Security reasoning method and system for privacy protection machine learning

Abstract

The invention discloses a security reasoning method and system for privacy protection machine learning, and relates to the technical field of privacy protection machine learning, and the method comprises the steps: calculating a secret share according to a model input matrix and sand secret sharing and random vector compression secret sharing of model parameters, reconstructing a secret value and packaging to obtain TP secret sharing of a model linear layer operation result; the method comprises the following steps of: performing mask calculation on an input matrix of a nonlinear layer in TP secret sharing by adopting a random number to obtain a mask random number, calculating TP secret sharing at a first different position in bit representation of the mask random number and a required mask random number so as to determine the highest bit of the input matrix of the nonlinear layer, calculating an RELU function, and calculating a truncation result according to the RELU function, and a nonlinear layer output result is obtained based on a truncation result and a random mask in TP secret sharing, so that the communication and calculation overhead of a security reasoning online stage is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy protection machine learning, in particular to a secure inference method and system for privacy protection machine learning. BACKGROUND

[0002] The statements in this section merely provide background information related to the present application and do not necessarily constitute the prior art.

[0003] Among the numerous branches of privacy protection machine learning (PPML), secure inference aims to solve a common application scenario, i.e., a user (client) expects to use a high-performance pre-trained model pre-deployed by a service party (server) to perform computation or analysis on its private data, and obtain the service result. The core goal of such technology is to achieve a two-way privacy guarantee: ensure that the client can obtain correct model inference output on the premise that its sensitive original data is kept secret from the server; at the same time, the key information such as the proprietary model architecture and parameters possessed by the server will not be leaked to the client (except for the information inherently inferred from the final calculation result) in this process. However, how to ensure that this dual privacy goal is achieved while taking into account the computational efficiency and scalability of the scheme is still a technical difficulty and challenge faced by the field.

[0004] To address the above challenges, cryptographic theories and technologies such as secure multi-party computation (MPC) provide important solutions. MPC technology enables n mutually distrustful participants to collaboratively complete the computation of a certain function without exposing their private original data to other participants, and to obtain the output result of the function together, without any party being able to obtain additional information other than its input and the final output. Based on MPC and related cryptographic tools, a secure inference protocol can be constructed, which enables the client to obtain model prediction services from the server without exposing its specific input content, and the server also does not need to worry about the unauthorized access or leakage of its model's core intellectual property rights, thereby guaranteeing the confidentiality of the model parameters.

[0005] Existing secure inference protocols based on multi-party computation, especially those designed for a large number of participants, still face significant performance and security challenges. A key problem lies in the computation of secure nonlinear layers, such as ReLU activation functions and maximum pooling Maxpool, which are key components of neural networks. These operations often result in high communication and computation overhead.

[0006] The method of calculating nonlinear layers based on packed secret sharing (PS) cannot tolerate the maximum number of malicious actors under semi-honest security in an honest majority setting. This greatly weakens the security of secure inference protocols and hinders the wider deployment of neural network models. Summary of the Invention

[0007] To address the aforementioned issues, this invention proposes a secure inference method and system for privacy-preserving machine learning. It provides an efficient secure inference method based on Turbopack (TP) secret sharing technology, which significantly reduces the communication and computational overhead during the online phase of secure inference and provides semi-honest security guarantees against the largest number of malicious participants.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a secure inference method for privacy-preserving machine learning, comprising: Each sub-participant calculates a random vector compressed secret share according to the invoked hybrid random number generation protocol; each sub-participant calculates a secret share based on its own Shamir secret share of the model input matrix, the Shamir secret share of the model parameters, and the random vector compressed secret share, so that the main participant can reconstruct the secret value and package it to obtain the TP secret share of the model linear layer operation results; For the input matrix of the nonlinear layer in TP secret sharing, a mask is calculated using random numbers to obtain a mask random number. The first different position in the bit representation of the mask random number and the required mask random number is calculated as the TP secret sharing, and the highest bit of the input matrix of the nonlinear layer is determined based on this. The ReLU function is calculated based on the highest bit of the input matrix of the nonlinear layer, and the truncation result is calculated based on the ReLU function. The Shamir secret sharing of the nonlinear layer operation result is generated based on the truncation result and the random mask in TP secret sharing.

