Safety verifiability method based on deep neural network DNN

Abstract

The invention relates to a safety verifiability method based on a deep neural network DNN, and belongs to the technical field of neural networks, and the method comprises the following steps: S1, sensitive sample generation; s2, generating a mixed data set; s3, safety prediction; the user sends the model and a to-be-queried sample encrypted by using a homomorphic encryption algorithm to a server, and the server predicts the to-be-queried sample in a secret state and returns an encryption result to the user due to the homomorphic encryption property; s4, verifying result correctness; the result correctness verification comprises two parts, the first part is model integrity verification, and the verification is performed by checking the accuracy of sensitive sample set prediction; the second part is calculation correctness verification by checking whether prediction results of all copies of the same to-be-predicted sample are consistent or not; the method has the beneficial effects that safety prediction and verifiability are realized.

Description

Technical Field

[0001] This invention belongs to the field of neural network technology, and specifically relates to a secure and verifiable method based on deep neural networks (DNNs). Background Technology

[0002] In the era of big data, machine learning, as an emerging tool, is widely used in many research fields. Machine learning is an interdisciplinary field involving multiple disciplines, including probability theory, statistics, and algorithm complexity theory. It can quickly and accurately extract useful information from massive amounts of data, thereby providing convenient services to people. The performance of a machine learning model depends on the model's structure and the size of the training dataset. With the advent of the 5G era, massive amounts of data are generated every day. Although generally, the more training data fed to a machine learning model, the better its performance, this undoubtedly increases the computational cost of training the model. For most users, training a complex machine learning model or deploying a complex model using massive amounts of data on local devices with limited computing resources is extremely difficult.

[0003] Some scholars have proposed federated learning, which stores data across multiple nodes and trains models in parallel on these nodes. This fully utilizes computing resources, improving training speed and accuracy. Furthermore, federated learning does not require users to send their local datasets, protecting user privacy. In addition, the development of cloud computing has provided new application scenarios for machine learning. Cloud computing can provide powerful computing resources and massive storage space, making machine learning possible on large-scale datasets. With the help of cloud servers, users can train and predict models, significantly reducing the computational overhead of client-side model training and prediction, and fully utilizing the datasets of each user. The emergence of federated learning and cloud computing allows resource-constrained users to complete complex computational tasks. Users pay for computing and storage resources in cloud servers, avoiding the purchase and maintenance of expensive local hardware. Despite the many advantages of federated learning and cloud computing, several security risks remain.

[0004] In the era of big data, machine learning is widely used in numerous research fields, especially deep neural network (DNN) models, which have achieved remarkable results in multiple areas thanks to their powerful data processing capabilities. However, with the advent of the 5G era and the explosive growth of data, the security and verifiability of DNN models have become pressing issues that need to be addressed. Summary of the Invention

[0005] This invention provides a secure verifiability method based on deep neural networks (DNNs) to address the security and verifiability issues during the DNN model's runtime phase. The user sends the model and a query sample encrypted using a homomorphic encryption algorithm to the server. Due to the nature of homomorphic encryption, the server predicts the query sample in encrypted form and returns the encrypted result to the user, thus achieving security detection. Result correctness verification includes two parts: the first part is model integrity verification, which is checked by examining the accuracy of predictions on sensitive sample sets; the second part is computational correctness verification, which is checked by verifying whether the prediction results of all copies of the same query sample are consistent, thus achieving verifiability.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solution:

[0007] A secure and verifiable method based on deep neural networks (DNNs) includes the following steps:

[0008] S1. Sensitive Sample Generation: The sensitive sample set is a set of samples carefully trained for a specified model. The samples in the set can be associated with most of the model's parameters when the model makes predictions.

[0009] S2. Generate a mixed dataset; after copying each sample to be queried by the same number of copies, it is randomly mixed with the sensitive sample. Users can verify whether the calculation results of all copies of the same sample are the same to verify whether the server has honestly returned the calculation results.

[0010] S3, Secure Prediction: The user sends the model and the query sample encrypted using a homomorphic encryption algorithm to the server. Due to the nature of homomorphic encryption, the server makes a prediction on the query sample in a closed state and returns the encrypted result to the user.

