Medical privacy protection method based on zero-knowledge deep learning

Abstract

The invention belongs to the crossing field of medical information technology and privacy calculation, and particularly relates to a medical privacy protection method based on zero-knowledge deep learning, which comprises the following steps: constructing a medical privacy protection system comprising a client and a doctor side, and deploying a zero-knowledge neural network model based on an improved zkReLU activation function at the doctor side; the patient end receives physiological data input by a patient, carries out sensitivity grading on the physiological data, and encrypts the physiological data with different sensitivities by adopting different algorithms to obtain encrypted data; inputting the encrypted data into a zero-knowledge neural network model for forward propagation to obtain a middle-layer zero-knowledge proof; the patient terminal initiates a diagnosis result query request, and the doctor terminal integrates the intermediate layer zero-knowledge proof to generate an aggregate zero-knowledge proof to wait for verification; the verifier verifies the correctness of the aggregated zero-knowledge proof through the verification public key, and confirms that the diagnosis result accords with a preset rule and the irrelevant privacy of the patient is not leaked; local decryption of high-sensitivity data and encryption reasoning of low-sensitivity data are realized, and the leakage risk is eliminated.

Description

Technical Field

[0001] The present invention belongs to the intersection of medical information technology and privacy computing, and specifically relates to a medical privacy protection method based on zero-knowledge deep learning. Background Art

[0002] With the in-depth application of artificial intelligence technology in the medical field, deep learning models have demonstrated significant advantages in disease diagnosis, image analysis, and personalized treatment. However, the privacy sensitivity of medical data poses a severe challenge to existing technologies. Traditional medical data privacy protection methods mostly rely on static encryption and access control, which cannot adapt to the dynamic computing environment required by deep learning. For example, conventional encryption technologies (such as AES and RSA) require data decryption before model inference, resulting in the exposure of patient privacy in the cloud or on third-party servers; although fully homomorphic encryption (FHE) supports secret state operations, its high computational overhead and incompatibility with nonlinear activation functions make real-time medical diagnosis difficult to achieve. In addition, existing zero-knowledge proof (ZKP) schemes are unable to efficiently handle the nonlinear structure and million-level parameter scale of deep neural networks, resulting in verification time that increases exponentially with network complexity, seriously restricting their practicality in medical scenarios.

[0003] The core contradiction in the current medical privacy protection system lies in balancing data security and computational efficiency. On the one hand, medical regulations (such as GDPR and HIPAA) require strict adherence to the principle of "data minimization," prohibiting unauthorized parties from accessing raw patient data. On the other hand, the complex computational characteristics of deep neural networks make it difficult for traditional privacy computing solutions to achieve both real-time performance and verifiability. For example, while Verifiable Computing (VC) technology is relatively mature for small-scale linear models, its arithmetic circuit design is not suitable for nonlinear operations such as sign determination of the ReLU activation function and gradient backpropagation. Furthermore, third-party audit mechanisms require direct access to model parameters or intermediate results, posing risks of privacy leakage and tampering. These shortcomings make it difficult for existing systems to meet the dual requirements of end-to-end privacy protection and efficient verification in medical scenarios. Summary of the Invention

[0004] To solve the above problems, the present invention provides a medical privacy protection method based on zero-knowledge deep learning, which adopts an innovative architecture that integrates hierarchical encryption, zero-knowledge proof and parallel acceleration, aiming to achieve privacy controllable and efficient verification of medical data in the entire deep learning process.

[0005] Specific plans include:

[0006] S1. Build a medical privacy protection system that includes both the client and doctor sides, and deploy a zero-knowledge neural network model based on the improved zkReLU activation function on the doctor side;

[0007] The improved zkReLU activation function includes: decomposing the nonlinear operation of the ReLU activation function into two parts: sign bit verification and numerical calculation, and introducing polynomial constraints to achieve arithmetic circuit compatibility; the polynomial constraints are

[0008] sign(x)∈{0,1},

[0009] sign(x)·x≥0,

[0010] (1-sign(x))·x<0,

[0011] sign(x) represents the sign bit of the input value x of the improved zkReLU activation function;

[0012] S2. The patient receives the physiological data input by the patient and classifies its sensitivity. Different algorithms are used to encrypt the physiological data of different sensitivities to obtain encrypted data.

