Matrix multiplication operation method and device and storage medium

Abstract

According to the matrix multiplication operation method and device and the storage medium, an original input matrix of a client side is packaged and encrypted through homomorphic encryption, a server side is allowed to operate in a ciphertext mode, and therefore the data privacy of the client side is protected. Afterwards, verification is carried out on the result of matrix multiplication of the server side by using homomorphism of encryption operation through homomorphic hash, and the matrix multiplication and the result of matrix multiplication form a closed loop through a polynomial packaging technology, so that the data security of the client side and the verifiability of a reasoning result are effectively ensured. Moreover, under dual verification of commitment verification and result verification, the accuracy of the target operation result is ensured.

Description

Technical Field

[0001] This specification relates to the field of data processing technology, and in particular to matrix multiplication operation methods, devices, and storage media. Background Art

[0002] With the advent of the big data era, people's lives are increasingly intertwined with data, and data privacy and security issues are becoming increasingly prominent. Ensuring efficient data use while maintaining data security is a challenge worth addressing. In large-model inference scenarios, clients need to outsource local data to the server for inference on local private data. However, client data is sensitive and contains a large amount of user privacy information. Large shared datasets also pose serious privacy and security issues. Furthermore, when performing private inference on user private data in the cloud, the correctness of the inference results is often difficult to verify. For example, to conserve local computing resources, the server can forge false inference results and send them to the client, making it impossible for the client to verify the validity of the inference results. Summary of the Invention

[0003] To overcome the problems existing in the related art, this specification provides a matrix multiplication operation method, device and storage medium.

[0004] According to a first aspect of the embodiments of this specification, a method is provided, comprising: Receive the server's cryptographic commitment to the model parameter matrix; Packing the original input matrix into a first polynomial, encrypting the first polynomial based on a fully homomorphic encryption algorithm to generate a ciphertext input matrix, and sending the ciphertext input matrix to the server, so that the server performs a matrix multiplication operation on the ciphertext input matrix and a second polynomial generated by packing the model parameter matrix, to obtain a ciphertext product matrix sent to the client; Decrypting the ciphertext product matrix to obtain a plaintext product matrix; The validity of the plaintext product matrix is ​​verified based on the commitment and the homomorphic hash function to obtain a valid target operation result.

[0005] According to a matrix multiplication method provided in this specification, packing the original input matrix into a first polynomial includes: Performing an amplification process on the original input matrix, adding an amplification row below the original calculation row of the original input matrix, wherein the amplification row is used to verify the validity of the plaintext product matrix through the homomorphic hash function; The original input matrix and the augmented rows are packed into a polynomial to obtain a first polynomial.

[0006] According to a matrix multiplication method provided in this specification, verifying the validity of the plaintext product matrix based on the commitment and homomorphic hash function includes: Verifying the commitment sent by the server to verify the validity of the commitment; If the verification is successful, the validity of the plaintext product matrix is ​​verified based on the homomorphic hash function to obtain a valid target operation result.

[0007] According to a matrix multiplication method provided in this specification, the commitment sent by the server includes a model parameter hash value set and a parameter commitment value set; The verification of the commitment sent by the server to verify the validity of the commitment includes: Based on the model parameter hash value set and the parameter commitment value set, calling the verification function of the commitment scheme to re-determine the commitment value; performing an element-by-element comparison of the re-determined commitment value with the parameter commitment value set sent by the server; If the comparison results are consistent, the commitment is determined to be valid, and the validity of the commitment is used to indicate that the model parameter matrix has not been changed during the matrix multiplication operation.

[0008] According to a matrix multiplication method provided in this specification, the plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the expanded row result; If the verification is successful, verifying the validity of the plaintext product matrix based on the homomorphic hash function to obtain a valid target operation result includes: Performing an algebraic operation on the model parameter hash value set and the original data of the amplified row to obtain an expected hash value; Performing hash calculation on the amplified row result to obtain an actual hash value; If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is ​​valid, and the original operation result is determined to be the target operation result.