[0011] S4. Result Correctness Verification: Result correctness verification consists of two parts. The first part is model integrity verification, which is tested by checking the accuracy of the prediction on the sensitive sample set. The second part is computational correctness verification, which is tested by checking whether the prediction results of all copies of the same sample to be predicted are consistent.

[0012] Optionally, the steps for generating sensitive samples are as follows:

[0013] Define the neural network model as y = f(W, x), where W = [w1, w2, ..., w n ] is the set of all parameters of the neural network model, where x is a sample; by optimizing the objective function Generate sensitive samples and optimize the objective function to maximize the difference in output between the original model and the model after parameter perturbation.

[0014] Optionally, the generation of sensitive samples satisfies the following constraints:

[0015] The range of values ​​for sample x is [p, q]. m And the difference between the sample v0 and the original dataset satisfies ||x-v0||≤∈, where ∈ is the perturbation value.

[0016] Optionally, the size of the mixed dataset is m·n+p, where n is the number of samples to be queried, m is the number of copies of a single sample, and p is the number of samples in the sensitive sample set.

[0017] Optionally, the plaintext encoding process of the homomorphic encryption algorithm includes:

[0018] From complex vector space Choose element a, and map it to the polynomial quotient ring via surjective φ and ψ. And a scaling factor Δ is introduced to complete the encoding.

[0019] Optionally, the encryption process is implemented using the public key pk = b = (-as + e, a) and the private key sk = (1, s), and the encryption result is (c1, c2) = r(b, a) + (m + e1, e2), where r is a random integer and e1 and e2 are two vectors.

[0020] Optionally, model integrity verification is achieved by detecting the consistency between the predicted output and the expected output of a sensitive sample set, which covers the correlation parameters of most neurons in the model.

[0021] Optionally, the judgment condition for the correctness verification is: if the prediction results of all replicas of the same queried sample are inconsistent, the server is judged to return an incorrect result.

[0022] Optionally, the generation of the sensitive sample set needs to screen samples that can be associated with most neurons of the model to ensure that the output is highly sensitive to parameter changes.

[0023] Optionally, it can be applied in federated learning scenarios to verify the privacy of sensitive data on cloud servers and the integrity of the inference process.

[0024] The beneficial effects of this invention are:

[0025] This invention involves the user sending a model and a query sample encrypted using a homomorphic encryption algorithm to the server. Due to the nature of homomorphic encryption, the server predicts the query sample in encrypted form and returns the encrypted result to the user, thus achieving security detection. The result correctness verification includes two parts: the first part is model integrity verification, which is verified by checking the accuracy of the prediction on the sensitive sample set; the second part is computational correctness verification, which is verified by checking whether the prediction results of all copies of the same query sample are consistent, thus achieving verifiability. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a schematic diagram of the workflow of the present invention;

[0028] Figure 2 This is a mixed data diagram of the present invention;

[0029] Figure 3 This is an example diagram for verifying the integrity of the model in this invention. Detailed Implementation

[0030] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0031] Example 1

[0032] like Figure 1 As shown, this embodiment provides a secure verifiability method based on a deep neural network (DNN), including the following steps:

[0033] S1. Sensitive Sample Generation. The sensitive sample set is a set of samples carefully trained for a specified model. The samples in this set are correlated with most of the model's parameters when predicted by the model. Therefore, the output of this sample set is highly sensitive to the model parameters. Generating the sensitive sample set requires selecting samples that are correlated with most of the model's neurons to ensure high sensitivity of the output to parameter changes. Even a slight change in the model parameters will cause the output of the sensitive sample set to change accordingly, thus validating the model used by the server.

[0034] S2. Generate a mixed dataset. Each query sample is copied the same number of times and randomly mixed with the sensitive sample. Users verify that the server is honestly returning results by checking if the calculation results of all copies of the same sample are identical. If a user finds that the prediction results of all copies of the same sample are inconsistent, it indicates that the server is returning incorrect calculation results.

[0035] S3. Secure Prediction. The user sends the model and the query sample encrypted using a homomorphic encryption algorithm to the server. Due to the nature of homomorphic encryption, the server can perform a prediction on the query sample in encrypted form and return the encrypted result to the user. Since the data is encrypted from the moment it leaves the user until the prediction result is returned to the user, the user's privacy information is not leaked.