[0013] If the physiological data is highly sensitive, it is encrypted using a fully homomorphic encryption algorithm; if the physiological data is low-sensitivity, it is encrypted using an attribute-based encryption algorithm;

[0014] S3. Input the encrypted data into the zero-knowledge neural network model for forward propagation to obtain the intermediate layer zero-knowledge proof;

[0015] S4. The patient initiates a diagnosis result query request, and the doctor integrates the intermediate layer zero-knowledge proof to generate an aggregated zero-knowledge proof for verification; the verifier verifies the correctness of the aggregated zero-knowledge proof by verifying the public key, confirming that the diagnosis result complies with the preset rules and does not leak the patient's privacy.

[0016] Furthermore, the zero-knowledge neural network model in step S1 further includes:

[0017] S11. Generate the verification equation through the Schwartz-Zippel lemma, expressed as

[0018]

[0019] Among them, Z'=|Z| is the absolute value of the pre-activation value Z, S Z is the symbolic tensor of the pre-activation value Z, r represents a random number, A represents the commitment value, G Z , G A represents the generator matrix;

[0020] S12. Stack the same type of tensor operations in the neural network into a three-dimensional tensor and generate a compression proof through random linear combination;

[0021] S13. Dynamic reconstruction of the zero-knowledge proof circuit after model parameter update, synchronous update of verification public key pkverify :

[0022]

[0023] in, Represents the verification public key before update, △W represents the parameter increment, and H() represents the hash function.

[0024] Furthermore, step S12 includes:

[0025] Input tensor X for N identical operations (0) ,…,X (N-1) , and the output tensor Y, construct the aggregation tensor and in, is a set, D1 represents the index set of the weight tensor, D2 represents the index set of the input tensor, and D3 represents the index set of the output tensor;

[0026] Using random vectors and Generate compression proof

[0027]

[0028] Among them, u1 and u3 represent random vectors, Indicates the length is A set of binary strings, i represents the position index, β(w,i) represents the weight index parameter function, represents the value of the input tensor at position i in the j-th operation, Represents the value of the output tensor at position i in the j-th operation; For the collection, Denotes the aggregate output function of the compression proof, D out A collection of indices representing random output tensors.

[0029] Furthermore, step S3 specifically includes:

[0030] S31. Load the pre-trained zero-knowledge neural network model, ensure that the model parameters are bound to the verification public key through Pedersen commitment, and initialize the constraint parameters of the improved zkReLU activation function;

[0031] S32. Perform format conversion on the encrypted data to adapt the input tensor structure of the zero-knowledge neural network model;

[0032] S33. Perform layer-by-layer forward propagation on the encrypted data after format conversion. During the propagation process, the homomorphic encryption algorithm is used to ensure that the output of each layer remains encrypted. The output of each layer includes the commitment value A, the pre-activation value Z, the symbol tensor SZ and the gradient tensor;

[0033] S34. Encode the output of each layer into a multidimensional tensor and generate Pedersen commitments bound to public parameters. Convert tensor operations into arithmetic circuits based on multilinear expansion, execute and verify the protocol, and then generate a compressed proof. Batch process cross-layer constraints through CUDA parallel computing; use GPU to accelerate multi-threaded execution and verification protocol.

[0034] Furthermore, during the propagation process, an improved zkReLU activation function is used for each layer of neurons, including linear region verification, nonlinear region verification and gradient reverse constraint;

[0035] Linear region verification includes directly outputting the original value when the input value is non-negative;

[0036] Nonlinear region verification includes that when the input value is negative, the output is zero, and the sign bit is introduced to verify the sign tensor S Z =sign(Z);

[0037] The gradient back constraint consists of binding the input gradient G Z With the activation gradient G A , ensuring the correctness of back propagation, expressed as

[0038] Furthermore, step S4 includes:

[0039] S41. The patient initiates a diagnostic result query request, which includes an encrypted data identifier and a privacy statement C; the privacy statement C is encoded as a public input embedded in a zero-knowledge proof circuit to obtain a proof fingerprint Hash(π);

[0040] S42. Write the data fingerprint Hash (Xone), proof fingerprint Hash (π) and encrypted data into the block through the smart contract.

