A privacy protection inference method for a binary neural network model under outsourcing computation

Abstract

The application discloses a privacy protection inference method for a binary neural network model under outsourcing computation and belongs to the field of neural network inference under outsourcing computation environment. Firstly, an inference system composed of a model owner, an edge server group and a user group is constructed, the model owner performs RSS, encrypts and distributes BNN model parameters to three edge servers, runs a symbolic function, generates an FSS function key and distributes the FSS function key to each edge server; meanwhile, random numbers are generated to mask multiplication operation and send data. Then, aiming at the BNN model, an activation function is designed based on the FSS and RSS hybrid protocol to optimize nonlinear operation, and a convolution layer and a full connection layer are constructed based on the RSS to provide efficient linear operation. Finally, the user adds the query result of the BNN model locally by using the additive homomorphism property of secret sharing to reconstruct a plaintext inference result. The application completes the lightweight construction of each module in the BNN, improves inference efficiency and realizes the protection of inference data privacy under a limited computing resource environment.

Description

Technical Field

[0001] This invention belongs to the field of neural network inference in outsourced computing environments. Specifically, it refers to a privacy-preserving inference method for binary neural network models under outsourced computing. Background Technology

[0002] In outsourced computing environments such as edge computing, the demand for neural network inference is growing, especially in resource-constrained environments like connected vehicles, where tasks such as object detection and speech recognition urgently require efficient and low-power solutions. Binary Neural Networks (BNNs), as a lightweight deep learning model, significantly reduce computational complexity and storage requirements by restricting weights and activation values ​​to binary values. However, in outsourced computing environments, the model parameters of the neural network and user input data may be leaked to the outsourced server. Therefore, effective privacy protection technologies are needed to achieve efficient model inference while protecting model parameters and user input.

[0003] In recent years, many studies have gradually introduced privacy-preserving techniques into neural networks. For example, SecureML and SecureNN achieve privacy-preserving training and inference of models through secure multi-party computation. Regarding privacy protection for BNN models, researchers have conducted in-depth studies on their training stability and inference accuracy. For instance, Banners uses Replicated Secret Sharing (RSS) to improve the inference speed of BNNs on edge servers; SecureBiNN combines operations on adjacent structures of the model to improve the inference efficiency of BNNs; FlexBNN proposes a flexible bit-width conversion method to reduce online communication overhead; and FssiBNN further improves the inference speed of BNNs based on Function Secret Sharing (FSS).

[0004] Although existing research has attempted to employ various cryptographic techniques to improve the privacy-preserving inference efficiency of BNNs in outsourced computing scenarios, the overhead of network communication remains too high due to the introduction of secure multi-party computation, thus posing a challenge for practical deployment.

[0005] Existing privacy-preserving inference schemes for BNNs based on secret sharing utilize techniques such as Arithmetic Secret Sharing (ASS) or RSS to implement privacy protection for each computational module within the model. For example... Figure 1 As shown, the secret-sharing-based BNN inference scheme mainly includes the following modules:

[0006] (1) Fully connected and convolutional layers. The parameters of these layers are composed of binary values, typically {-1, +1}. During forward propagation, the weights W, biases B, and convolutional kernels perform binary operations on the input signal to reduce model complexity and storage requirements. This binary representation can significantly improve inference speed and reduce memory usage. Furthermore, existing techniques utilize ASS and Beaver triples to achieve secure multi-party computation, effectively leveraging linear multiplication to ensure multi-party security and privacy.

[0007] (2) Activation Function. In traditional neural networks, commonly used activation functions such as ReLU typically return positive numbers. However, BNNs often use the sign function instead to accommodate the binary representation of weights and activations. This substitution allows each activation value to be perfectly mapped to binary form, thereby improving computational efficiency. Meanwhile, existing work typically builds parallel carry adders (PPAs) based on ASS (Alternating Range Array), using multi-round communication to achieve comparison operations on secretly shared values, ensuring security for all parties.

[0008] (3) Max Pooling. BNN uses only max pooling as its downsampling strategy. In this process, the max pooling layer selects the maximum value from the output of the activation function and generates the corresponding binary output. Specifically, in this way, BNN can optimize output information, reduce redundancy, and help extract key features, thereby enhancing the model's performance. Existing work usually implements max pooling based on PPA comparison and local addition and subtraction.