[0009] As an alternative implementation, all sub-parties compute locally. ;in, It is generated through secret sharing of 0. Obtained; for The TP secret is shared for each element in the resulting vector; For the first Group input lines; The Shamir secret is shared for each element of the input matrix X; For input vectors The secret sharing of each element of Shamir; TP secret sharing random masking part main participant collects all secret shares and reconstructs the secret value , the is packed into a block vector , as the TP secret sharing of the operation result of the model linear layer.

[0010] As an optional implementation, in the process of determining the first different position in the bit representation of the mask random number and the required mask random number, the mask random number and the required mask random number are calculated and XOR , and 01 bit string is obtained through the forward XOR algorithm , the first bit of the bit string is 0, and the following positions are all 1, and only the first bit is 1 and the other positions are all 0 through subtraction between bits .

[0011] As an optional implementation, let the sequence input to be , where , and the output sequence is , ). The specific process is as follows: For , calculate ; Let , for to : for to , calculate ; If : execute the multiplication protocol ; ; Let , for to 1: for to : calculate ; If : all participants execute the multiplication protocol ; ; For : calculate ; After the above step is completed, the ; for : calculate ; .

[0012] As an alternative implementation, call the multiplication protocol , and calculate ; call the multiplication protocol again to calculate the RELU function: , .

[0013] As an alternative implementation, the process of generating Shamir secret sharing of the nonlinear layer operation result includes: Call the truncated random number generation protocol ; Calculate ; Collect the complete compressed sharing of from all sub-participants , and reconstruct , then calculate the public value ; Calculate the truncated result ; For , generate Shamir secret sharing and distribute the shares to other sub-participants; For , all sub-participants locally calculate .

[0014] In a second aspect, the present application provides a secure inference system for privacy-preserving machine learning, comprising: A linear layer protocol module configured to calculate a compressed secret sharing of a random vector by each sub-participant according to the called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameters and the compressed secret sharing of the random vector held by each sub-participant, to reconstruct the secret value by the main participant and pack to obtain the TP secret sharing of the model linear layer operation result; A nonlinear layer protocol module configured to mask calculate the input matrix of the nonlinear layer in the TP secret sharing with a random number to obtain a masked random number, calculate the TP secret sharing of the first different position in the bit representation of the required masked random number, and determine the highest bit of the input matrix of the nonlinear layer according to the first different position, calculate the RELU function according to the highest bit of the input matrix of the nonlinear layer, calculate the truncated result according to the RELU function, and generate the Shamir secret sharing of the nonlinear layer operation result based on the truncated result and the random mask in the TP secret sharing.

[0015] In a third aspect, the present application provides an electronic device comprising a memory and a processor, and computer instructions stored on the memory and running on the processor, when the computer instructions are run by the processor, the method of the first aspect is completed.

[0016] In a fourth aspect, the present application provides a computer readable storage medium for storing computer instructions, when the computer instructions are executed by the processor, the method of the first aspect is completed.

[0017] In a fifth aspect, the present application provides a computer program product comprising a computer program, when the computer program is executed by the processor, the method of the first aspect is completed.

[0018] Compared with the prior art, the present application has the following beneficial effects: The present application provides a secure inference method and system for privacy protection machine learning, provides an efficient secure inference method based on Turbopack (TP) secret sharing technology, calculates secret shares according to Shamir secret sharing of model input matrix and model parameters and random vector compression secret sharing, reconstructs the secret value and packs to obtain the TP secret sharing of the model linear layer operation result; for the input matrix of the nonlinear layer in the TP secret sharing, the random number is used for mask calculation to obtain the mask random number, the TP secret sharing of the first different position in the bit representation of the mask random number and the required mask random number is calculated, so as to determine the highest bit of the input matrix of the nonlinear layer, calculate the RELU function, calculate the truncation result according to the RELU function, obtain the nonlinear layer output result based on the truncation result and the random mask in the TP secret sharing, greatly reduce the communication and calculation overhead of the online stage of the secure inference, and provide semi-honest security guarantee for the maximum number of malicious participants.