[0036] S4. Result Correctness Verification. Result correctness verification consists of two parts. The first is model integrity verification, which checks the accuracy of predictions on a sensitive sample set. Model integrity verification is achieved by detecting the consistency between the predicted output and the expected output of the sensitive sample set. The sensitive sample set covers the correlation parameters of most neurons in the model. The second is computational correctness verification, which checks whether the prediction results of all copies of the same sample to be predicted are consistent. The judgment condition for correctness verification is: if the prediction results of all copies of the same sample to be queried are inconsistent, then the server is deemed to have returned an incorrect result.

[0037] This embodiment is applied in a federated learning scenario to verify the privacy of sensitive data on cloud servers and the integrity of the inference process.

[0038] Example 2

[0039] Based on Example 1, in step 1, the sensitive sample is generated, specifically as follows:

[0040] A neural network model can be defined as y = f(W, x), where x is a sample and W = [w1, w2, ..., w n [x] is the set of all parameters of the model. Suppose the model parameter W is modified to W+Δw, where Δw is the modification amount, and the modified output y′=f(W+Δw,x). To detect whether the model parameters have been modified, a "sensitive" input sample x... input It should be able to show the difference between y and y as much as possible, thus yielding the following definition:

[0041]

[0042] Where ||·||2 represents the L2 norm (Euclidean norm) of the vector, used to measure the "distance / difference" of the vector or function output, and f(W, x) represents the model / function with parameters W and input x as variables, such as the forward propagation of neural networks in machine learning and the system response in signal processing. The input x is processed by the rules defined by parameters W and outputs a result, which represents the calculation logic when the input is still x after the model parameters change from W to W+Δw (Δw is a small perturbation or increment of the parameters). It can be understood as "the model with perturbation parameters acts on x".

[0043] From an optimization perspective, the goal is to find the input x that is most sensitive to parameter perturbation Δw: given model parameters W and parameter perturbation Δw, we iterate through all possible inputs x, calculate the L2 norm difference between the model output (W+Δw, x) after parameter perturbation and the original model output f(W, x), and find the x that makes this difference the largest, denoted as v. This is often used to analyze how small changes in the model parameters can cause drastic fluctuations in the output.

[0044] fi (W,x) represents the output of the i-th sample or the i-th layer. Its core is to transform or map the input x using parameters W to achieve prediction, classification, and regression tasks. i (W,x) is modified to obtain f i (W+Δw,x).

[0045] in, It is the gradient (vector derivative) with respect to W, describing the change of f as W changes. i The rate of change of W, after calculation, is a vector with the same dimension as W; Here, a higher-order term represents the error of the square order of the Δw norm. When ||Δw||²→0 (i.e., the parameter change is extremely small), this term is more significant than the linear term. It approaches 0 faster and can be approximated as negligible. It simplifies the calculation of function output when parameters change slightly, allowing complex function changes to be described by gradients (rate of change), and is the mathematical foundation of algorithms such as gradient descent and backpropagation (derived through Taylor expansion of parameter update rules).

[0046] Simple adjustments: in, Let the square of the norm of the function increment be . It consists of a first-order approximation plus higher-order minterms.

[0047] When the parameters W are sufficiently smooth, for a small Δw, the function increment ≈ gradient-driven linear change plus negligible higher-order small terms. This supports the rationale for the gradient descent algorithm (using the gradient to guide the direction of parameter updates, based on the "optimizable function under linear approximation"), and also helps to understand the output changes when fine-tuning model parameters.

[0048] Therefore, the definition of the sensitive sample set S for the model y = f(W,x) is derived as follows:

[0049]

[0050] Sensitive sample set S (left side) It first calculates the L2 norm of the gradient for each sample (or loss component), then adds up the n results to measure the sum of the gradient magnitudes per sample.

[0051] Sensitive sample set S right side It directly calculates the Frobenius norm on the overall gradient matrix (combining the gradients of all samples), which is essentially equivalent to the left side and is an expression from the perspective of matrix norm.

