Matrix multiplication operation method, device and storage medium

Abstract

The application provides a matrix multiplication operation method, device and storage medium. The original input matrix of a client is packaged and encrypted through homomorphic encryption, and the server is allowed to operate in the form of ciphertext, so as to protect the data privacy of the client. Then, the homomorphic nature of the encryption operation is used to verify the result of the matrix multiplication operation of the server through homomorphic hashing. The two form a closed loop through polynomial packaging technology, effectively ensuring the safety of the client data and the verifiability of the reasoning result. Moreover, under the double verification of commitment verification and result verification, the accuracy of the target operation result is ensured.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of data processing, and particularly relates to a matrix multiplication operation method, device and storage medium. BACKGROUND

[0002] With the advent of the big data era, people's life has been closely related to data, and the privacy and security of data have become increasingly prominent. How to ensure efficient use of data while ensuring data security is a problem worth solving. In the big model inference scenario, the client needs to outsource local data to the server for local private data inference. However, the client data is sensitive data containing a large amount of user privacy information, and a large number of shared data sets also pose serious privacy and security problems. At the same time, when the cloud performs private inference on user data, the correctness of the inference result is often difficult to verify. For example, the server can send a fake inference result to the client to save local computing resources, and the client cannot identify the validity of the inference result. SUMMARY

[0003] To overcome the problems in the related art, the present specification provides a matrix multiplication operation method, device and storage medium.

[0004] According to a first aspect of an embodiment of the present specification, a method is provided, the method comprising:

[0005] receiving a cryptographic commitment generated by a server on a model parameter matrix;

[0006] packing an original input matrix into a first polynomial, encrypting the first polynomial based on a homomorphic encryption algorithm to generate a ciphertext input matrix, and sending the ciphertext input matrix to the server, so that the server performs matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on packing of the model parameter matrix to obtain a ciphertext product matrix sent to the client;

[0007] decrypting the ciphertext product matrix to obtain a plaintext product matrix;

[0008] verifying the validity of the plaintext product matrix based on the commitment and a homomorphic hash function to obtain a valid target operation result.

[0009] According to a matrix multiplication operation method provided by the present specification, the original input matrix is packed into a first polynomial, which comprises:

[0010] performing amplification processing on the original input matrix, and increasing an amplification row below an original calculation row of the original input matrix, the amplification row being used to verify the validity of the plaintext product matrix through the homomorphic hash function;

[0011] Pack the original input matrix and the augmented row as a polynomial to obtain a first polynomial.

[0012] According to the matrix multiplication operation method provided in the specification, the validity of the plaintext product matrix is verified based on the commitment and the homomorphic hash function, which includes:

[0013] The commitment sent by the server is verified to verify the validity of the commitment.

[0014] If the verification is passed, the validity of the plaintext product matrix is verified based on the homomorphic hash function, and the effective target operation result is obtained.

[0015] According to the matrix multiplication operation method provided in the specification, the commitment sent by the server includes a model parameter hash value set and a parameter commitment value set.

[0016] The commitment sent by the server is verified to verify the validity of the commitment, which includes:

[0017] Based on the model parameter hash value set and the parameter commitment value set, the verification function of the commitment scheme is called to re-determine the commitment value.

[0018] The re-determined commitment value and the parameter commitment value set sent by the server are compared element by element.

[0019] If the comparison result is consistent, it is determined that the commitment is valid, and the commitment is valid to indicate that the model parameter matrix has not been changed in the matrix multiplication operation.

[0020] According to the matrix multiplication operation method provided in the specification, the plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the augmented row result.

[0021] If the verification is passed, the validity of the plaintext product matrix is verified based on the homomorphic hash function, and the effective target operation result is obtained, which includes:

[0022] The model parameter hash value set and the original data of the augmented row are subjected to algebraic operation to obtain an expected hash value.

[0023] The augmented row result is subjected to hash calculation to obtain an actual hash value.

[0024] If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is valid, and the original operation result is determined as the target operation result.

[0025] According to the matrix multiplication operation method provided in the specification, the method further includes:

[0026] If the verification fails, the plaintext product matrix is rejected, and the process ends.

[0027] According to a second aspect of the embodiments of the present specification, a matrix multiplication method is provided, and the method comprises:

[0028] A cryptographic commitment of the model parameter matrix is generated and sent to the client.