[0009] According to the matrix multiplication method of the embodiment of this specification, the method further includes: If the verification fails, the plaintext product matrix is ​​rejected and the process ends.

[0010] According to a second aspect of the embodiments of this specification, a matrix multiplication method is provided, the method comprising: Generate a cryptographic commitment to the model parameter matrix and send it to the client; Receive a ciphertext input matrix sent by the client, where the ciphertext input matrix is ​​generated by the client packaging an original input matrix into a first polynomial and encrypting the first polynomial based on a fully homomorphic encryption algorithm; A second polynomial generated by packaging the model parameter matrix; Perform a matrix multiplication operation on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and send the ciphertext product matrix to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and verify the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain a valid target operation result.

[0011] According to a matrix multiplication method provided in this specification, the cryptographic commitment generated for the model parameter matrix and sent to the client includes: Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values; Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number; The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

[0012] According to a third aspect of the embodiments of this specification, a device is provided, including: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, the matrix multiplication operation method as described in any one of the first aspect or the second aspect is implemented.

[0013] According to a fourth aspect of the embodiments of this specification, a computer-readable storage medium is provided, including: When the computer program is executed by a processor, the matrix multiplication method described in any one of the first aspect or the second aspect is implemented.

[0014] The technical solutions provided by the embodiments of this specification may have the following beneficial effects: In the embodiments of this specification, the client's original input matrix is ​​packaged and encrypted using homomorphic encryption, allowing the server to perform operations in ciphertext, thereby protecting the client's data privacy. Subsequently, the server's matrix multiplication results are verified using homomorphic hashing, leveraging the homomorphic nature of encryption operations. The two form a closed loop using polynomial packaging technology, effectively ensuring client data security and the verifiability of inference results. Furthermore, through the dual verification of commitment verification and result verification, the accuracy of the target operation results is ensured.

[0015] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the specification and, together with the description, serve to explain the principles of the specification.

[0017] Figure 1 This is a schematic diagram of a large model reasoning scenario shown in this specification according to an exemplary embodiment.

[0018] Figure 2 This is a flowchart of a matrix multiplication method according to an exemplary embodiment of the present specification.

[0019] Figure 3 is another flowchart of a matrix multiplication method according to an exemplary embodiment of this specification.

[0020] Figure 4 It is a schematic diagram of a device according to an exemplary embodiment of this specification.

[0021] Figure 5 This is a schematic diagram of a device according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION

[0022] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with this specification. Rather, they are merely examples of apparatus and methods consistent with certain aspects of this specification, as detailed in the appended claims.

[0023] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0025] This specification provides a matrix multiplication method, device, and computer-readable storage medium. The following describes the embodiments of this specification in detail with reference to the accompanying drawings. The features of the following embodiments and implementations may be combined with each other unless they conflict.

[0026] In large-scale model inference scenarios, clients often need to outsource local private data to cloud servers for inference. This data often contains sensitive information about users' privacy. Therefore, a technical solution is needed that can efficiently utilize data while ensuring data security.

[0027] In addition, when the cloud performs privacy reasoning on user private data, the correctness of the reasoning results is difficult to verify. For example, the server may forge false reasoning results to save local computing resources, but the client cannot recognize their validity.

[0028] In order to solve the above technical problems, this specification provides a moment multiplication operation method.

[0029] The goal is to protect client data privacy by homomorphically encrypting the client's local private data, allowing the server to perform operations in ciphertext. Subsequently, homomorphic hashing leverages the homomorphic nature of encryption operations to verify the results of matrix multiplication. The two form a closed loop using polynomial packing technology, effectively ensuring client data security and verifiable reasoning results.

[0030] like Figure 1 As shown, Figure 1 This is a schematic diagram of a large model reasoning scenario shown in this specification according to an exemplary embodiment.

[0031] The large model reasoning system includes a client and a cloud server provider (hereinafter referred to as the server for the convenience of description).