[0052] S is a comprehensive measure of the gradient of the model parameter W, used to analyze gradient explosion / vanishing (the norm being too large / too small affects training stability) and optimizer adjustment (e.g., gradient clipping criteria).

[0053] S is the objective function for sensitive samples. There are also other constraints when generating sensitive samples. Firstly, the value of sample x is within a certain range, denoted as [p, q]. m On the other hand, the generated sensitive samples cannot differ too much from the original samples; they are samples v0 in the original dataset with a small perturbation ∈, i.e., ||x-v0|| ≤ ∈. In summary, the objective optimization function for the sensitive input v can be derived as follows:

[0054] The constraint condition is stx∈[p, q] m ∧||x-v0||≤∈;st: an abbreviation for “subject to”, meaning “restricted to” or “satisfied”, introducing the constraint condition. Taking the partial derivative of f with respect to W yields the gradient of the weight W, which reflects the rate at which the function f changes with W. It is the square of the Frobenius norm. For a matrix (where the gradient is in matrix form), the Frobenius norm is the square root of the sum of squares of the matrix elements. The squared result is the sum of squares of the elements, which is used to measure the "magnitude" of the gradient.

[0055] When inputting x (in [p,q) m Under the constraint that the difference between the interval and the original input v0 does not exceed (∈), find an x ​​such that the gradient of the model output with respect to the parameters W is as large as possible. A large gradient means that the input x has a strong influence on the model parameters. In adversarial training / attack scenarios, the core is constrained gradient maximization optimization.

[0056] Generally, each sample is associated with a subset of neurons in the model during prediction; unassociated neurons will not have their associated parameters activated during prediction. Therefore, after generating the sensitive sample set S, it is necessary to find a small subset of samples within S that can be associated with the vast majority of neurons in the model during prediction. The purpose of this is to ensure that most of the model's parameters participate in the calculation during prediction using this small subset of the dataset, making the output more sensitive to changes in the model parameters.

[0057] Example 3

[0058] Based on Example 1, in step 2, as Figure 2 As shown, the specific actions and processes for generating a hybrid dataset are as follows:

[0059] To verify the computational results returned by the model, users need to generate a hybrid dataset locally. The hybrid dataset consists of copies of the generated sensitive samples and the samples to be queried. First, the user copies each sample to be queried. Assuming there are n samples to be queried, each sample is copied m times. The number of samples in the sensitive sample set is p. Then the final size of the hybrid dataset is m·n+p.

[0060] Example 4

[0061] Based on Example 1, in step 3, the security prediction specifically includes:

[0062] To protect user privacy, this solution uses a homomorphic encryption algorithm to encrypt the samples to be predicted. Since homomorphic encryption allows computational operations on data in a dense state, the prediction results are also encrypted, thus protecting the privacy information contained within the prediction results. Before using the algorithm for encryption, the plaintext needs to be encoded. This is because previous homomorphic encryption algorithms mostly used plaintext spaces that were... A polynomial quotient ring, while the plaintext space is a complex vector space capable of supporting floating-point operations. The encoding process is as follows:

[0063] 1. From Select an element 'a' from the set and calculate φ. -1 (a), where φ is arrive Another polynomial ring quotient ring is a surjective ring;

[0064] 2. φ -1 (a)(the inverse function of φ acts on a) multiplied by a scaling factor Δ;

[0065] 3. Finally, multiply by ψ -1 Get ψ -1 (Δ·φ -1 (a)) Composite function, where ψ is arrive A full shot.

[0066] In summary, the encoding result for sample X is m(X) = ψ -1 (Δ·φ -1(a)). During encryption, the user first generates a public key locally: pk = b = (-as + e, a), where a and s are private key parameters, e is a random number, error term, or public parameter, b or pk is the public key, (-as + e, a) is a two-dimensional vector or coordinate pair, -as + e is the first component, a is the second component, and the private key is sk = (1, s), where 1 is the first component (a fixed value, identity element, or some standardized parameter), and s is the actual private key parameter used to generate the public key or perform signature / encryption operations. Then, the encoded sample is encrypted as follows:

[0067] (c1,c2)=r(b,a)+(m+e1,e2)

[0068] = (rb+m+e1, ra+e2);

[0069] Where (c1, c2) represents a two-dimensional vector, which is the encrypted result; r(b, a) represents the multiplication of scalar r and vector (b, a), where r is a random integer; and (m+e1, e2) represents another vector, composed of message m and vectors e1 and e2, where e1 and e2 are two different vectors. Upon receiving the encrypted sample, the server performs a prediction on the sample in encrypted state and returns the prediction result (c1′, c2′). The user then decrypts the prediction result.