[0029] The ciphertext input matrix sent by the client is received, which is generated by the client by packing the original input matrix into a first polynomial and encrypting the first polynomial based on a homomorphic encryption algorithm.

[0030] A second polynomial is generated by packing the model parameter matrix.

[0031] The ciphertext input matrix and the second polynomial are subjected to matrix multiplication to generate a ciphertext product matrix, which is sent to the client for decryption by the client to obtain a plaintext product matrix; and the validity of the plaintext product matrix is verified based on the commitment and a homomorphic hash function to obtain a valid target operation result.

[0032] According to a matrix multiplication method provided by the present specification, the cryptographic commitment of the model parameter matrix is generated and sent to the client, which comprises:

[0033] A homomorphic hash function is applied to each parameter element in the model parameter matrix to generate a model parameter hash value set.

[0034] A corresponding parameter commitment value set is generated by a cryptographic commitment scheme, and each commitment value is bound to a parameter element and a random number.

[0035] The model parameter hash value set, the parameter commitment value set, and the random number are packed and sent to the client.

[0036] According to a third aspect of the embodiments of the present specification, a device is provided, which comprises:

[0037] The device comprises a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements the matrix multiplication method of any one of the first aspect or the second aspect when executing the program.

[0038] According to a fourth aspect of the embodiments of the present specification, a computer readable storage medium is provided, which comprises:

[0039] The computer program is executed by the processor to implement the matrix multiplication method of any one of the first aspect or the second aspect.

[0040] The technical solutions provided by the embodiments of the present specification can include the following beneficial effects:

[0041] In the embodiments of the present specification, the original input matrix of the client is packaged and encrypted by homomorphic encryption, allowing the server to operate in the form of ciphertext, thereby protecting the data privacy of the client. Thereafter, the result of the matrix multiplication operation of the server is verified by homomorphic hash using the homomorphism of the encryption operation, and the two form a closed loop through polynomial packaging technology, effectively ensuring the security of the client data and the verifiability of the reasoning result. Moreover, under the double verification of commitment verification and result verification, the accuracy of the target operation result is ensured.

[0042] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present specification and, together with the specification, serve to explain the principles of the present specification.

[0044] Figure 1 is a large model reasoning scene schematic diagram according to an exemplary embodiment of the present specification.

[0045] Figure 2 is a flowchart of a matrix multiplication operation method according to an exemplary embodiment of the present specification.

[0046] Figure 3 is another flowchart of a matrix multiplication operation method according to an exemplary embodiment of the present specification.

[0047] Figure 4 is a device schematic diagram according to an exemplary embodiment of the present specification.

[0048] Figure 5 is a device schematic diagram according to an exemplary embodiment of the present specification. DETAILED DESCRIPTION

[0049] The exemplary embodiments will be described in detail hereinafter with reference to the accompanying drawings. In the following description, the same numbers refer to the same elements throughout the drawings, unless otherwise represented. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the present specification, as detailed in the appended claims.

[0050] The terms used in this specification are for the purpose of describing specific embodiments only and are not intended to limit this specification. As used in this specification and the appended claims, the singular forms "a," "an," "the," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

[0051] It should be understood that although the terms first, second, third, etc. may be used in this specification to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information without departing from the scope of this specification. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0052] This specification provides a matrix multiplication method, device, and computer-readable storage medium. The following describes the embodiments of this specification in detail with reference to the accompanying drawings. The features of the following embodiments and implementations may be combined with each other unless they conflict.

[0053] In large-scale model inference scenarios, clients often need to outsource local private data to cloud servers for inference. This data often contains sensitive information about users' privacy. Therefore, a technical solution is needed that can efficiently utilize data while ensuring data security.

[0054] In addition, when the cloud performs privacy reasoning on user private data, the correctness of the reasoning results is difficult to verify. For example, the server may forge false reasoning results to save local computing resources, but the client cannot recognize their validity.

[0055] In order to solve the above technical problems, this specification provides a moment multiplication operation method.

[0056] The goal is to protect client data privacy by homomorphically encrypting the client's local private data, allowing the server to perform operations in ciphertext. Subsequently, homomorphic hashing leverages the homomorphic nature of encryption operations to verify the results of matrix multiplication. The two form a closed loop using polynomial packing technology, effectively ensuring client data security and verifiable reasoning results.

[0057] like Figure 1 As shown, Figure 1 This is a schematic diagram of a large model reasoning scenario shown in this specification according to an exemplary embodiment.