[0032] The client provides raw input data, encrypts it, and sends it to the server for inference and prediction. The receiving server then decrypts the result based on the encrypted data, verifies its correctness, and ultimately uses the valid result. The client can be, but is not limited to, a personal computer, mobile phone, or edge device.

[0033] Cloud server providers, with strong storage and computing capabilities, offer large-model inference services. These providers are typically cloud service providers or AI companies' computing platforms, and possess model parameters (such as neural network weights). They receive encrypted data from clients, perform inference and proof using their own model parameters in ciphertext, and return encrypted results. These servers can be, but are not limited to, high-performance server clusters or data centers.

[0034] Reference Figure 1, based on the above large model inference system, the complete data flow link of the matrix multiplication operation described in this specification is as follows: Initialization phase.

[0035] The server uses the training data to train the large model and obtain the large model and model parameters to be reasoned and proved.

[0036] When using the matrix multiplication protocol for large model inference, the server commits to the private model parameter data of the large model and sends the commitment to the client. The server generates the commitment value of the original model parameter matrix, the homomorphic hash value, and the random number, and packages them and sends them to the client.

[0037] After receiving the promise, the client calls the commitment verification function to verify its validity and confirm that the server's model parameters have not been tampered with. If verification passes, the client proceeds to the next step; otherwise, the interaction is terminated. In other words, the client's verification of the promise's validity can occur before verifying the server's inference results. This is because the combination of commitment verification and server-side inference result verification ensures the accuracy of the final result, improving interaction efficiency while ensuring the correctness of the final result. At the same time, if the commitment verification fails, the interaction is terminated or the server-side inference result is rejected in a timely manner, saving computing resources.

[0038] Data transmission and ciphertext calculation stage.

[0039] The client encrypts the local private data by packing it, adding augmented rows to the original input matrix and converting it into a form suitable for homomorphic encryption through polynomial packing (which facilitates the server to perform ciphertext matrix multiplication). The data is then sent to the server for inference and prediction, such as performing secure matrix multiplication, to obtain the inference result.

[0040] The server receives the client's ciphertext input matrix, converts its own original model parameter matrix into a polynomial through polynomial packaging, and then uses the multiplication characteristics of homomorphic encryption to perform matrix multiplication in the ciphertext state to generate a ciphertext product matrix containing the original calculation results and the amplified row results, and sends it to the client.

[0041] Result verification stage.

[0042] The client decrypts the inference result and verifies the decrypted plaintext result using a homomorphic hash algorithm to ensure the validity of the plaintext result and that the server has not forged the calculation result. If valid, the plaintext result is determined to be the target calculation result and used for subsequent applications.

[0043] Through the above process, cryptographic technology is used to build a closed loop of privacy protection and verifiable results. While ensuring the security and privacy of client data, secure and reliable model reasoning is completed on the server side, and the results are verifiable.

[0044] This solution is applicable to models involving matrix multiplication (or operations that can be converted to matrix multiplication), including large transformer-based language models. Examples include convolutional neural networks (CNNs), recurrent neural networks (RNNs), and multi-layer perceptrons (MLPs).

[0045] The following is an embodiment of a matrix multiplication operation method provided in this specification. The matrix multiplication operation method is applied to the client in the above-mentioned large model reasoning system.

[0046] like Figure 2 As shown, Figure 2 1 is a flowchart of a matrix multiplication method according to an exemplary embodiment of the present specification, comprising the following steps: In step 102, a cryptographic commitment generated by the server for the model parameter matrix is ​​received.

[0047] The original model parameter matrix is ​​the core calculation parameter of the model, such as the weight matrix of the neural network (the convolution kernel of CNN, the fully connected layer weight of MLP, the attention weight of Transformer, etc.), which is stored on the server.

[0048] A cryptographic commitment is a sealed envelope around data, with two key properties: First, the committer cannot tamper with the committed data after the commitment is made; second, the recipient can verify the committed data to ensure it is consistent with the original data. In this specification, the server commits to the local model parameters to ensure their integrity and prevent malicious modification by the server.