[0041] Furthermore, the privacy statement C includes the scope of diagnostic results that are allowed to be disclosed, the privacy fields that are prohibited from being disclosed, and the model reasoning compliance rules; Step S41 converts the privacy statement C into a public input and encodes the scope of diagnostic results that are allowed to be disclosed as a range parameter y min 、y max , the binary mask matrix M formed by the privacy fields that are prohibited from being leaked is serialized into a binary vector; the logical expression Φ(y) of the model reasoning compliance rule is compiled into Boolean logic gates to generate the constraint condition Verify(C,y):

[0042]

[0043] Among them, y∈[y min ,ymax ] indicates that the diagnosis result y is within the authorized range, Indicates that the sensitive field is masked, and Φ(y)=1 indicates that the diagnosis result y complies with medical rules.

[0044] Furthermore, step S4 further includes:

[0045] Using recursive SNARK technology, the intermediate layer zero-knowledge proofs of all layers of the zero-knowledge neural network model are compressed into aggregated zero-knowledge proofs;

[0046] When the patient initiates a diagnosis result query request, the doctor adjusts the parameter ΔW to trigger the zero-knowledge proof circuit to dynamically reconstruct and update the verification public key. The doctor uses the updated verification public key to obtain the aggregated zero-knowledge proof, and the verifier uses the updated verification public key to verify.

[0047] Beneficial effects of the present invention:

[0048] This invention processes medical data in a hierarchical manner based on sensitivity. Highly sensitive data (such as gene sequences and CT images) is encrypted using fully homomorphic encryption (BGV) technology, ensuring it remains in ciphertext during the neural network's forward propagation. Low-sensitivity data (such as age) is dynamically accessed using attribute-based encryption (CP-ABE), allowing it to be decrypted only under authorized circumstances. This allows for local decryption of highly sensitive data and encrypted inference of low-sensitivity data, eliminating the risk of data leakage.

[0049] On this basis, the improved zkReLU activation function reconstructs the nonlinear activation function, decomposing it into linear and nonlinear regions. Polynomial constraints are then constructed to bind the input and output tensors, thereby generating a verifiable zero-knowledge proof. This addresses the core issue of traditional ZKP schemes that cannot handle nonlinear computations. The improved zkReLU activation function ensures the irreversibility of intermediate values ​​in model operations, achieving zero privacy leakage in GDPR testing.

[0050] This invention adopts layered compression and parallel circuit design to reduce the single-step proof time of a 16-layer network from 3 minutes to 0.8 seconds, and the proof volume is reduced to 1 / 3. Combined with CUDA acceleration technology, it realizes real-time inference of a 200M parameter model with a throughput of 1200 times / second.

[0051] Through the statement-response mechanism, patient privacy statements are encoded as public inputs. Combined with blockchain evidence storage and recursive SNARK verification, the model output is forced to contain only authorized information. Dynamic compliance audits and 1-second verification delay are supported. End-to-end verification of an 8-layer network takes less than 0.9 seconds, increasing efficiency by 40 times. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0053] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0054] The present invention provides a medical privacy protection method based on zero-knowledge deep learning, such as Figure 1 As shown, the following steps are included:

[0055] S1. Build a medical privacy protection system including the client and doctor sides, and deploy a zero-knowledge neural network model based on the improved zkReLU activation function on the doctor side.

[0056] Specifically, the improved zkReLU activation function decomposes the nonlinear operation of the traditional ReLU activation function into two parts: sign bit verification and numerical calculation, which are used to process the nonlinear region (i.e., when the input value x is less than 0) and the linear region (i.e., when the input value x is greater than or equal to 0). Among them, the sign bit verification corresponds to the nonlinear region, and is used to verify that the sign bit sign(x) = 0 to ensure that the input value x is in the nonlinear region, preventing attackers from forging the sign of the input value x, thereby destroying the correctness of the activation function or leaking private information. The numerical calculation corresponds to the linear region, and does not require complex sign bit verification, and only the results of the numerical calculation need to be retained.