[0058] The large model inference system includes a client and a cloud server provider (hereinafter referred to as a server for convenience of description).

[0059] The client is the subject that provides original input data, encrypts the data, and sends it to the server for inference prediction. The server receives the result of the operation based on the encrypted data, decrypts the result, and verifies its correctness, and finally uses the valid result. The client can be, but is not limited to, a personal computer, a mobile phone, an edge device, etc.

[0060] The cloud server provider has strong storage and computing power to provide large model inference services for users, and is usually an algorithm platform of a cloud service provider or an AI company, etc., which has model parameters (such as neural network weights). The encrypted data sent by the client is received, and the inference and proof are completed in the ciphertext state using the model parameters of the server, and the encrypted result is returned. The server can be, but is not limited to, a high-performance server cluster, a data center, etc.

[0061] Referring to Figure 1 According to the above large model inference system, the complete data flow link of the matrix multiplication operation described in the specification is as follows:

[0062] Initialization phase.

[0063] The server trains the large model using training data to obtain the large model to be inferred and proved and the model parameters.

[0064] When using the matrix multiplication protocol for large model inference, the server commits the private data of the model parameters of the large model and sends the commitment to the client. Among them, the server generates the commitment value, the homomorphic hash value and the random number of the original model parameter matrix, and sends them to the client in a package.

[0065] After receiving, the client calls the commitment verification function to verify the validity of the commitment and confirms that the model parameters of the server have not been tampered with. If the verification is successful, the next step is entered, otherwise the interaction is terminated. That is, the process of verifying the validity of the commitment by the client can be any process before verifying the inference result of the server. Because the combination of commitment verification and server inference result verification ensures the accuracy of the final result, improves the interaction efficiency, and ensures the correctness of the final result. At the same time, when the commitment verification fails, the interaction will be terminated or the server inference result will be rejected in time, saving computing resources.

[0066] Data transmission and ciphertext calculation phase.

[0067] The client packs and encrypts local private data, including adding augmented rows to the original input matrix, and converting the matrix into a form suitable for homomorphic encryption through polynomial packing (to facilitate the server to perform ciphertext matrix multiplication). The client sends the encrypted input matrix to the server for inference and prediction, such as performing secure matrix multiplication to obtain the inference result.

[0068] The server receives the ciphertext input matrix from the client, converts the original model parameter matrix into a polynomial through polynomial packing, and performs matrix multiplication in the ciphertext state using the multiplication property of homomorphic encryption to generate a ciphertext product matrix containing the original calculation result and the augmented row result, and sends the ciphertext product matrix to the client.

[0069] The result verification phase.

[0070] The client decrypts the inference result and verifies the decrypted plaintext result based on the homomorphic hash algorithm to ensure the validity of the verification plaintext result and ensure that the server has not falsified the calculation result. In the case of validity, the plaintext result is determined to be the target operation result for subsequent application.

[0071] Through the above process, a closed loop of privacy protection and result verification is constructed through cryptographic techniques to ensure that the client's data is secure and private, and that the server can complete secure and trustworthy model inference, and ensure that the result is verifiable.

[0072] The present scheme is applicable to models involving matrix multiplication (or operations that can be converted into matrix multiplication), including large language models based on transformers. For example, convolutional neural networks (CNN), recurrent neural networks (RNN), multi-layer perceptrons (MLP), etc.

[0073] The following is an embodiment of a matrix multiplication operation method provided by the present specification. The matrix multiplication operation method is applied to the client in the large model inference system described above.

[0074] As shown in Figure 2 , Figure 2 is a flowchart of a matrix multiplication operation method according to an exemplary embodiment of the present specification, comprising the following steps:

[0075] In step 102, a cryptographic commitment generated by the server for the model parameter matrix is received.

[0076] The original model parameter matrix is the core computing parameter of the model, such as the weight matrix of the neural network (convolution kernel of CNN, full connection layer weight of MLP, attention weight of Transformer, etc.), which is stored in the server.

[0077] The cryptographic commitment is a sealed envelope for data, which has two key attributes: one is that the committer cannot tamper with the committed data after the commitment is generated; the other is that the receiver can verify the committed data to determine whether it is consistent with the original data. In this specification, the server will commit the local model parameters, which can ensure the integrity of the model parameters and prevent the server from maliciously modifying them.