[0049] In some embodiments, the server generates a cryptographic commitment to the model parameter matrix and sends it to the client, including: Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values; Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number; The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

[0050] The specific process is as follows: Server-side local model parameter matrix W =[ ] for each element w i Perform two operations separately: Calculate its hash value through the LHH hash function h i , , generate a set of model parameter hash values.

[0051] Generate parameter commitment values ​​through cryptographic commitment scheme (com.commit) c i ,Will w i and a random number r i As input, generate an irreversible string, i.e. , and obtain the parameter commitment value set.

[0052] The server will Sent to the client for the client to verify the validity of the commitment. That is, the client confirms through the commitment verification function that the model parameters on the server have not been tampered with before calculation, ensuring the credibility of the parameters.

[0053] In step 104, the original input matrix is ​​packaged into a first polynomial, the first polynomial is encrypted based on a fully homomorphic encryption algorithm, a ciphertext input matrix is ​​generated, and the ciphertext input matrix is ​​sent to the server, so that the server performs a matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on the packaged model parameter matrix to obtain a ciphertext product matrix sent to the client.

[0054] The client packages local private data using polynomial packaging, converting matrix data into a polynomial form. This allows matrix elements to be used as polynomial coefficients, converting matrix operations into polynomial operations. In this embodiment, both the client and server package matrix data into polynomials and then leverage the operational properties of polynomials to perform matrix multiplication. This approach facilitates data encryption and computation.

[0055] In some embodiments, packing the original input matrix into a first polynomial comprises: Performing an amplification process on the original input matrix, adding an amplification row below the original calculation row of the original input matrix, wherein the amplification row is used to verify the validity of the plaintext product matrix through the homomorphic hash function; The original input matrix and the augmented rows are packed into a polynomial to obtain a first polynomial.

[0056] The original input matrix refers to the matrix of local private data, as shown below:

[0057] The client performs amplification processing on the original input matrix. In the original calculation row of the original input matrix { X 0 ， X 1 ...X n-1 Add an expansion row below Xn The data of this expanded row is the previous n The sum of the column data corresponding to the -1 row (multiplied by the coefficient s) is used to verify the validity of the plaintext product matrix obtained after the server-side operation through the homomorphic hash function.

[0058]

[0059] In this formula, i To calculate the row, i ∈{0,1,... n}, the client's original input matrix is ​​[ n +1, m ], n+1 The original input matrix for the client X the number of rows, m The original input matrix for the client X The number of columns.

[0060] The client uses a polynomial to pack the original input matrix and the augmented matrix formed by the augmented rows, mapping the matrix elements to polynomial coefficients so that matrix multiplication can be converted to polynomial multiplication. The coefficients of the polynomial are:

[0061] Corresponding to the original input matrix X Elements X ( i, j ), i ∈{0,1,...n}, j ∈{0,1,...m-1}; N is the dimension control parameter of polynomial packing, which is used to define the degree of the polynomial of the homomorphic encryption scheme; Mark the reverse mapping of the elements in the original input matrix to the polynomial to ensure that the operation covers all cross terms; Mark the forward mapping of elements in the original input matrix into the polynomial, ensuring that the elements are correctly mapped to the dimensions of the model parameters.

[0062] The first polynomial obtained by packing is:

[0063] The client encrypts the polynomial using a fully homomorphic encryption algorithm for , the client sends To the server. Homomorphic encryption supports any number of addition and multiplication operations on ciphertext. This means that client data always exists in ciphertext form during transmission and storage, and the server cannot access the original data content, thus ensuring data privacy. Furthermore, the ciphertext calculation characteristics of homomorphic encryption allow the server to complete complex computing tasks in the ciphertext state without frequent encryption and decryption operations, achieving matrix multiplication without leaking data.