[0070] C1′+c2′·s=rb+e1+m′+ras+e2s

[0071] =er + e1 + m′ + e2s

[0072] ≈m′;

[0073] Finally, decoding m′ will yield the prediction result.

[0074] The result correctness verification is as follows:

[0075] After receiving the results from the server, users primarily verify two aspects: model accuracy and computational correctness. Verifying model accuracy involves checking whether the output of the sensitive sample set matches expectations. Because the sensitive sample set is associated with the vast majority of neurons in the model, its output is highly sensitive to changes in model parameters. Even minor changes in model parameters can be detected through the sample output. Verifying model integrity involves... Figure 3 As shown.

[0076] The correctness of the calculation results is verified by checking whether the prediction results of all copies of the same prediction sample are consistent. If the results are inconsistent, it indicates that the server has not honestly returned the calculation results, and the user refuses to accept them.

[0077] Example 5

[0078] Based on all the above embodiments, the secure verifiability method based on deep neural networks (DNNs) includes the following steps:

[0079] A1. Sensitive sample generation;

[0080] A sensitive sample set is a set of samples carefully trained for a given DNN model. These samples are correlated with most of the model's parameters during prediction, making their output highly sensitive to changes in the model's parameters. The specific steps are as follows:

[0081] To detect modifications to model parameters, the objective of sensitive samples is to maximize the difference between the outputs of the original and modified models. Assume the model is defined as y = f(W·x), where W is the set of model parameters. The modified parameters are W + ΔW, and the corresponding output is y' = f((W + ΔW)·x). The objective function for sensitive samples is:

[0082] v = argmax x ||f(Wx)-f((W+ΔW)·x)||2

[0083] By optimizing this objective function, we can obtain the set of input samples S that is most sensitive to changes in model parameters.

[0084] Where ||·||2 represents the L2 norm of the vector.

[0085] Constraints: The range of values ​​for sample x is set to [p, q]. m .

[0086] The difference between the generated sensitive sample x' and the original sample v0 should be less than a certain threshold ε, i.e., ||x'-v0||≤ε.

[0087] Optimization function: Based on the above conditions, the objective optimization function of the sensitive input v is obtained, and the optimal solution is found while satisfying the constraints.

[0088] Selecting sensitive samples: In the generated sensitive sample set S, select samples that can be associated with most of the neurons in the model to ensure that the output is highly sensitive to changes in model parameters.

[0089] A2. Generate a mixed dataset;

[0090] To verify the calculation results returned by the server, the user generates a hybrid dataset locally. This dataset consists of copies of sensitive samples and the samples to be queried. The specific steps are as follows:

[0091] Copy the query sample: Copy each query sample. Assume there are n query samples in total, and each sample is copied m times.

[0092] Hybrid dataset: The duplicated query samples and sensitive samples are randomly mixed. Assuming the number of samples in the sensitive sample set is p, the final hybrid dataset size is m*n+p.

[0093] A3. Security Prediction

[0094] To protect user privacy, this solution uses a homomorphic encryption algorithm to encrypt the sample to be predicted and performs the prediction in the encrypted state. The specific steps are as follows:

[0095] Before homomorphically encrypting the data, the user first encodes the sample to be predicted, mapping it from complex space to a polynomial quotient ring supported by the encryption algorithm. The server then predicts the encrypted sample in encrypted form, and the returned result is decrypted and decoded by the user to obtain the original prediction result.

[0096] Plaintext encoding: Since the plaintext space of homomorphic encryption algorithms is typically a polynomial quotient ring, while the input data consists of elements in a complex vector space, plaintext encoding is necessary. The encoding process includes steps such as element selection, inverse mapping calculation, scaling, and remapping.

[0097] Encryption operation: The user generates a public key and a private key locally, encrypts the encoded sample, and obtains the encrypted sample.