[0009] (4) Batch Normalization. When γ>0, BatchNorm can be simplified to an additive form and calculated together with the Sign function. The specific formula is Sign(α+(β / γ)), where the bias terms α and β are adjusted to accommodate the needs of binary activation.

[0010] Based on the modules described above, multiple edge servers execute inference tasks based on the input data, and ultimately return the generated result shares to the user. The user reconstructs the plaintext result locally using the result shares returned by the server, thereby achieving efficient inference of the BNN while ensuring data privacy.

[0011] In outsourced computing environments such as edge computing, existing technologies for building privacy-preserving BNN inference suffer from the following problems:

[0012] (1) For linear operations, linear operations based on the ASS and FSS schemes require the use of auxiliary variables such as multiplication triples to introduce a large amount of communication.

[0013] (2) For nonlinear operations, directly applying ASS to the parallel carry adder (PPA) to implement a secure comparison protocol results in more communication rounds, and the communication cost increases with the number of data bits. Current schemes based solely on RSS utilize share conversion between ASS and RSS to evaluate BNN, which leads to additional communication rounds and higher communication overhead. Summary of the Invention

[0014] This invention proposes a privacy-preserving inference method for BNN models under outsourced computing. It utilizes RSS technology to construct linear computation and FSS technology to construct nonlinear computation, thereby meeting the inference efficiency requirements of resource-constrained outsourced computing environments.

[0015] A privacy-preserving inference method for BNN models under outsourced computation includes the following steps:

[0016] Step 1: Construct an inference system consisting of model owners, edge server groups, and users;

[0017] The model owner is a trusted entity that uses RSS technology to divide the BNN model into shares and then provides these shares to three independent edge servers.

[0018] Three independent edge servers process user inference requests according to a customized protocol and return their respective shares of query results to the client.

[0019] Users utilize a lightweight additive secret-sharing technique to divide data query requests into three parts, send them to the edge server group, and reconstruct the results into plaintext locally after receiving the three parts of the query results.

[0020] Step two: The model owner executes RSS to encrypt and distribute the BNN model parameters to three edge servers, completing the offline deployment.

[0021] Edge server P i The proportions are respectively the input parameter proportions (W). i Data share (X) i , i∈{0,1,2}.

[0022] Step 3: The model owner runs the symbolic function offline to generate the FSS function key and distributes it to each edge server; simultaneously, a random number mask α is generated. i (Satisfying α0+α1+α2=0), used for multiplication operations and data transmission.

[0023] First, construct an interval function (IC) based on the distributed comparison function (DCF) in FSS, specifically:

[0024] The distributed comparison function f satisfies: f(x) = β if x > α, else 0;

[0025] Based on two DCF operations, the IC function is further constructed to satisfy: f p,q (x)=1 x∈[p,q] .

[0026] Then, based on the IC function, let f p,q In (x), p = 0 and q = 2 n-1 The secret share value is n bits, and a comparison function based on FSS is implemented.

[0027] Finally, by running the Gen part of the symbolic function, the function keys k0,k1 and random input value masks r0,r1 of the FSS are generated and distributed to the edge servers P0,P1 to generate the random output value mask r. out Distribute to edge server P2.

[0028] Step 3: Construct an RSS-based FC / Conv layer for the BNN.

[0029] In BNNs, linear combinations of input X and parameters W are of two types: fully connected layers (FC) and convolutional layers (Conv). A fully connected layer is expressed as WX + b, where addition relies on the local operation of the secret-sharing property, and the main computation comes from matrix multiplication; a convolutional layer transforms the input and weights into matrix multiplication by applying the Toeplitz transformation.

[0030] The multiplication operation of the fully connected layer is performed using RSS re-sharing technology, specifically as follows:

[0031] Consider an arbitrary fully connected layer with input X, weights W, and input / output layer biases b stored in a secret-sharing manner among edge servers. Each edge server jointly invokes a multiplication protocol to compute the result. In this multiplication protocol, each of the three edge servers holds a share of the model parameters W and the RSS of the user input X. Each edge server P... i Local computation <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 Afterwards, each edge server performs re-sharing, using the random number mask α pre-generated in the offline phase. i encryption <y> i , encrypt <y> i The data is sent to neighboring parties, and each participating party calculates its RSS share of the multiplication result locally using the received data. <y>> i =< <W·X》 i .