[0064] In this embodiment, the client uses a fully homomorphic encryption algorithm to encrypt the polynomial, providing a basis for the server to perform matrix multiplication operations on the ciphertext.

[0065] In some embodiments, first, the server receives the ciphertext input matrix sent by the client. The ciphertext input matrix is ​​generated by the client packaging the original input matrix into a first polynomial and encrypting the first polynomial based on a fully homomorphic encryption algorithm.

[0066] Afterwards, the server receives Afterwards, the server packages the model parameter matrix to generate the second polynomial.

[0067] Specifically, the server also performs polynomial packaging on the local model parameter matrix W: the server matrix is ​​[ m, k ],

[0068] The server-side packaged polynomial is Get the second polynomial .

[0069] Specifically, the server also performs polynomial packaging on the local model parameter matrix W: the server model parameter matrix W is [ m, k ], m is the number of rows of the server-side local model parameter matrix W, k is the number of columns of the server-side local model parameter matrix W.

[0070]

[0071] In this formula, i, j To calculate the row, corresponding to the element of the local model parameter matrix W , i∈{0,1,... m -1}, j ∈{0,1,... k -1}; The server-side packaged polynomial is Get the second polynomial .

[0072] Next, the server performs a matrix multiplication operation on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and sends the ciphertext product matrix to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and verifies the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain a valid target operation result.

[0073] Specifically, server-side computing Since fully homomorphic encryption supports ciphertext multiplication operations, this calculation process is completed in the ciphertext state, and the server can perform matrix multiplication operations without decryption.

[0074] After the calculation is completed, the server decodes the packed ciphertext matrix to obtain the result of the ciphertext product matrix Enc (T) :

[0075] Among them, the ciphertext product matrix The original operation result including the original input matrix { , } and the expanded row results .

[0076] Server sends To the client.

[0077] In this embodiment, the ciphertext calculation characteristics of homomorphic encryption are used to complete matrix multiplication operations without leaking data.

[0078] In step 106, the ciphertext product matrix is ​​decrypted to obtain a plaintext product matrix.

[0079] The client receives the ciphertext product matrix sent by the server After that, the ciphertext product matrix is ​​decrypted to obtain the plaintext product matrix including the original operation result and the amplified row result { }, among which, the front n- The first row is the original operation result of the original input matrix, the n The line is ahead n- The sum of 1 row is used for verification. After homomorphic hash verification, the client can confirm the correctness of the result and use it.

[0080] As an example, the client decrypts the matrix product result T: { }=Dec( Enc(T) ).

[0081] As an example, the client uses the public key to polynomial Perform fully homomorphic encryption and receive the ciphertext product matrix returned by the server on the client Finally, the plaintext product matrix T is obtained by decrypting it with the private key corresponding to the public key, ensuring that only the client can obtain the original operation result.

[0082] In step 108, the validity of the plaintext product matrix is ​​verified based on the commitment and the homomorphic hash function to obtain a valid target operation result.

[0083] After the client obtains the plaintext product matrix T through decryption, it needs to verify the validity of the result.

[0084] Homomorphic encryption, on the other hand, allows specific algebraic operations, such as addition and multiplication, to be performed directly on encrypted data. Furthermore, the result of performing the operation on the ciphertext, after decryption, is equivalent to the result of performing the corresponding operation on the original plaintext. Therefore, the client verifies the validity of the matrix product result based on homomorphic hashing and commitments.

[0085] In some embodiments, verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function includes: Verifying the commitment sent by the server to verify the validity of the commitment; If the verification is successful, the validity of the plaintext product matrix is ​​verified based on the homomorphic hash function to obtain a valid target operation result.

[0086] The client verifies the commitment sent by the server, which includes a model parameter hash value set and a parameter commitment value set, and confirms that the model parameters have not been tampered with by executing the commitment function.

