgment algorithm that the nth intermediate feature ciphertext output by the nth layer of the N layers of neural networks is abstract, the nth intermediate feature ciphertext is sent back to the client, where 1 ≤ n < N and N is a positive integer greater than or equal to 2; Among them, the server-side abstraction judgment algorithm includes: If the feature dimension of the nth intermediate feature ciphertext is less than or equal to the preset dimension threshold, and / or the information entropy of the nth intermediate feature ciphertext is less than or equal to the preset entropy threshold, then the nth intermediate feature ciphertext is considered abstract, otherwise the nth intermediate feature ciphertext is considered not abstract; The client decrypts the nth intermediate feature ciphertext to obtain the nth intermediate feature plaintext, and uploads the nth intermediate feature plaintext to the server; among them, the client decrypting the nth intermediate feature ciphertext to obtain the nth intermediate feature plaintext includes: The client decrypts the nth intermediate feature ciphertext using the fully homomorphic encryption algorithm key to obtain the nth intermediate feature plaintext; When the client determines that the nth intermediate feature ciphertext is abstract based on the client-side abstraction judgment algorithm, the nth intermediate feature plaintext is uploaded to the server; The client-side abstraction judgment algorithm includes: Obtain the statistical features of the nth intermediate feature plaintext; Perform a statistical feature hypothesis test on the statistical features of the nth intermediate feature plaintext and the statistical features of the original data, and determine whether the nth intermediate feature ciphertext is abstract according to the statistical feature hypothesis test result; The server continues to input the nth intermediate feature plaintext into the network after the nth layer of neural networks in the second local model to obtain a prediction result, calculates the loss ciphertext using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the label ciphertext, and updates the network parameters of the second local model and obtains the noisy gradient based on the loss ciphertext; The client updates the network parameters of the first local model based on the noisy gradient.

2. The privacy protection method for segmented learning based on selective decryption according to claim 1, characterized in that: The client deploys an adversarial verification network, and the adversarial verification network includes a feature reconstructor, an attack discriminator, and an abstraction determiner; The client-side abstraction judgment algorithm includes: Input the nth intermediate feature plaintext into the feature reconstructor to obtain the nth reconstructed original data; The attack discriminator calculates a discrimination index based on the nth reconstructed original data and the original data. The discrimination index includes at least one of the structural similarity between the nth reconstructed original data and the original data, the peak signal-to-noise ratio change rate of the nth layer of neural networks, and the historical attack success rate of the nth layer; The abstraction determiner determines whether the discrimination index meets the abstraction condition. If it meets the abstraction condition, the nth intermediate feature ciphertext is considered abstract, otherwise the nth intermediate feature ciphertext is considered not abstract.

3. The privacy protection method for segmented learning based on selective decryption according to claim 2, characterized in that: The abstract condition includes at least one of condition one, condition two and condition three; Condition 1: The structural similarity between the n-th layer reconstructed original data and the original data is less than a predetermined structural similarity threshold; Condition 2: The historical attack success rate at layer n is less than the dynamic attack success rate threshold at layer n. The dynamic attack success rate threshold at layer n is determined based on the dynamic attack success rate threshold at layer n-1 and the historical attack success rate at layer n. Condition three: The peak signal-to-noise ratio change rate of the n-th layer neural network is less than a predetermined peak signal-to-noise ratio change rate threshold.

4. The method for privacy protection of segmented learning based on selective decryption according to claim 1, 2 or 3, wherein: The method of calculating the loss ciphertext using the public key of the asymmetric homomorphic encryption algorithm, the prediction result, and the label ciphertext includes: The prediction result is encrypted using the public key of the asymmetric homomorphic encryption algorithm to obtain the prediction result ciphertext; The loss ciphertext is calculated by the prediction result ciphertext and the label ciphertext.

5. The method for privacy protection of segmented learning based on selective decryption according to claim 1, 2 or 3, wherein: The updating of the network parameters of the second local model based on the loss ciphertext and obtaining the noisy gradient includes: The server sends the lost ciphertext to the client or a third-party key management center; The client or a third-party key management center decrypts the loss ciphertext to obtain the loss plaintext, and uploads the loss plaintext to the server. The server updates the network parameters of the second local model based on the loss plaintext and generates gradients that are sent back to the client. Differential privacy technology is used to add noise to the gradient to obtain the noisy gradient, which is then sent to the client.

6. The method for privacy protection of segmented learning based on selective decryption according to claim 1, 2 or 3, wherein: The model to be trained is an image classification model, and the original data is image data.

7. A system based on the selective decryption-based segmentation learning privacy protection method according to any of claims 1-6, characterized in that: It includes the client and the server that connects and communicates with the client.

Images