[0019] The security limitation of the current protocol for calculating the nonlinear layer based on the compression secret sharing technology is derived from its dependence on the general DN multiplication on the compression secret sharing. Satisfy And , resulting in There is a gap between the corruption threshold ( ). Therefore, the present application introduces an enhanced method, replaces PS in the nonlinear layer with a TurboPack method, and calculates the multiplication gate using the compression Beaver triple, which adjusts the security to reach the standard threshold under the honest majority setting.

[0020] The advantages of the additional aspects of the present application will be partially given in the following description, partially will become obvious from the following description, or will be understood through the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the accompanying drawings in the following description only aim at the embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of the provided drawings.

[0022] Figure 1 A flow chart of a secure inference method for privacy-preserving machine learning is provided for Embodiment 1 of the present application. DETAILED DESCRIPTION

[0023] The present application will be further described below in conjunction with the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs.

[0025] It should be noted that the terms used herein are only intended to describe specific embodiments, and are not intended to limit the exemplary embodiments according to the present application. As used herein, the singular form is intended to include the plural form unless the context clearly indicates otherwise, and it should also be understood that the terms "comprise" and "include" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] The embodiments in the present application and the features in the embodiments can be combined with each other without conflict.

[0027] Embodiment 1 The present embodiment proposes a secure inference method for privacy-preserving machine learning, as shown in Figure 1 The method comprises the following steps: Each sub-participant calculates a random vector compressed secret sharing according to the called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameters and the random vector compressed secret sharing held by each sub-participant, so as to reconstruct the secret value by the main participant and obtain the TP secret sharing of the model linear layer operation result; For the input matrix of the nonlinear layer in TP secret sharing, a mask is calculated using random numbers to obtain a mask random number. The first different position in the bit representation of the mask random number and the required mask random number is calculated as the TP secret sharing, and the highest bit of the input matrix of the nonlinear layer is determined based on this. The ReLU function is calculated based on the highest bit of the input matrix of the nonlinear layer, and the truncation result is calculated based on the ReLU function. The Shamir secret sharing of the nonlinear layer operation result is generated based on the truncation result and the random mask in TP secret sharing.

[0028] The method in this embodiment mainly includes a linear layer protocol based on Shamir secret sharing (SS) and embedding SS-TP conversion, and a nonlinear layer protocol based on TP and embedding TP-SS conversion. These will be described in detail below.

[0029] In this embodiment, the use of lowercase letters is first defined (e.g., ) represents a scalar, using uppercase letters (e.g., ...). ) represents a matrix, where, express The first in the matrix Line number Elements of the column. Use bold lowercase letters (e.g., ...). ) represents a vector, where Representing vectors The Each component. Similarly, and Each represents all elements as equal to 1. and The vector. Unless otherwise stated, all vector operations are element-wise. For example, ,Right now and The Hadama pile.

[0030] For the sake of brevity, let For set , For set .

[0031] The protocol is based on a finite field Above, among them It is a Mersenne prime. A Mersenne prime is represented as... Examples include and .

[0032] The protocol uses both standard Shamir secret sharing and TP compressed secret sharing.

[0033] and respectively represent the SS and TP of the compressed secrets in TP.

[0034] In this embodiment, a linear layer protocol based on SS and embedded SS-TP conversion is used: there are parties , each of which holds Shamir secret shares of input matrix and Shamir secret shares of model parameters , where , , and set . The TP secret sharing of linear layer operation result is obtained, where .

[0035] (1) All parties call a hybrid random number generation protocol to generate groups , where ; is the compressed secret sharing of random vector ; is the Shamir secret sharing of random value ; is the input line, represents the group of input lines, represents the input line in the group of input lines.

[0036] The specific construction of the hybrid random number generation protocol is as follows: In the preprocessing phase, prepare Shamir secret shares and compressed secret shares , where , indicating that all secrets stored in the compressed secret sharing are .