[0087] As an example, verifying the commitment sent by the server to verify the validity of the commitment includes: Based on the model parameter hash value set and the parameter commitment value set, calling the verification function of the commitment scheme to re-determine the commitment value; performing an element-by-element comparison of the re-determined commitment value with the parameter commitment value set sent by the server; If the comparison results are consistent, the commitment is determined to be valid, and the validity of the commitment is used to indicate that the model parameter matrix has not been changed during the matrix multiplication operation.

[0088] If the verification fails, the plaintext product matrix is ​​rejected and the process ends.

[0089] The client receives the parameter commitment value sent by the server , parameter hash value and random numbers .

[0090] By calling the verification function of the commitment scheme , redetermine the commitment value .

[0091] Will recalculate Sent by the server c i Perform element-by-element comparison. If the comparison results are consistent, the commitment is determined to be valid. The validity of the commitment is used to indicate that the model parameter matrix has not been changed in the matrix multiplication operation. This is because the model parameter hash value sent by the server h i With the original model parameters w i One-to-one correspondence, that is h i = LHH.hash( w i ). Therefore, verify the validity of the commitment:

[0092] If the above equation is 1, then c i It is indeed w i The client confirms the validity of the server's commitment, indicating that the server has not tampered with the parameters. If the above equation ! = 1, the client rejects the server's inference result or terminates the current inference process and sends an error message to the server.

[0093] The commitment scheme ensures the integrity of the model parameters provided by the server, laying the foundation for the reliability of subsequent calculations.

[0094] Then, after the verification is passed, the validity of the plaintext product matrix is ​​verified based on the homomorphic hash function to obtain the valid target operation result.

[0095] In some embodiments, if the verification is successful, verifying the validity of the plaintext product matrix based on the homomorphic hash function to obtain a valid target operation result includes: Performing an algebraic operation on the model parameter hash value set and the original data of the amplified row to obtain an expected hash value; Performing hash calculation on the amplified row result to obtain an actual hash value; If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is ​​valid, and the original operation result is determined to be the target operation result.

[0096] As an example, the plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the expanded row result.

[0097] Homomorphic hash verification ensures that the calculation process of ciphertext matrix multiplication is correct and the server has not forged the result by amplifying the hash consistency of the row result.

[0098] Specifically, the client calculates the actual hash value of the augmented row result and uses the Eval function of the homomorphic hash based on the set of model parameter hash values ​​sent by the server and verified by the commitment. h i And the expansion row held locally by the client X n The original data is used to calculate the expected hash value. If the two hash values ​​are equal, it can be proved that the result of the plaintext product matrix is ​​correct. That is: LHH.hash( )==LHH.Eval ( ).

[0099] The specific process is as follows: The client performs the following operations through the evaluation function of the homomorphic hash function: Set the model parameter hash values h i As an encrypted feature of the model parameter, the amplified row X n The data are treated as known input factors; The matrix multiplication operation of the simulated model parameter matrix and the augmented row is finally obtained. It should be noted that algebraic operations are only performed at the hash value level (for example, hash value multiplication corresponds to the multiplication of the original parameters and the augmented row elements, and hash value addition corresponds to the sum of products).

[0100] The client calculates the actual hash value of the expanded row in the plaintext product matrix. If the hash value matches the expected hash value, the matrix multiplication operation is correct, and the client is convinced that the data on the server is a valid product result. The client uses the original operation result as the target operation result for subsequent reasoning (such as activation function processing and generating the final output).

[0101] If there is any inconsistency, it means that the result is forged or the calculation is wrong, and the result should be rejected.

[0102] In this process, the property of homomorphic hashing is utilized, that is, the hash operation of the result is consistent with the result of the operation through the hash value of the original data, thereby realizing the verification of the calculation result without the client obtaining the original model parameters of the server and without exposing all the original data.