[0032] Step 4: Construct an activation function for BNN based on a hybrid protocol of RSS and FSS.

[0033] The activation function, the Sign function, in BNNs is constructed based on FSS. The computation is completed in two stages: generation and evaluation. The FSS paradigm is built by transforming the function into offset form and adding a random number mask. The BA function based on FSS is then constructed to support RSS in both input and output. A hybrid protocol of RSS and FSS is designed, as detailed below:

[0034] First, consider a third-party RSS scenario, where the Sign function is represented as an offset function containing input and output masks. The sum of r0 and r1 serves as the input value mask, satisfying r in =r0+r1, the value of r2 is used as the output value mask to satisfy r out =r2. Using a trusted third party as the Dealer, random numbers r0, r1, and r2 are distributed to the three participants, who then hold shares: P0{< <x> >0,<r in >0}，P1{< <x> >1,<r in >1}，P2{< <x>>2,r out }

[0035] Next, the trusted third party, based on the FSS paradigm, divides the entire process into two phases: offline and online, to construct and execute the aforementioned function, as follows:

[0036] The Dealer first generates a random number r and constructs the corresponding offset function. Then, the Dealer generates a shared key (k0, k1) through the Gen function of the FSS generation protocol, distributing the keys k0 and k1 to participants P0 and P1 respectively.

[0037] During the online phase, P0 and P1 first reconstruct the masked input value x+r. in Use it as input to utilize the function key k locally. i Execute the evaluation protocol Eval(x+r) in The calculation is performed, and the resulting share is recorded as follows: <res> 0， <res>1. At this point, participant P2 performs local calculations. <res>2 = -r out At this time, it was observed that... Each of the three parties holds a copy of the additive secret of the input value X after it has been processed by the Sign function.

[0038] Finally, each participant performs a round of re-sharing, P j Each of them took what they had in their hands <res> j Send to P (j+1)mod3 This enables each party to hold local secret sharing in the form of RSS. <o> > j ＝{ <o> j , <o> (j+1)mod3 Complete the design of a hybrid protocol for FSS and RSS.

[0039] Step 5: Construct a max pooling layer and a regularization layer for the BNN.

[0040] In BNN, the max pooling layer outputs a binary result for each location in the image and then sums them up. Based on local addition and SecBA, the max pooling function SecMaxPool is obtained, specifically:

[0041] When considering the single-channel case, max pooling is performed by... The output is calculated by sliding an upward window of size k×k with a stride of s (usually s=k). in At this point, the SecMaxPool operation calls the secure addition and SecBA operations d′2·d′2 times in parallel. The addition protocol requires no communication, while the SecBA protocol only needs to reconstruct x+r in the online phase. in The computation is completed through two rounds of communication, including re-sharing.

[0042] In hidden layers, regularization operations combined with adjacent activation functions are collectively represented as activation function operations. In BNNs, regularization operations, except in the output layer, always appear together with the BA operation, in the form BA(BN(x)). For the BN operation, given the input share... <x>The parameters <γ> and <β> in the regularization formula γ·x+β are pre-computed locally and <β> / <γ> are secretly shared, transforming the activation function and regularization into separate activation function operations: BA(BN( <x>))=BA(<γ>· <x>+<β>)=BA( <x>+<β> / <γ>), where BA(x)=Sign(x).

[0043] Step six: The user divides the data query into three parts and sends them to three edge servers respectively. The three edge servers perform queries based on the BNN models built in steps three, four and five, and return the inference results to the user. The user then uses the additive homomorphic property of secret sharing to reconstruct the plaintext inference results locally.

[0044] The advantages and beneficial effects of this invention are as follows:

[0045] (1) This invention proposes a privacy-preserving inference method for BNN models. It optimizes the efficiency of linear and nonlinear computations using lightweight cryptographic primitives RSS and FSS, respectively, and constructs a hybrid protocol of lightweight secret-sharing primitives to improve inference speed in the online phase. Through the design of the preprocessing scheme and the hybrid protocol, it achieves faster speed and lower online communication volume, resulting in more efficient inference computation.