[0078] In some embodiments, the server generates a cryptographic commitment of the model parameter matrix and sends it to the client, including:

[0079] Applying a homomorphic hash function to each parameter element in the model parameter matrix generates a set of model parameter hash values;

[0080] Generating a set of corresponding parameter commitment values through a cryptographic commitment scheme, each commitment value binding a parameter element and a random number;

[0081] Packing the set of model parameter hash values, the set of parameter commitment values, and the random number and sending them to the client.

[0082] The specific process is as follows:

[0083] The server performs two operations on each element of the local model parameter matrix W [ ]respectively. w i

[0084] Calculating its hash value through the LHH hash function h i , to generate a set of model parameter hash values.

[0085] Generating a parameter commitment value through a cryptographic commitment scheme (com.commit) c i , w i and a random number r i as input, generating an irreversible string, i.e. , to get a set of parameter commitment values.

[0086] The server will send The commitment is sent to the client for the client to verify the validity of the commitment, that is, the client confirms through the commitment verification function that the model parameters of the server are not tampered with before calculation, and ensures the credibility of the parameters.

[0087] In step 104, the original input matrix is packed into a first polynomial, the first polynomial is encrypted based on a homomorphic encryption algorithm to generate a ciphertext input matrix, and the ciphertext input matrix is sent to the server to make the server perform matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on the model parameter matrix to obtain a ciphertext product matrix sent to the client.

[0088] The client packs the local private data, and the packing process adopts polynomial packing to convert the matrix data into a polynomial. In this way, the elements of the matrix can be used as the coefficients of the polynomial, so that the matrix operation is converted into a polynomial operation. In this embodiment, the client and the server will pack the matrix data into a polynomial, and then use the operation properties of the polynomial to realize the matrix multiplication operation. This method provides convenience for data encryption and calculation.

[0089] In some embodiments, the packing of the original input matrix into a first polynomial comprises:

[0090] The original input matrix is augmented by adding an augmented row below the original calculation row of the original input matrix, and the augmented row is used to verify the validity of the plaintext product matrix through the homomorphic hash function.

[0091] The original input matrix and the augmented row are packed into a polynomial to obtain a first polynomial.

[0092] The original input matrix refers to the matrix of the local private data, for example:

[0093]

[0094] The client augments the original input matrix by adding an augmented row below the original calculation row of the original input matrix X 0 ， X 1 ...X n-1} of the original input matrix Xn . The data of the augmented row is the sum (multiplied by a coefficient s) of the corresponding column data of the previous n -1 row, which is used to verify the validity of the plaintext product matrix obtained by the server after operation through the homomorphic hash function.

[0095]

[0096] In the formula, i For the calculation of rows, i ∈{0,1,... n}, the client original input matrix is n +1, m ], n+1 The number of rows of the client original input matrix X , m The number of columns of the client original input matrix X .

[0097] The client uses a polynomial to pack the augmented matrix formed by the original input matrix and the augmented row, and maps the matrix elements to polynomial coefficients, so that the matrix multiplication can be converted into polynomial multiplication. Among them, the coefficients of the polynomial are:

[0098]

[0099] Corresponding to the element X ( X ) of the original input matrix i, j , i ∈{0,1,...n}, j ∈{0,1,...m-1};

[0100] N is the dimension control parameter of polynomial packing, which is used to define the degree of the polynomial of the homomorphic encryption scheme;

[0101] is the reverse mapping mark of the element in the polynomial in the original input matrix, which ensures that all cross terms are covered in the operation;

[0102] is the forward mapping mark of the element in the polynomial in the original input matrix, which ensures that the element is correctly mapped to the dimension of the model parameter.

[0103] The first polynomial obtained by packing is:

[0104]

[0105] The client uses the fully homomorphic encryption algorithm to encrypt the polynomial is , and the client sends to the server. Among them, the homomorphic encryption can support arbitrary number of addition and multiplication operations on ciphertext. This means that the client's data is always in the form of ciphertext during transmission and storage, and the server cannot obtain the original data content, thereby ensuring data privacy. And the server can complete complex calculation tasks in the ciphertext state through the ciphertext calculation characteristics of homomorphic encryption, without frequent encryption and decryption operations, realizing the completion of matrix multiplication operation without leaking data.

[0106] In the present embodiment, the client encrypts the polynomial using the fully homomorphic encryption algorithm, providing a basis for the server to perform matrix multiplication operations on the ciphertext.

[0107] In some embodiments, first, the server receives the ciphertext input matrix sent by the client The ciphertext input matrix is generated by the client packing the original input matrix into a first polynomial and encrypting the first polynomial based on the fully homomorphic encryption algorithm.