[0103] This specification provides a matrix multiplication method, device, and computer-readable storage medium. This method uses homomorphic encryption to package and encrypt the client's original input matrix, allowing the server to perform operations in ciphertext, thereby protecting the client's data privacy. Subsequently, the results of the server-side matrix multiplication are verified using homomorphic hashing, leveraging the homomorphism of encryption operations. The two form a closed loop using polynomial packing technology, effectively ensuring client data security and the verifiability of inference results. Furthermore, through the dual verification of commitment verification and result verification, the accuracy of the target operation results is ensured.

[0104] The following is an embodiment of a matrix multiplication operation method provided in this specification. The matrix multiplication operation method is applied to the server side of the above-mentioned large model reasoning system.

[0105] like Figure 3 As shown, Figure 3 1 is a flowchart of a matrix multiplication method according to an exemplary embodiment of the present specification, comprising the following steps: In step 201, a cryptographic commitment is generated for the model parameter matrix and sent to the client.

[0106] In some embodiments, the cryptographic commitment generated for the model parameter matrix and sent to the client includes: Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values; Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number; The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

[0107] The server first calculates the local private model parameter matrix W=[ ] Make a commitment:

[0108] The server will Sent to the client.

[0109] In step 203, the model parameter matrix is ​​packaged to generate a second polynomial.

[0110] The server packages and encrypts the local model parameter matrix:

[0111] The server-side packaged polynomial is .

[0112] In step 205 , a ciphertext input matrix sent by the client is received. The ciphertext input matrix is ​​generated by the client packaging the original input matrix into a first polynomial and encrypting the first polynomial based on a fully homomorphic encryption algorithm.

[0113] The server receives the polynomial encrypted by the client using the fully homomorphic encryption algorithm Obtained Enc(P(x)) .

[0114] In step 207, a matrix multiplication operation is performed on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and the ciphertext product matrix is ​​sent to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and the validity of the plaintext product matrix is ​​verified based on the commitment and homomorphic hash function to obtain a valid target operation result.

[0115] Server-side computing The server decodes the ciphertext matrix to obtain the plaintext product matrix.

[0116] Server sends The client verifies the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain a valid target operation result.

[0117] The implementation process of each step in the above method is detailed in the implementation process of the corresponding steps in the matrix multiplication operation method of the client applied to the above large model inference system. The same technical effect can be achieved and will not be repeated here.

[0118] Based on the same application concept as the above method, the embodiment of the present application also proposes a matrix multiplication operation device, such as Figure 4 shown.

[0119] The device comprises: The receiving module is used to receive the cryptographic commitment generated by the server for the model parameter matrix; an encryption module, configured to package an original input matrix into a first polynomial, encrypt the first polynomial based on a fully homomorphic encryption algorithm, generate a ciphertext input matrix, and send the ciphertext input matrix to the server, so that the server performs a matrix multiplication operation on the ciphertext input matrix and a second polynomial generated by packaging the model parameter matrix, thereby obtaining a ciphertext product matrix to be sent to the client; A decryption module, configured to decrypt the ciphertext product matrix to obtain a plaintext product matrix; A verification module is used to verify the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result.

[0120] The implementation process of the functions and effects of each module / submodule / unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and the same technical effects can be achieved, so it will not be repeated here.

[0121] Figure 5 The following is a schematic diagram of the physical structure of a matrix multiplication operation device, such as Figure 5 As shown, the matrix multiplication operation device may include: a processor (processor) 510, a communication interface (Communications Interface) 520, a memory (memory) 530 and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the matrix multiplication operation method.

[0122] In addition, the logical instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0123] On the other hand, the present application also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the matrix multiplication operation methods provided by the above methods.

[0124] On the other hand, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to perform the matrix multiplication operation method provided by the above methods.

[0125] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0126] Other embodiments of the present invention will readily occur to those skilled in the art upon consideration of the present invention and practice of the invention claimed herein. This specification is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of this specification and include common knowledge or customary techniques in the art not claimed herein. The description and examples are to be considered as exemplary only, with the true scope and spirit of the present invention being indicated by the following claims.

[0127] It should be understood that the present description is not limited to the exact structure that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present description is limited only by the appended claims.