[0057] Based on the above analysis, the present invention generates a polynomial constraint integrated into the zero-knowledge proof circuit, so that the forward propagation process of the neural network can be verified without leaking the input data; the polynomial constraint is

[0058] sign(x)∈{0,1}(1)

[0059] sign(x)·x≥0 (2)

[0060] (1-sign(x))·x<0 (3)

[0061] sign(x) represents the sign bit of the input value x of the improved zkReLU activation function. Formula (1) represents the forced decomposition of the sign bit into a binary value, converting the determination of the sign bit into a discrete variable constraint that can be processed by the arithmetic circuit, and is compatible with the circuit design of zero-knowledge proof. Formula (2) is used to ensure that the product of the sign bit and the input value is non-negative, to prevent attackers from tampering with the output of the activation function by forging the sign bit. Formula (3) is used to verify the correctness of the input value in the nonlinear region. Among them, when x<0, sign(x)=0, when x≥0, sign(x)=1; in addition, when x<0, the output of the improved zkReLU activation function is 0, and when x≥0, the output of the improved zkReLU activation function is the original value. The three constraints are defined by the binary sign bit, forward verification (linear region verification) and reverse verification (nonlinear region verification), which jointly ensure the verifiability and security of the improved zkReLU in zero-knowledge circuits.

[0062] Specifically, the zero-knowledge neural network model in step S1 further includes:

[0063] S11. Generate the verification equation through the Schwartz-Zippel lemma to ensure the correctness of the ReLU calculation:

[0064]

[0065] Where Z represents the pre-activation value, which refers to the original data that needs to be protected; Z'=|Z| represents the absolute value of the pre-activation value Z, which is the target value for verifying the correctness of the calculation; S Z A symbolic tensor representing the pre-activation value Z, r represents the random number of random point sampling to construct the Schwartz-Zippel lemma, A represents the commitment value (or auxiliary tensor), which is used to confuse the real input and prevent information leakage; G Z , G A Represents the generator matrix, also known as the gradient tensor, which is used to encode tensor operations into polynomial form.

[0066] S12. Stacking tensor operations of the same type in neural networks into three-dimensional tensors and generating compression proofs through random linear combinations.

[0067] Specifically, in different layers and training steps of a neural network, there are some computational units with identical structures and fixed parameters, such as matrix multiplication, convolution kernels, activation functions, etc. The present invention stacks the tensor operations of the same type of computational units into a three-dimensional tensor and generates a compression proof through random linear combination. The specific operations include:

[0068] Input tensor X for N identical operations (0) ,…,X (N-1) , and the output tensor Y, construct the aggregation tensor and in, is a set, D1 represents the index set of the weight tensor, D2 represents the index set of the input tensor, and D3 represents the index set of the output tensor; it should be noted that Y is X (0) ,…,X (N-1) The result obtained by inputting the same operation together.

[0069] Using random vectors and Generate the compression proof as follows

[0070]

[0071] Among them, u1 and u3 represent random vectors, Indicates the length is A set of binary strings, i represents the position index, β(w,i) represents the weight index parameter function, represents the value of the input tensor at position i in the j-th operation, Represents the value of the output tensor at position i in the j-th operation; For the collection, Denotes the aggregate output function of the compression proof, D out A collection of indices representing random output tensors.

[0072] In the above operations, the purpose of constructing an aggregate tensor is to merge multiple independent proofs of the same operation into one aggregate proof, avoiding repeated verification, reducing the number of verifications and storage overhead. For example, the input X of 100 convolution operations is (0) ,…,X (99) Stacked into a three-dimensional tensor X∈T 100×H×W , H and W are the height and width of the input. Compressed proofs further reduce the proof size through techniques such as randomized linear combinations, reducing the proof size from O(N) to O(1)O. The mathematical principle behind this is the Schwartz-Zippel lemma, which guarantees with high probability that the compressed proof represents the correctness of the original N operations. Combining the construction of aggregate tensors and compressed proofs improves efficiency.