[0108] Thereafter, after receiving , the server packs the model parameter matrix to generate a second polynomial.

[0109] In other words, the server also packs the local model parameter matrix W into a polynomial: the server matrix is m, k ,

[0110]

[0111] The server packs the polynomial as to obtain the second polynomial .

[0112] In other words, the server also packs the local model parameter matrix W into a polynomial: the server model parameter matrix W is m, k , m is the number of rows of the server local model parameter matrix W, k is the number of columns of the server local model parameter matrix W.

[0113]

[0114] In the formula, i, j is the calculation row, corresponding to the element of the local model parameter matrix W, i ∈{0,1,... m -1}, j ∈{0,1,... k -1};

[0115] The server packs the polynomial as to obtain the second polynomial .

[0116] Next, the server performs a matrix multiplication operation on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and sends the ciphertext product matrix to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and verifies the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain a valid target operation result.

[0117] Specifically, server-side computing Since fully homomorphic encryption supports ciphertext multiplication operations, this calculation process is completed in the ciphertext state, and the server can perform matrix multiplication operations without decryption.

[0118] After the calculation is completed, the server decodes the packed ciphertext matrix to obtain the result of the ciphertext product matrix Enc (T) :

[0119]

[0120] Among them, the ciphertext product matrix The original operation result including the original input matrix { , } and the expanded row results .

[0121] Server sends To the client.

[0122] In this embodiment, the ciphertext calculation characteristics of homomorphic encryption are used to complete matrix multiplication operations without leaking data.

[0123] In step 106, the ciphertext product matrix is ​​decrypted to obtain a plaintext product matrix.

[0124] The client receives the ciphertext product matrix sent by the server After that, the ciphertext product matrix is ​​decrypted to obtain the plaintext product matrix including the original operation result and the amplified row result { }, among which, the front n- The first row is the original operation result of the original input matrix, the n The line is ahead n- The sum of 1 row is used for verification. After homomorphic hash verification, the client can confirm the correctness of the result and use it.

[0125] As an example, the client decrypts the matrix product result T: { }=Dec( Enc(T) ).

[0126] As an example, the client uses the public key to polynomial Performing homomorphic encryption, the client receives the ciphertext product matrix returned by the server Then, the plaintext product matrix T is decrypted using the private key corresponding to the public key, ensuring that only the client can obtain the original operation result.

[0127] In step 108, the validity of the plaintext product matrix is verified based on the commitment and the homomorphic hash function, obtaining the valid target operation result.

[0128] After the client decrypts the plaintext product matrix T, the validity of the result needs to be verified.

[0129] Homomorphic encryption allows direct algebraic operations, such as addition and multiplication, on encrypted data. After the operation on the ciphertext, the result is equivalent to the result of the corresponding operation on the original plaintext after decryption. Therefore, the client verifies the validity of the matrix product result based on the homomorphic hash and commitment.

[0130] In some embodiments, the validity of the plaintext product matrix is verified based on the commitment and the homomorphic hash function, including:

[0131] The commitment sent by the server is verified to verify the validity of the commitment;

[0132] If the verification is passed, the validity of the plaintext product matrix is verified based on the homomorphic hash function, obtaining the valid target operation result.

[0133] The client verifies the commitment sent by the server, which includes a set of model parameter hash values and a set of parameter commitment values, and confirms that the model parameters have not been tampered with by executing the commitment function.

[0134] As an example, the commitment sent by the server is verified to verify the validity of the commitment, including:

[0135] Based on the set of model parameter hash values and the set of parameter commitment values, a verification function of the commitment scheme is called to re-determine the commitment value;

[0136] The re-determined commitment value is compared with the set of parameter commitment values sent by the server element by element;

[0137] If the comparison result is consistent, it is determined that the commitment is valid, and the commitment is valid to indicate that the model parameter matrix has not been changed in the matrix multiplication operation.

[0138] If the verification is not passed, the plaintext product matrix is rejected and the process is ended.

[0139] The client receives the parameter commitment value sent by the server , parameter hash value and random number .

[0140] re-determine the commitment value by calling the verification function of the commitment scheme . .