[0046] (2) This invention proposes a privacy-preserving inference method for BNN models under outsourced computation, which improves inference efficiency while protecting the privacy of inference data in environments with limited computing resources. The overall solution is based on secure multi-party computation technology. In terms of privacy protection, the solution designs activation functions based on a hybrid FSS and RSS protocol to optimize nonlinear operations, constructs convolutional layers and fully connected layers based on RSS to provide efficient linear operations, and completes the lightweight construction of each module in the BNN to ensure the security of the model and input data during inference. Attached Figure Description

[0047] Figure 1 It is an existing secret-sharing BNN inference scheme;

[0048] Figure 2 This invention proposes a privacy-preserving inference method for BNN models under edge cloud computing. Detailed Implementation

[0049] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0050] This invention proposes a privacy-preserving inference method for BNN models under outsourced computation, utilizing RSS technology to construct linear computation and FSS technology to construct nonlinear computation.

[0051] (1) Nonlinear computation is constructed using FSS technology. By using a preprocessing mechanism to generate function-based keys in the offline stage, a large amount of computation is transferred from the online stage to the offline stage, which greatly reduces server communication overhead and optimizes the problem of excessive online overhead in previous PPA-based schemes.

[0052] (2) By using RSS technology to construct linear operations, the multiplication efficiency achieved is higher than that of the Beaver multiplication triplet. At the same time, a hybrid protocol design scheme of RSS and FSS under neural networks is proposed to give full play to the advantages of both to improve the efficiency of linear and nonlinear operations and achieve efficient BNN inference.

[0053] A privacy-preserving inference system for BNN models under outsourced computation includes three types of entities: edge server groups, model owners, and users, such as... Figure 2 As shown:

[0054] (1) Model Owner. The model owner is a trusted entity that uses RSS technology to divide the BNN model into shares and then provides these shares to three independent edge servers in order to provide inference services to users.

[0055] (2) Edge server group. Three independent servers will process user inference requests according to a customized protocol.

[0056] (3) User. The user uses a lightweight additive secret sharing technology to divide the data query into three shares. The edge server group returns each share of the query result to the client, and the client reconstructs it into plaintext locally.

[0057] A privacy-preserving inference method for BNN models under outsourced computation, the specific steps of which are as follows:

[0058] (1) Offline deployment stage.

[0059] First, in order to provide the service, the model owner needs to pre-deploy the encrypted parameters of the BNN model to a server group. Specifically, the model owner needs to execute RSS to encrypt and distribute the model parameters to three independent servers to complete the deployment.

[0060] (2) Function key and random number generation.

[0061] First, construct an interval function (IC) based on the distributed comparison function (DCF) in FSS. The distributed comparison function f satisfies: f(x) = β if x > α, else 0. Based on two DCF operations, further construct the IC function satisfying: f p,q (x)=1 x∈[p,q] .

[0062] Continuing with the IC function, let f p,q In (x), p = 0 and q = 2 n-1 Implement a comparison function based on FSS (with a secret share value of n bits).

[0063] Finally, run the symbolic function;

[0064] The symbolic function is divided into two parts: Gen and Eval. The offline calculation is completed locally in advance, while the online part is calculated by interaction between the two servers. See Algorithm 2 for details.

[0065] In this offline phase, only the Gen part of Algorithm 2 is run to generate the FSS key and distribute it to each participating server to support the online calculation of the subsequent activation function; at the same time, the multiplication operation and the random number mask needed when sending data are also generated in this phase.

[0066] (3) Construction of FC / Conv layer based on RSS.

[0067] In BNNs, linear combinations of input X and parameters W have two main types: fully connected layers (FC) and convolutional layers (Conv). A fully connected layer can be expressed as WX + b, where addition can be performed locally using the secret-sharing property, with the main computation coming from matrix multiplication. Convolutional layers can be transformed into matrix multiplication by applying a Toeplitz transformation to the input and weights. RSS re-sharing technology can efficiently perform multiplication. Consider an arbitrary fully connected layer with input X, weights W (and input / output layer biases b) stored in a secret-sharing manner among the participants. The participants jointly invoke a multiplication protocol to compute the result (see Algorithm 1). This protocol can be easily extended to convolutional operations and batch regularization. In the protocol, each of the three participants holds an RSS share of the model parameters W and the user input X, with each party P... i Only local calculation is needed <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 Afterwards, all parties perform re-sharing, using the random number mask α pre-generated in the offline phase. i encryption <y> i , encrypt <y> i The data is sent to neighboring parties, and each participating party calculates the RSS share of the multiplication result locally using the received data. <y>> i =<<W·X> > i .