[0037] Subsequently, all parties locally calculate compressed secret shares , where is the group of compressed secret shares. ​a unit vector with 1 at the i-th position and 0 at other positions. Then all participants perform the degree reduction protocol reduce the degree of to . Where is calculated in the same way as , and to avoid too much confusion from too many nested subscripts, we do not use the notation .

[0038] (2) All participants locally compute for . Where is obtained by secret sharing of 0; where is the Shamir secret share of the i-th element of the result vector ; and is the Shamir secret share of the i-th element of the input vector ; and is the i-th input wire; is the Shamir secret share of each element of the input matrix X; is the Shamir secret share of each element of the input vector ; and is the random mask part in the TP secret share .

[0039] (3) Collect all secret shares and reconstruct the secret value for .

[0040] If , pack into a block vector as a TP secret share. When , use zero padding.

[0041] In this embodiment, based on the TP and embedded TP-SS conversion nonlinear layer protocol, there are participants in the protocol, and the input of the nonlinear layer is a matrix , where represents an input wire, and each participant holds a TP secret share of the input matrix (i.e. ), is the random mask part in the TP secret share.

[0042] Participants jointly hold the compressed secret share of , for convenience of representation, it is assumed that the size of the input matrix is equal to the compression factor Finally, the output matrix of the nonlinear layer is obtained. Standard Shamir Secret Sharing , .

[0043] The truncation function is: ; The RELU function is: ; Where b is the exponent.

[0044] Among them, to calculate First calculate derivative , equivalent to calculation highest bit On the Mersenne prime field, ,in It is 2 The lowest bit.

[0045] To calculate First, use random numbers. mask ,get Then Publicly available on the Mersenne prime field ,in yes The lowest bit, yes The lowest bit, ,if Conversely, it is 0.

[0046] To calculate Using the bitwise comparison algorithm (LT), the bitwise comparison algorithm (LT) finds... and The first distinct position represented by the bit, if If the value at that position is 1, then... , and vice versa is 1.

[0047] To find and The first distinct position represented by the bit (assuming this is the first...) (bit), first calculate and Each and XOR Then on A 0-1 bit string is obtained by using the forward XOR algorithm (POR). The beginning of this string bit string with the first bit being 0 and the rest being 1, then only a simple bit-by-bit subtraction is needed to obtain a bit string with the first bit being 1 and the rest being 0 bit string with the first bit being 1 and the rest being 0 .

[0048] Specifically: (1) by calling a random bit generation protocol learn . Among them, , and .

[0049] Among them, is the TP sharing of the mask random number needed in the subsequent; is the secret sharing of each bit of the mask random number needed in the subsequent; is the i-th bit of the mask random number ; is the random mask part of the TP sharing .

[0050] (2) Calculate , where is the secret sharing of .

[0051] (3)-(6) Perform a bit-by-bit comparison algorithm to calculate the secret sharing of .

[0052] (3) Collect the compressed shares of from all participants , and reconstruct ; where the subscript represents the circuit, y and t represent different circuits; Then calculate the public value ; Calculate .

[0053] (4) For : Calculate ; is the TP sharing of .

[0054] (5) Perform a forward XOR algorithm on , which is based on the form of its TP sharing. ​

[0055] (5) , compute .

[0056] Let the sequence input to be , where , and the output sequence be , ); The detailed procedure is as follows: (5-1) For : Compute .

[0057] (5-2) Let . For to : For to (parallel execution): Compute . If : All parties perform the multiplication protocol ; .

[0058] (5-3) Let . For to 1: For to (parallel execution): Compute . If : All parties perform the multiplication protocol ; .

[0059] (5-4) For : Compute .

[0060] Thus, after this step, learns ; For : Compute ; Compute .

[0061] (6) Compute .

[0062] (7) Step , and is based on its TP sharing form to complete the calculation.

[0063] (7) Call multiplication protocol , and compute .

[0064] (8) Step computation , and is based on the TP sharing form to complete the computation.

[0065] (8) Call multiplication protocol , .