[0141] compare the re-computed with the c i sent by the server, if the comparison result is consistent, it is determined that the commitment is valid, and the commitment is valid for indicating that the model parameter matrix has not been changed in the matrix multiplication operation. This is because the model parameter hash value h i sent by the server is one-to-one corresponding to the original model parameter w i , that is h i = LHH.hash( w i ). Therefore, the validity of the commitment is verified:

[0142]

[0143] If the above equation is 1, it is proved c i is indeed w i a valid commitment, that is, the server has not tampered with the parameters, and the client believes that the commitment of the server is valid. If the above equation! = 1, the client rejects the reasoning result of the server. Or terminate the current reasoning process, send an error prompt to the server.

[0144] The commitment scheme ensures the integrity of the model parameters provided by the server, which lays the foundation for the reliability of subsequent calculations.

[0145] Next, after verification, the validity of the plaintext product matrix is verified based on the homomorphic hash function, and the valid target operation result is obtained.

[0146] In some embodiments, if the verification is passed, the validity of the plaintext product matrix is verified based on the homomorphic hash function, and the valid target operation result is obtained, including:

[0147] Perform algebraic operation on the model parameter hash value set and the original data of the augmented row to obtain an expected hash value;

[0148] Hash calculation is performed on the augmented row result to obtain an actual hash value;

[0149] If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is valid, and the original operation result is determined as the target operation result.

[0150] As an example, the plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the augmented row result.

[0151] The homomorphic hash verification ensures the correctness of the ciphertext matrix multiplication calculation process and the non-forgery of the result by the server through the hash consistency of the augmented row result.

[0152] Specifically, the client calculates the actual hash value of the augmented row result, and simultaneously calculates the expected hash value based on the model parameter hash value set sent by the server and verified by the commitment, and the original data of the augmented row held locally by the client using the Eval function of the homomorphic hash. h i X n If the two hash values are equal, it can be proved that the result of the plaintext product matrix is correct. That is:

[0153] LHH.hash( )==LHH.Eval ( ).

[0154] The specific process is as follows:

[0155] The client performs the following operations through the evaluation function of the homomorphic hash function:

[0156] The model parameter hash value set h i is regarded as the encrypted features of the model parameters, and the augmented row X n data is regarded as known input factors;

[0157] The matrix multiplication operation of the model parameter matrix and the augmented row is simulated, and finally the expected hash value is obtained. It should be noted that it only performs algebraic operations at the hash value level (such as hash value multiplication corresponding to the multiplication of the original parameters and the augmented row elements, and hash value addition corresponding to the sum of the products).

[0158] The client calculates the actual hash value of the augmented row result in the plaintext product matrix, and if it is consistent with the expected hash value, it proves that the matrix multiplication operation is correct, and the client believes that the data of the server is the valid product result. The client uses the original operation result as the target operation result for subsequent reasoning (such as activation function processing and generating the final output).

[0159] If it is not consistent, it means that the result is forged or the operation is incorrect, and the result is rejected.

[0160] ​In this process, the property of homomorphic hashing is utilized, that is, the hash operation of the result is consistent with the result of the operation using the hash value of the original data, thereby realizing the verification of the calculation result without the client obtaining the original model parameters of the server and without exposing all the original data.

[0161] This specification provides a matrix multiplication method, device, and computer-readable storage medium. This method uses homomorphic encryption to package and encrypt the client's original input matrix, allowing the server to perform operations in ciphertext, thereby protecting the client's data privacy. Subsequently, the results of the server-side matrix multiplication are verified using homomorphic hashing, leveraging the homomorphism of encryption operations. The two form a closed loop using polynomial packing technology, effectively ensuring client data security and the verifiability of inference results. Furthermore, through the dual verification of commitment verification and result verification, the accuracy of the target operation results is ensured.

[0162] The following is an embodiment of a matrix multiplication operation method provided in this specification. The matrix multiplication operation method is applied to the server side of the above-mentioned large model reasoning system.

[0163] like Figure 3 As shown, Figure 3 1 is a flowchart of a matrix multiplication method according to an exemplary embodiment of the present specification, comprising the following steps:

[0164] In step 201, a cryptographic commitment is generated for the model parameter matrix and sent to the client.

[0165] In some embodiments, generating a cryptographic commitment to a model parameter matrix and sending it to the client includes:

[0166] Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values;

[0167] Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number;

[0168] The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

[0169] The server first calculates the local private model parameter matrix W=[ ] Make a commitment:

[0170]

[0171] The server will Sent to the client.

[0172] In step 203, a second polynomial is generated by packing the model parameter matrix.