[0073] Assume an aggregate proof scenario in a medical diagnosis: the doctor performs the same convolution operation (3×3 convolution kernel) on the encrypted CT images of 100 patients.

[0074] X (j) : encrypted image of the jth patient;

[0075] Y (j) : Encrypted feature map after convolution;

[0076] u1, u3: randomly generated 256-dimensional vectors;

[0077] β(w,i): Binding parameter between convolution kernel weight w and position i;

[0078] Input: Input X of N operations (j) and output Y (j) ;

[0079] Aggregation: construct X, Y;

[0080] Compression: generated by u1 and u3

[0081] Verification: Check Whether the polynomial constraints defined by β(w,i) are satisfied to ensure the correctness of all operations.

[0082] S13. Dynamic reconstruction of the zero-knowledge proof circuit after model parameter update, synchronous update of verification public key pk verify , ensuring that the update process is traceable and zero-knowledge is not destroyed. The update formula is:

[0083]

[0084] in, Represents the verification public key before update, △W represents the parameter increment, and H() represents the hash function.

[0085] S2. The patient end receives the physiological data input by the patient, and classifies the sensitivity of the data according to privacy protection regulations and data sensitivity. Different algorithms are used to encrypt physiological data of different sensitivities to obtain encrypted data.

[0086] Specifically, if the physiological data is highly sensitive data, it is encrypted using a fully homomorphic encryption algorithm; if the physiological data is low-sensitivity data, it is encrypted using an attribute-based encryption algorithm; ensuring that the input physiological data is only decrypted locally on the patient side to complete data hierarchical encryption, and then the patient side synchronizes the encrypted data and metadata to the doctor side, triggering the initialization process of the zero-knowledge neural network model.

[0087] S3. The encrypted data is fed into the zero-knowledge neural network model for forward propagation. After each layer of computation, a zero-knowledge proof for the intermediate layer is generated (using the Schwartz-Zippel lemma to verify the polynomial equality), ensuring that neither the input data nor sensitive information in the intermediate layers is leaked during the computation. After inference is complete, the system temporarily stores the encrypted diagnosis results, awaiting query requests from the patient.

[0088] Specifically, step S3 includes:

[0089] S31. Load the pre-trained zero-knowledge neural network model, ensure that the model parameters are bound to the verification public key via Pedersen commitments, and initialize the constraint parameters of the improved zkReLU activation function. Note that encrypted data must remain confidential during transmission and loading.

[0090] S32. Perform format conversion on the encrypted data to adapt the input tensor structure of the zero-knowledge neural network model.

[0091] S33. Perform layer-by-layer forward propagation on the encrypted data after format conversion, including arithmetic operations such as convolution and matrix multiplication; during the propagation process, a homomorphic encryption algorithm is used to ensure that the output of each layer remains encrypted. The output of each layer includes the commitment value A, the pre-activation value Z, the sign bit S Z and the gradient tensor.

[0092] S34. Each layer's output is encoded as a multidimensional tensor and Pedersen commitments are generated and bound to public parameters. Tensor operations are converted into arithmetic circuits based on multilinear expansion, and the protocol is executed and verified. A compressed proof is then generated. Cross-layer constraints are batched using CUDA parallel computing. Similar tensors from different layers are stacked into higher-order tensors to reduce repeated computations. Finally, GPUs are used to accelerate multi-threaded execution and verification of the protocol, optimizing proof generation time.

[0093] Public parameters are publicly available data tied to cryptographic protocols. Core components include generators, domain parameters, and hash functions, used to construct and verify Pedersen commitments. In multidimensional tensor scenarios, these parameters may be expanded to structured generator matrices to accommodate high-dimensional data binding. Their core value lies in ensuring computational verifiability, data integrity, and privacy.