[0098] Closed-state prediction: After receiving the encrypted sample, the server makes a prediction on the sample in the closed state and returns the encrypted prediction result.

[0099] Decryption and Decryption: Users decrypt and decode the received encrypted prediction results to obtain the final prediction result.

[0100] A4. Verification of the correctness of the results;

[0101] After receiving the results from the server, the user verifies the correctness of the results, including model integrity verification and calculation correctness verification. The specific steps are as follows:

[0102] Model integrity verification: Model integrity is verified by checking whether the output of the sensitive sample set matches the expectations. Since the sensitive sample set is associated with the vast majority of neurons in the model, its output is highly sensitive to changes in model parameters. Once the model parameters change, even a slight change, it can be detected through the output of the sensitive sample set.

[0103] Calculation correctness verification: The correctness of the calculation is verified by checking whether the prediction results of all copies of the same prediction sample are consistent. If the prediction results of all copies of the same prediction sample are inconsistent, it indicates that the server has not honestly returned the calculation result, and the user refuses to accept the result.

[0104] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope described in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A secure verifiability method based on deep neural networks (DNNs), characterized in that, Includes the following steps: S1. Sensitive Sample Generation: The sensitive sample set is a set of samples carefully trained for a specified model. The samples in the set can be associated with most of the model's parameters when the model makes predictions. S2. Generate a mixed dataset; Each queried sample is copied the same number of times and then randomly mixed with the sensitive sample. Users can verify whether the calculation results of all copies of the same sample are the same to confirm whether the server is honestly returning the calculation results. S3, security prediction; The user sends the model and the query sample encrypted using a homomorphic encryption algorithm to the server. Due to the nature of homomorphic encryption, the server makes a prediction on the query sample in the encrypted state and returns the encrypted result to the user. S4. Result Correctness Verification: Result correctness verification includes two parts. The first part is model integrity verification, which is verified by checking the accuracy of the prediction on the sensitive sample set. The second part is the verification of computational correctness, which is checked by examining whether the prediction results of all copies of the same sample to be predicted are consistent.

2. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, The steps for generating the sensitive sample are as follows: Define the neural network model as y = f(W, x), where W = [w1, w2, ..., w n ] is the set of all parameters of the neural network model, where x is a sample; by optimizing the objective function Generate sensitive samples and optimize the objective function to maximize the difference in output between the original model and the model after parameter perturbation.

3. The secure verifiability method based on a deep neural network (DNN) according to claim 2, characterized in that, The generation of the sensitive samples satisfies the following constraints: The range of values ​​for sample x is [p, q]. m And the difference between the sample v0 and the original dataset satisfies ||x-v0||≤∈, where ∈ is the perturbation value.

4. The secure verifiability method based on a deep neural network (DNN) according to claim 2, characterized in that, The size of the hybrid dataset is m·n+p, where n is the number of samples to be queried, m is the number of copies of a single sample, and p is the number of samples in the sensitive sample set.

5. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, The plaintext encoding process of the homomorphic encryption algorithm includes: From complex vector space Choose element a, and map it to the polynomial quotient ring via surjective φ and ψ. And a scaling factor Δ is introduced to complete the encoding.

6. The secure verifiability method based on a deep neural network (DNN) according to claim 5, characterized in that, The encryption process is implemented using the public key pk = b = (-as + e, a) and the private key sk = (1, s). The encryption result is (c1, c2) = r(b, a) + (m + e1, e2), where r is a random integer and e1 and e2 are two vectors.

7. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, Model integrity verification is achieved by detecting the consistency between the predicted output and the expected output of a sensitive sample set, which covers the correlation parameters of most neurons in the model.

8. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, The judgment condition for verifying the correctness of the calculation is: if the prediction results of all copies of the same queried sample are inconsistent, the server is judged to return an incorrect result.

9. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, The generation of the sensitive sample set requires screening samples that can be associated with most neurons of the model to ensure that the output is highly sensitive to parameter changes.

10. The secure verifiability method based on a deep neural network (DNN) according to claim 1, characterized in that, It is applied in federated learning scenarios to verify the privacy of sensitive data on cloud servers and the integrity of the inference process.

Images