[0173] The server packs and encrypts the local model parameter matrix:

[0174]

[0175] The server packs the polynomial as .

[0176] In step 205, the ciphertext input matrix sent by the client is received, which is generated by packing the original input matrix into a first polynomial by the client and encrypting the first polynomial based on a fully homomorphic encryption algorithm.

[0177] The server receives the polynomial encrypted by the client using the fully homomorphic encryption algorithm to obtain Enc(P(x)) .

[0178] In step 207, matrix multiplication is performed on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and the ciphertext product matrix is sent to the client for decryption by the client to obtain a plaintext product matrix; and the validity of the plaintext product matrix is verified based on the commitment and homomorphic hash function to obtain the valid target operation result.

[0179] The server calculates The server decrypts the ciphertext matrix to obtain the plaintext product matrix.

[0180] The server sends to the client for validity verification, and verifies the validity of the plaintext product matrix based on the commitment and homomorphic hash function to obtain the valid target operation result.

[0181] The implementation process of each step in the above method is specifically described in the implementation process of the corresponding step in the matrix multiplication method applied to the client of the large model inference system described above, which can achieve the same technical effect, and will not be repeated here.

[0182] Based on the same application concept as the above method, the embodiments of the present application also propose a matrix multiplication device, as shown in Figure 4 .

[0183] The device comprises:

[0184] A receiving module for receiving a cryptographic commitment generated by the server for the model parameter matrix;

[0185] encrypting the original input matrix into a first polynomial, encrypting the first polynomial based on a fully homomorphic encryption algorithm to generate a ciphertext input matrix, and sending the ciphertext input matrix to the server, so that the server performs matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on the model parameter matrix to obtain a ciphertext product matrix sent to the client;

[0186] decrypting the ciphertext product matrix to obtain a plaintext product matrix;

[0187] verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result.

[0188] The implementation process of the functions and roles of the above-mentioned modules / sub-modules / units will be specifically described in the implementation process of the corresponding steps in the above-mentioned method, and the same technical effects can be achieved, which will not be repeated here.

[0189] Figure 5 An example of an entity structure diagram of a matrix multiplication operation device is shown in Figure 5 As shown in the figure, the matrix multiplication operation device can include a processor 510, a communications interface 520, a memory 530, and a communications bus 540, wherein the processor 510, the communications interface 520, and the memory 530 communicate with each other through the communications bus 540. The processor 510 can invoke the logic instructions in the memory 530 to execute the matrix multiplication operation method.

[0190] In addition, the logic instructions in the memory 530 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various storage medium that can store program codes.

[0191] In another aspect, the present application also provides a computer program product, which comprises a computer program, the computer program can be stored on a non-transitory computer readable storage medium, and the computer program is executed by a processor, so that the computer can perform the matrix multiplication operation method provided by the above-mentioned methods.

[0192] In another aspect, the present application also provides a non-transitory computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the matrix multiplication operation method provided by the above-mentioned methods.

[0193] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0194] Other embodiments of the present specification will be apparent to those skilled in the art upon consideration of the specification and practice of the applications disclosed herein. The present specification is intended to cover any variations, uses or adaptations of the present specification following, in general, the principles of the present specification and including such departures from the present specification as come within the known and customary practice in the art to which the present specification pertains or the likes. The specification and examples are to be considered exemplary only, with the true scope and spirit of the present specification being indicated by the following claims.

[0195] It should be understood that the present specification is not limited to the precise structures as herein described and illustrated in the drawings, and that various modifications and changes can be made without departing from the scope thereof. The scope of the present specification is limited only by the claims that follow.

[0196] The above only describes the preferred embodiments of the present specification and is not intended to limit the present specification, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the protection scope of the present specification.

Claims

1. A matrix multiplication method, characterized in that: The method comprises: Receive the server's cryptographic commitment to the model parameter matrix; Packing the original input matrix into a first polynomial, encrypting the first polynomial based on a fully homomorphic encryption algorithm to generate a ciphertext input matrix, and sending the ciphertext input matrix to the server, so that the server performs a matrix multiplication operation on the ciphertext input matrix and a second polynomial generated based on the packaged model parameter matrix, to obtain a ciphertext product matrix sent to the client; Decrypting the ciphertext product matrix to obtain a plaintext product matrix; Verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result; The verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result includes: verifying the commitment sent by the server to verify the validity of the commitment; The commitment sent by the server includes a model parameter hash value set and a parameter commitment value set; and verifying the validity of the commitment sent by the server includes: Based on the model parameter hash value set and the parameter commitment value set, the verification function of the commitment scheme is called to redetermine the commitment value; the redetermined commitment value is compared element by element with the parameter commitment value set sent by the server; if the comparison results are consistent, the commitment is determined to be valid, and the validity of the commitment is used to indicate that the model parameter matrix has not been changed in the matrix multiplication operation.