[0094] Specifically, during the propagation process, the improved zkReLU activation function is used for each layer of neurons, including linear region verification, nonlinear region verification and gradient reverse constraint;

[0095] Linear region verification includes directly outputting the original value when the input value is non-negative;

[0096] Nonlinear region verification includes that when the input value is negative, the output is zero, and the sign bit is introduced to verify the sign tensor S Z =sign(Z);

[0097] The gradient back constraint consists of binding the input gradient G Z With the activation gradient G A , ensuring the correctness of back propagation, expressed as

[0098] The specific process of step S34 is shown in Table 1.

[0099] Table 1 Process stage table

[0100]

[0101] To ensure zero-knowledge security, the Schwartz-Zippel lemma ensures that random sampling during the verification process cannot infer the original data or intermediate results. All intermediate tensors are stored as Pedersen commitments, with decryption performed only locally on the patient's end. In the verification protocol, the verifier verifies the validity of the compressed proof using the public key: first, the consistency of the Pedersen commitment and the multilinear extension is verified, and then the polynomial constraint is confirmed through a sum-check protocol. Finally, the encrypted diagnosis results that pass verification are output only to the patient, ensuring data privacy and result credibility.

[0102] S4. The patient initiates a diagnosis result query request, and the doctor integrates the intermediate layer zero-knowledge proof to generate an aggregated zero-knowledge proof for verification; the verifier verifies the correctness of the aggregated zero-knowledge proof by verifying the public key, confirming that the diagnosis result complies with the preset rules and does not leak the patient's privacy.

[0103] Specifically, step S4 includes:

[0104] S41. The patient initiates a diagnosis result query request, which includes an encrypted data identifier and a privacy statement C. The privacy statement C is encoded as a public input and embedded in a zero-knowledge proof circuit to obtain a proof fingerprint Hash(π).

[0105] Specifically, the privacy statement C includes the scope of diagnostic results that are allowed to be disclosed, privacy fields that are prohibited from being disclosed, and model reasoning compliance rules; the generation of privacy statement C and the scope constraint of the content results refer to the range of diagnostic results that are allowed to be disclosed, such as the tumor probability interval [0%, 100%]; the privacy field mask is the privacy field that is prohibited from being disclosed, such as the patient's ID number and gene sequence; the location of sensitive fields is identified by the binary mask matrix M; the model reasoning compliance rules are defined by the logical expression Φ(y), such as the results must comply with medical guidelines and multi-indicator joint judgment.

[0106] In step S41, the tuple of the privacy statement C is converted into a public input format, adapted to the input interface of the zero-knowledge proof circuit, and the range constraint is encoded as a range parameter y min 、y max , the binary mask matrix M is serialized into a binary vector; the logical expression Φ(y) is compiled into Boolean logic gates that can be recognized by the arithmetic circuit, and then the constraint condition Verify(C,y) is generated through circuit constraint binding:

[0107]

[0108] Among them, y∈[y min ,y max ] indicates that the diagnosis result y is within the authorized range, Indicates that the sensitive field is masked (the corresponding position result is 0), and Φ(y)=1 indicates that the diagnosis result y complies with medical rules (such as the joint judgment of multiple indicators is true).

[0109] The doctor generates a zero-knowledge proof based on the privacy statement C, proving that the diagnosis result y satisfies all constraints. The doctor then uses polynomial commitments to bind public inputs and circuit parameters, ensuring that the verification process cannot be tampered with. The verifier then verifies the polynomial equality using the Schwartz-Zippel lemma, confirming that the hash value of the mask matrix M is consistent with the privacy statement C to verify the legitimacy of the proof. Finally, the verifier outputs only the result of Verify(C,y)=1, while the remaining fields are encrypted or set to zero.

[0110] S42. The data fingerprint Hash (Xone), proof fingerprint Hash (π), and encrypted data are written to the block through a smart contract. The data fingerprint is bound to the original encrypted data, and the proof fingerprint is bound to the verification process. That is, the final verification record that integrates public input, verification results, and other metadata is written to the block, achieving tamper-proof audit traceability. Patients can verify the validity of on-chain records through a lightweight client without relying on third-party institutions. The data fingerprint Hash (Xone) is generated by encrypting physiological data or by processing encrypted data on the doctor's end.