[0068]

[0069] (4) Construction of activation function based on RSS and FSS hybrid protocol.

[0070] When constructing the activation function in a BNN, the Sign function is used due to its binarization characteristics. Therefore, a Sign function is constructed based on FSS, and its online communication efficiency is improved by completing the calculation in two stages: generation (Gen) and evaluation (Eval). Simultaneously, since the overall system of this invention uses RSS shares as input and output, while FSS requires plaintext input and ASS shares as output, the focus is on constructing the FSS-based BA function to support RSS input and output. Therefore, this invention constructs the FSS paradigm by converting the function to offset form and adding a random number mask, designing a hybrid protocol of RSS and FSS. To ensure privacy, the input RSS shares are held by three parties respectively, while the output RSS shares are dynamically calculated through the generation and evaluation process of FSS. The family of offset functions applied to the FSS paradigm is defined as follows:

[0071] First, consider a third-party RSS scenario where the goal is to represent the Sign function as an offset function that includes input and output masks. The sum of r0 and r1 serves as the input value mask, satisfying r in =r0+r1, the value of r2 is used as the output value mask to satisfy r out =r2. Using a trusted third party as the Dealer, random numbers r0, r1, and r2 are distributed to the three participants, who then hold shares: P0{< <x> >0,<r in >0}，P1{< <x> >1,<r in >1}，P2{< <x>>2,r out }

[0072] Next, the trusted third party, following the FSS paradigm, divides the entire process into offline and online phases to construct and execute the aforementioned function. As mentioned above, in the offline phase, the function key is generated and distributed to the participants. Specifically, the Dealer first generates a random number r and constructs the corresponding offset function. Then, the Dealer generates the function sharing key (k0, k1) using the FSS generation protocol Gen, and distributes keys k0 and k1 to participants P0 and P1 respectively. In the online phase, P0 and P1 first reconstruct the masked input value x+r. in Use it as input to utilize the function key k locally. i Execute the evaluation protocol Eval(x+r) in The calculation is performed, and the resulting share is recorded as follows: <res> 0， <res>1. At this point, participant P2 performs local calculations. <res>2 = -r out At this point, it can be observed Each of the three parties holds an additive secret share of the input value X after processing by the Sign function. To complete subsequent computations, only one round of re-sharing is needed, P... j Each of them took what they had in their hands <res> j Send to P (j+1)mod3 This enables each party to hold local secret sharing in the form of RSS. <o> > j ＝{ <o> j , <o> (j+1)mod3 Complete the design of a hybrid protocol for FSS and RSS.

[0073] The binary activation function operation constructed based on the FSS and RSS hybrid protocol described above is the SecBA algorithm, and the specific process is shown in Algorithm 2. By combining the characteristics of RSS and FSS, this scheme achieves efficient binary activation function operation based on input-output masks. This scheme not only utilizes FSS to optimize the execution efficiency of nonlinear operations, but also combines it with RSS to embed it into the entire RSS-based inference process, providing a new combination scheme for distributed computing while ensuring privacy.

[0074]

[0075]

[0076] (5) Construction of maximum pooling layer and regularization layer.

[0077] In BNNs, the max pooling layer always follows batch normalization and binary activation layers, outputting a binarized result for each location in the image and finally summing them. Therefore, max pooling can be computed using secure addition and secure comparison. The addative homomorphic property of secret sharing allows for local computation, while secure comparison can be implemented using the SecBA function mentioned above. Thus, the max pooling function SecMaxPool can be easily obtained based on local addition and SecBA.

[0078] When considering the single-channel case, max pooling is performed by... The output is calculated by sliding an upward window of size k×k with a stride of s (usually s=k). in At this point, the SecMaxPool operation can call the secure addition in parallel, performing d′2·d′2 secure BA operations. As mentioned earlier, the addition protocol does not require any communication, and the SecBA protocol only needs to reconstruct x+r during the online phase. in The computation can be completed by performing two rounds of communication, including re-sharing.