[0128] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A matrix multiplication method, characterized in that: The method comprises: Receive the server's cryptographic commitment to the model parameter matrix; Packing the original input matrix into a first polynomial, encrypting the first polynomial based on a fully homomorphic encryption algorithm to generate a ciphertext input matrix, and sending the ciphertext input matrix to the server, so that the server performs a matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on the packaged model parameter matrix, to obtain a ciphertext product matrix sent to the client; Decrypting the ciphertext product matrix to obtain a plaintext product matrix; The validity of the plaintext product matrix is ​​verified based on the commitment and the homomorphic hash function to obtain a valid target operation result.

2. The matrix multiplication method according to claim 1, wherein: The step of packing the original input matrix into a first polynomial comprises: Performing an amplification process on the original input matrix, adding an amplification row below the original calculation row of the original input matrix, wherein the amplification row is used to verify the validity of the plaintext product matrix through the homomorphic hash function; The original input matrix and the augmented rows are packed into a polynomial to obtain a first polynomial.

3. The matrix multiplication method according to claim 2, wherein: The verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function includes: Verifying the commitment sent by the server to verify the validity of the commitment; If the verification is successful, the validity of the plaintext product matrix is ​​verified based on the homomorphic hash function to obtain a valid target operation result.

4. The matrix multiplication method according to claim 3, wherein: The commitment sent by the server includes a model parameter hash value set and a parameter commitment value set; The verification of the commitment sent by the server to verify the validity of the commitment includes: Based on the model parameter hash value set and the parameter commitment value set, calling the verification function of the commitment scheme to re-determine the commitment value; performing an element-by-element comparison of the re-determined commitment value with the parameter commitment value set sent by the server; If the comparison results are consistent, the commitment is determined to be valid, and the validity of the commitment is used to indicate that the model parameter matrix has not been changed during the matrix multiplication operation.

5. The matrix multiplication method according to claim 3, wherein: The plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the expanded row result; If the verification is successful, verifying the validity of the plaintext product matrix based on the homomorphic hash function to obtain a valid target operation result includes: Performing an algebraic operation on the model parameter hash value set and the original data of the amplified row to obtain an expected hash value; Performing hash calculation on the amplified row result to obtain an actual hash value; If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is ​​valid, and the original operation result is determined to be the target operation result.

6. The matrix multiplication method according to claim 3, wherein: The method further comprises: If the verification fails, the plaintext product matrix is ​​rejected and the process ends.

7. A matrix multiplication method, characterized in that: The method comprises: Generate a cryptographic commitment to the model parameter matrix and send it to the client; Receive a ciphertext input matrix sent by the client, where the ciphertext input matrix is ​​generated by the client packaging an original input matrix into a first polynomial and encrypting the first polynomial based on a fully homomorphic encryption algorithm; A second polynomial generated by packaging the model parameter matrix; Perform a matrix multiplication operation on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and send the ciphertext product matrix to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and verify the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain a valid target operation result.

8. The matrix multiplication method according to claim 7, wherein: The cryptographic commitment generated for the model parameter matrix and sent to the client includes: Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values; Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number; The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

9. A computer device, characterized in that: A method for performing matrix multiplication according to claim 1, comprising: a memory, a processor, and a matrix multiplication operation program stored in the memory and executable on the processor, wherein the processor implements the steps of the matrix multiplication operation method according to any one of claims 1 to 6 when executing the matrix multiplication operation program, and / or It includes a memory, a processor and a matrix multiplication operation program stored in the memory and capable of running on the processor. When the processor executes the matrix multiplication operation program, the steps of the matrix multiplication operation method as described in any one of claims 7 to 8 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a matrix multiplication operation program, which, when executed, implements the steps of the matrix multiplication operation method according to any one of claims 1 to 6, and / or The computer-readable storage medium stores a matrix multiplication operation program, which, when executed, implements the steps of the matrix multiplication operation method according to any one of claims 7 to 8.

Images