[0111] S43. To achieve low-latency verification and dynamic model adaptation in medical scenarios, the system achieves dual optimization through a recursive zero-knowledge proof architecture and an incremental update mechanism. Specifically, recursive SNARK technologies such as Plonk / Halo2 are used to compress the verification process of multi-layer neural networks into a single proof:

[0112] π final =RecursiveSNARK(π1,π2,...,π L )

[0113] Among them, π final RecursiveSNARK() represents the recursive zero-knowledge proof generation function, π1,π2,…,π L Represents the set of intermediate layer zero-knowledge proofs generated by each layer of the neural network (L is the total number of network layers).

[0114] The neural network architecture used in the test scenario consists of eight sequentially connected computational layers: input layer → convolutional layer 1 → zkReLU → convolutional layer 2 → zkReLU → convolutional layer 3 → zkReLU → fully connected layer → output layer. By parallelizing the polynomial commitment computations within the verification circuit, the verification time complexity is reduced from O(L) in traditional solutions to O(logL). Experimental data shows that the delay in verifying diagnostic results for the eight-layer network is reduced from 3.2 seconds to 0.8 seconds, meeting the real-time requirements of emergency scenarios.

[0115] At the same time, the system supports seamless compatibility after dynamic model updates: when the doctor adjusts the parameter ΔW, the incremental proof generation process is automatically triggered, and only the zero-knowledge circuit is reconstructed for the parameter change part to generate a lightweight incremental proof π Δ (Generation time 0.2 seconds), and bind the new and old public keys through the hash chain:

[0116]

[0117] In the present invention, unless otherwise clearly stipulated and limited, the terms "installation", "setting", "connection", "fixation", "rotation" and the like should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can be the internal connection of two elements or the interaction relationship between two elements. Unless otherwise clearly defined, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to the specific circumstances.

[0118] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A medical privacy protection method based on zero-knowledge deep learning, characterized in that: The following steps are involved: S1. Build a medical privacy protection system that includes both the client and doctor sides, and deploy a zero-knowledge neural network model based on the improved zkReLU activation function on the doctor side; The improved zkReLU activation function includes: decomposing the nonlinear operation of the ReLU activation function into two parts: sign bit verification and numerical calculation, and introducing polynomial constraints to achieve arithmetic circuit compatibility; the polynomial constraint is sign(x)∈{0,1}, sign(x)·x≥0, (1-sign(x))·x<0, sign(x) represents the sign bit of the input value x of the improved zkReLU activation function; S2. The patient receives the physiological data input by the patient and classifies its sensitivity. Different algorithms are used to encrypt the physiological data of different sensitivities to obtain encrypted data. If the physiological data is highly sensitive, it is encrypted using a fully homomorphic encryption algorithm; if the physiological data is low-sensitivity, it is encrypted using an attribute-based encryption algorithm; S3. Input the encrypted data into the zero-knowledge neural network model for forward propagation to obtain the intermediate layer zero-knowledge proof; S4. The patient initiates a diagnosis result query request, and the doctor integrates the intermediate layer zero-knowledge proof to generate an aggregated zero-knowledge proof for verification; the verifier verifies the correctness of the aggregated zero-knowledge proof by verifying the public key, confirming that the diagnosis result complies with the preset rules and does not leak the patient's privacy.

2. A medical privacy protection method based on zero-knowledge deep learning according to claim 1, characterized in that: Step S1: The zero-knowledge neural network model also includes: S11. Generate the verification equation through the Schwartz-Zippel lemma, expressed as Among them, Z'=|Z| is the absolute value of the pre-activation value Z, S Z is the symbolic tensor of the pre-activation value Z, r represents a random number, A represents the commitment value, G Z , G A represents the generator matrix; S12. Stack the same type of tensor operations in the neural network into a three-dimensional tensor and generate a compression proof through random linear combination; S13. Dynamic reconstruction of the zero-knowledge proof circuit after model parameter update, synchronous update of verification public key pk verify : in, Represents the verification public key before update, △W represents the parameter increment, and H() represents the hash function.