[0079] Regularization operations in hidden layers can be combined with adjacent activation functions and uniformly represented as activation function operations, so they do not need to be explained separately. In BNNs, regularization operations, except in the output layer, always appear together with the BA operation, in the form BA(BN(x)). For the BN operation, given the input share... <x>And the parameters <γ> and <β> in the regularization formula γ·x+β, we can pre-compute <β> / <γ> locally and share them secretly. This way, the activation function and regularization that occur together can be transformed into separate activation function operations: BA(BN( <x>))=BA(<γ>· <x>+<β>)=BA( <x>+<β> / <γ>), where BA(x) = Sign(x). It can be proven that in this scenario, BA(<γ>· <x>+<β>)=BA( <x>+<β> / <γ>), because γ is a positive number.

[0080] (6) Return of complete process results.

[0081] Finally, the calculated inference results are returned to the user by each server, and the user reconstructs the plaintext inference results locally by adding the results using the additive homomorphic property of the secret sharing.< / x> < / x> < / x> < / x> < / x> < / x> < / o> < / o> < / o> < / res> < / res> < / res> < / res> < / x> < / x> < / x> < / y> < / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y> < / x> < / x> < / x> < / x> < / o> < / o> < / o> < / res> < / res> < / res> < / res> < / x> < / x> < / x> < / y> < / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y>

Claims

1. A privacy-preserving inference method for BNN models under outsourced computation, characterized in that, Comprising the following steps: Step one, build a reasoning system composed of model owners, edge server groups and user groups; Step two, the model owner performs RSS, encrypts and distributes BNN model parameters to three edge servers, and completes offline deployment; Edge server P i The share of the input parameter W i The data share X i i∈{0,1,2}; Step three, the model owner runs the symbolic function in the offline stage, generates the FSS function key, and distributes it to each edge server; at the same time, a random number mask α is generated i , for multiplication operation and data transmission; First, according to the distributed comparison function DCF in FSS, an interval function IC is constructed, specifically: The distributed comparison function f satisfies: f(x) = β if x > α, otherwise 0; Based on two DCF operations, further construct IC function to meet: f p,q (x) = 1 x∈[p,q]； Then, based on the IC function, let f p,q (x) with p = 0, q = 2 n-1 , the secret sharing value is n bit, and a comparison function based on FSS is implemented; Finally, by running the Gen part of the symbol function, the function keys k0, k1 and random input value masks r0, r1 of the FSS are generated and distributed to the edge servers P0, P1, and the random output value masks r out are distributed to the edge server P2; Step four, for the BNN model, its RSS-based FC / Conv layer, RSS and FSS hybrid protocol-based activation function, and maximum pooling layer and regularization layer are constructed respectively; Step 401, construct the RSS-based FC / Conv layer; In BNN, the linear combination of input X and parameter W has two types: fully connected layer FC and convolution layer Conv; The fully connected layer is expressed as WX+b, where the addition operation is operated locally relying on the homomorphism property of secret sharing, and the multiplication operation of the fully connected layer is performed using the re-sharing technology of RSS; Step 402, construct the activation function based on the hybrid protocol of RSS and FSS; Based on FSS, the activation function in BNN, namely the Sign function, is constructed, which is completed by generating Gen and evaluating Eval two stages, and the FSS paradigm is constructed by converting the function into offset form and adding random number mask, and the FSS-based BA function is constructed in the form of RSS input and output, and the hybrid protocol of RSS and FSS is designed, the specific process is as follows: First, consider a three-party RSS scenario, express the Sign function as an offset function containing input and output masks where the sum of r0, r1 as input mask satisfies r in = r0 + r1, the value of r2 as output mask satisfies r out = r2; distribute random numbers r0, r1, r2 to three parties by a trusted third party as Dealer, at this time the three parties hold shares respectively: P0{《x》0, <r in >0}, P1{《x》1, <r in >1}, P2{《x》2, r out}; Next, the trusted third party divides the whole process into offline and online two stages according to the paradigm of FSS, in order to construct and execute the above function, as follows: The dealer first generates a random number r and constructs the corresponding offset function; Then, the dealer generates function sharing keys (k0, k1) through the FSS generation protocol Gen, and distributes the keys k0, k1 to the participants P0, P1 respectively; In the online phase, P0 and P1 first reconstruct the input value x + r with a mask in , which is used as input locally with the function key k i The evaluation protocol Eval(x + r in ) is executed for the computation, and the resulting share is denoted by <res> 0， <res>1. At this time, the participant P2 locally computes <res>2 = -r out ; at this time res = 0 <res> 0+ <res> 1+ <res>2 = Sign [rin,rout] (x) - r out = Sign(x + r in - r in ) + r out - r out = Sign(x), each party holds a share of the output of the Sign function on the input value X< / res> < / res> < / res> < / res> < / res> < / res> Finally, the participants perform a round of re-sharing, P j Each of the participants hands over <res>x sent to P (j+1)mod3 such that each party locally holds a secret share of the RSS in the form of j = { <o> j , <o> (j+1)mod3}, complete the hybrid protocol design of FSS and RSS;< / o> < / o> < / res> Step 403, construct the maximum pooling layer and the regularization layer; Among them, the maximum pooling layer outputs a binary result for each position in the image and finally sums up, and the regularization operation in the hidden layer is combined with the adjacent activation function to represent the activation function operation uniformly; Step five, the user divides the data query into three parts and sends them to the three edge servers respectively, and the three edge servers query based on the constructed BNN model and return the query reasoning results to the user end respectively, and the user reconstructs the plaintext reasoning result by using the additive homomorphism property of secret sharing.