2. The matrix multiplication method according to claim 1, wherein: The step of packing the original input matrix into a first polynomial comprises: Performing an amplification process on the original input matrix, adding an amplification row below the original calculation row of the original input matrix, wherein the amplification row is used to verify the validity of the plaintext product matrix through the homomorphic hash function; The original input matrix and the augmented rows are packed into a polynomial to obtain a first polynomial.

3. The matrix multiplication method according to claim 2, wherein: After verifying the validity of the commitment sent by the server, the method further includes: If the verification is successful, the validity of the plaintext product matrix is ​​verified based on the homomorphic hash function to obtain a valid target operation result.

4. The matrix multiplication method according to claim 3, wherein: The plaintext product matrix includes the plaintext of the original operation result of the original input matrix and the expanded row result; If the verification is successful, verifying the validity of the plaintext product matrix based on the homomorphic hash function to obtain a valid target operation result includes: Performing an algebraic operation on the model parameter hash value set and the original data of the amplified row to obtain an expected hash value; Performing hash calculation on the amplified row result to obtain an actual hash value; If the actual hash value is consistent with the expected hash value, it is determined that the plaintext product matrix is ​​valid, and the original operation result is determined to be the target operation result.

5. The matrix multiplication method according to claim 3, wherein: The method further comprises: If the verification fails, the plaintext product matrix is ​​rejected and the process ends.

6. A matrix multiplication method, characterized in that: The method comprises: Generate a cryptographic commitment to the model parameter matrix and send it to the client; Receive a ciphertext input matrix sent by the client, where the ciphertext input matrix is ​​generated by the client packaging an original input matrix into a first polynomial and encrypting the first polynomial based on a fully homomorphic encryption algorithm; A second polynomial generated by packaging the model parameter matrix; Performing a matrix multiplication operation on the ciphertext input matrix and the second polynomial to generate a ciphertext product matrix, and sending the ciphertext product matrix to the client so that the client can decrypt the ciphertext product matrix to obtain a plaintext product matrix; and verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result; The verifying the validity of the plaintext product matrix based on the commitment and the homomorphic hash function to obtain a valid target operation result includes: verifying the commitment sent by the server to verify the validity of the commitment; The commitment sent by the server includes a model parameter hash value set and a parameter commitment value set; and verifying the validity of the commitment sent by the server includes: Based on the model parameter hash value set and the parameter commitment value set, the verification function of the commitment scheme is called to redetermine the commitment value; the redetermined commitment value is compared element by element with the parameter commitment value set sent by the server; if the comparison results are consistent, the commitment is determined to be valid, and the validity of the commitment is used to indicate that the model parameter matrix has not been changed in the matrix multiplication operation.

7. The matrix multiplication method according to claim 6, wherein: The cryptographic commitment generated for the model parameter matrix and sent to the client includes: Applying a homomorphic hash function to each parameter element in the model parameter matrix to generate a set of model parameter hash values; Generate a set of corresponding parameter commitment values ​​through a cryptographic commitment scheme, where each commitment value is bound to a parameter element and a random number; The model parameter hash value set, parameter commitment value set and random number are packaged and sent to the client.

8. A computer device, characterized in that: A method for performing matrix multiplication according to claim 1, comprising: a memory, a processor, and a matrix multiplication operation program stored in the memory and executable on the processor, wherein the processor executes the matrix multiplication operation program to implement the steps of the matrix multiplication operation method according to any one of claims 1 to 5, and / or It includes a memory, a processor and a matrix multiplication operation program stored in the memory and capable of running on the processor. When the processor executes the matrix multiplication operation program, the steps of the matrix multiplication operation method as described in any one of claims 6 to 7 are implemented.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a matrix multiplication operation program, which, when executed, implements the steps of the matrix multiplication operation method according to any one of claims 1 to 5, and / or The computer-readable storage medium stores a matrix multiplication operation program, which, when executed, implements the steps of the matrix multiplication operation method according to any one of claims 6 to 7.

Images