3. A medical privacy protection method based on zero-knowledge deep learning according to claim 2, characterized in that: Step S12 includes: Input tensor X for N identical operations (0) ,…,X (N-1) , and the output tensor Y, construct the aggregation tensor and in, is a set, D1 represents the index set of the weight tensor, D2 represents the index set of the input tensor, and D3 represents the index set of the output tensor; Using random vectors and Generate compression proof Among them, u1 and u3 represent random vectors, Indicates the length is A set of binary strings, i represents the position index, β(w,i) represents the weight index parameter function, represents the value of the input tensor at position i in the j-th operation, Represents the value of the output tensor at position i in the j-th operation; For the collection, Denotes the aggregate output function of the compression proof, D out A collection of indices representing random output tensors.

4. A medical privacy protection method based on zero-knowledge deep learning according to claim 1, characterized in that: Step S3 specifically includes: S31. Load the pre-trained zero-knowledge neural network model, ensure that the model parameters are bound to the verification public key through Pedersen commitment, and initialize the constraint parameters of the improved zkReLU activation function; S32. Perform format conversion on the encrypted data to adapt the input tensor structure of the zero-knowledge neural network model; S33. Perform layer-by-layer forward propagation on the encrypted data after format conversion. During the propagation process, the homomorphic encryption algorithm is used to ensure that the output of each layer remains encrypted. The output of each layer includes the commitment value A, the pre-activation value Z, the symbol tensor S Z and the gradient tensor; S34. Encode the output of each layer into a multidimensional tensor and generate Pedersen commitments bound to public parameters. Convert tensor operations into arithmetic circuits based on multilinear expansion, execute and verify the protocol, and then generate a compressed proof. Batch process cross-layer constraints through CUDA parallel computing; use GPU to accelerate multi-threaded execution and verification protocol.

5. A medical privacy protection method based on zero-knowledge deep learning according to claim 4, characterized in that: During the propagation process, the improved zkReLU activation function is used for each layer of neurons, including linear region verification, nonlinear region verification and gradient reverse constraint; Linear region verification includes directly outputting the original value when the input value is non-negative; Nonlinear region verification includes that when the input value is negative, the output is zero, and the sign bit is introduced to verify the sign tensor S Z =sign(Z); The gradient back constraint consists of binding the input gradient G Z With the activation gradient G A , ensuring the correctness of back propagation, expressed as 6. A medical privacy protection method based on zero-knowledge deep learning according to claim 1, characterized in that: Step S4 includes: S41. The patient initiates a diagnostic result query request, which includes an encrypted data identifier and a privacy statement C; the privacy statement C is encoded as a public input embedded in a zero-knowledge proof circuit to obtain a proof fingerprint Hash(π); S42. Write the data fingerprint Hash (Xone), proof fingerprint Hash (π) and encrypted data into the block through the smart contract.

7. A medical privacy protection method based on zero-knowledge deep learning according to claim 6, characterized in that: The privacy statement C includes the scope of diagnostic results that are allowed to be disclosed, the privacy fields that are prohibited from being disclosed, and the model reasoning compliance rules. Step S41 converts the privacy statement C into a public input and encodes the scope of diagnostic results that are allowed to be disclosed as a range parameter y min 、y max , the binary mask matrix M formed by the privacy fields that are prohibited from being leaked is serialized into a binary vector; the logical expression Φ(y) of the model reasoning compliance rule is compiled into Boolean logic gates to generate the constraint condition Verify(C,y): Among them, y∈[y min ,y max ] indicates that the diagnosis result y is within the authorized range, Indicates that the sensitive field is masked, and Φ(y)=1 indicates that the diagnosis result y complies with medical rules.

8. A medical privacy protection method based on zero-knowledge deep learning according to claim 6, characterized in that: Step S4 further includes: Using recursive SNARK technology, the intermediate layer zero-knowledge proofs of all layers of the zero-knowledge neural network model are compressed into aggregated zero-knowledge proofs; When the patient initiates a diagnosis result query request, the doctor adjusts the parameter ΔW to trigger the zero-knowledge proof circuit to dynamically reconstruct and update the verification public key. The doctor uses the updated verification public key to obtain the aggregated zero-knowledge proof, and the verifier uses the updated verification public key to verify.

Images