2. The privacy-preserving inference method for BNN model under outsourcing computation according to claim 1, characterized in that, The reasoning system is specifically: The model owner is a trusted entity, which divides the BNN model into shares by using RSS technology, and then provides these shares to three edge servers that do not collude with each other; The three edge servers that do not collude with each other process the reasoning request of the user according to the customized protocol, and return the shares of their query results to the client; The user divides the data query request into three shares by using a lightweight additive secret sharing technique, sends the shares to the edge server group, and reconstructs the query result into plaintext locally after receiving three query results.

3. The privacy-preserving inference method for BNN model under outsourcing computation according to claim 1, characterized in that, The convolution layer is converted into matrix multiplication by applying Toeplitz transformation to the input X and the parameter W.

4. The privacy-preserving inference method for BNN model under outsourcing computation according to claim 1, characterized in that, In the full connection layer, re-sharing of RSS is used for multiplication operation of the full connection layer, specifically as follows: Considering that an arbitrary full connection layer input is X, the weight is W, and the input / output layer bias b is stored in a secret sharing manner among edge servers, the multiplication protocol is called by the edge servers to calculate the result; In this multiplication protocol, three edge servers each hold an RSS share of the model parameters W and the user input X, each edge server P i At the local computation <y> i ＝ <w> i · <x> i + <w> i+1 · <x> i + <w> i · <x> i+1 ; then each edge server performs re-sharing, using the random number mask a pre-generated in the offline phase i encryption <y> i The encrypted <y> i Send to neighbors, each participant computes locally the RSS share of the multiplication result y from the received data i = W X i .< / y> < / y> < / x> < / w> < / x> < / w> < / x> < / w> < / y> 5. The privacy-preserving inference method for BNN model under outsourcing computation according to claim 1, characterized in that, The max pooling layer obtains a max pooling function SecMaxPool based on local addition and SecBA, specifically as follows: When considering the single channel case, the max-pooling is computed by sliding a window of size k x k over the input with stride s to compute the output as where At this point, the SecMaxPool operation invokes the secure addition and the SecBA operation d'2- d'2 times in parallel; where the addition protocol does not require any communication, the protocol SecBA requires the reconstruction of x + r in the online phase in and the re-sharing is done in two rounds of communication to complete the operation.

6. The privacy-preserving inference method for BNN model under outsourcing computation according to claim 1, characterized in that, The regularization operation in the hidden layer is combined with the adjacent activation function and uniformly represented as an activation function operation, specifically as follows: In BNNs, the regularization operation appears together with the BA operation, except at the output layer, in the form BA(BN(x)); for the BN operation, given an input share x <x>and parameters <γ> and <β> in the regularization formula γ · x + β, pre-compute <β> / <γ> locally and secret share, transform the activation function and regularization into separate activation function operations: BA(BN( <x>)) = BA(< γ> · <x>+ <β>) = BA <x>+<β> / <γ>),where BA(x)=Sign(x).< / x> < / x> < / x> < / x>

Images