[0066] (9)-(12) Step computation truncated result , since this truncation protocol is a classic truncation method and is not the innovation point of the patent, so it is not described in detail here.

[0067] (9) Call truncated random number generation protocol .

[0068] Among them, , , And .

[0069] (10) Compute .

[0070] (11) Collect the complete compressed share of from all participants , and reconstruct . Then Compute the public value .

[0071] (12) Compute the truncated result .

[0072] (13) For , Generate Shamir secret sharing and distribute the shares to other participants.

[0073] (14) For , all participants locally compute .

[0074] It should be noted that all data acquisition is based on compliance with laws and regulations and user consent, and legal application is made to the data.

[0075] Embodiment 2 The embodiment provides a secure inference system for privacy-preserving machine learning, comprising: a linear layer protocol module configured to calculate, by each sub-participant, a random vector compressed secret sharing according to a called hybrid random number generation protocol; and calculate, by each sub-participant, a secret share according to Shamir secret sharing of a model input matrix and Shamir secret sharing of model parameters and the random vector compressed secret sharing, so as to reconstruct, by a main participant, a secret value and pack a TP secret sharing of a model linear layer operation result; a nonlinear layer protocol module configured to calculate, by using a random number, a mask of an input matrix of a nonlinear layer in the TP secret sharing, obtain a mask random number, calculate a TP secret sharing of a first different position in a bit representation of the mask random number and a required mask random number, and determine a highest bit of the input matrix of the nonlinear layer according to the TP secret sharing, calculate a RELU function according to the highest bit of the input matrix of the nonlinear layer, calculate a truncation result according to the RELU function, and generate, based on the truncation result and the random mask in the TP secret sharing, a Shamir secret sharing of a nonlinear layer operation result.

[0076] It should be noted that the above modules correspond to the steps described in Embodiment 1, and the above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules can be executed in a computer system such as a set of computer executable instructions as part of the system.

[0077] In more embodiments, the following are also provided: An electronic device comprising a memory and a processor and computer instructions stored on the memory and running on the processor, when the computer instructions are run by the processor, the method described in Embodiment 1 is completed. For brevity, this will not be repeated here.

[0078] It should be understood that in the embodiment, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSPs, application-specific integrated circuits ASICs, ready-to-program gate arrays FPGA or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0079] The memory can include read-only memory and random access memory, and provide instructions and data to the processor, and a part of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0080] A computer readable storage medium for storing computer instructions, when the computer instructions are executed by a processor, the method described in Embodiment 1 is completed.

[0081] The method in embodiment 1 can be directly embodied as being completed by a hardware processor or being completed by a combination of hardware and software modules in the processor. The software modules can be located in a storage medium mature in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, or the like. The storage medium is located in a memory, and a processor reads information in the memory and completes the steps of the above method in combination with hardware. To avoid repetition, no longer detailed description is made herein.

[0082] A computer program product includes a computer program, which, when executed by a processor, implements the method described in embodiment 1.

[0083] The present application also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer executable instructions, for example, instructions embodied in program modules, executed by devices at a target real or virtual processor to perform processes / methods as described above. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In various embodiments, the functionality of program modules can be combined or split between program modules as desired. Machine executable instructions for program modules can be executed within a local or distributed device. In a distributed device, program modules can be located in local and remote storage media.

[0084] Computer program code for carrying out operations of the present application can be written in one or more programming languages. These computer program code can be provided to a processor of a general purpose computer, a special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the computer or other programmable data processing apparatus, cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code can be entirely on the computer, partially on the computer, as a stand-alone software package, partially on the computer and partially on a remote computer, or entirely on a remote computer or server.

[0085] In the context of the present application, computer program code or related data can be carried by any suitable carrier to enable a device, apparatus or processor to perform various processes and operations described above. Examples of carriers include signals, computer readable media, and the like. Examples of signals can include electrical, optical, radio, sound or other forms of propagated signals, such as carrier waves, infrared signals, and the like.

[0086] Those skilled in the art can appreciate that the units and algorithm steps of the examples described in combination with the embodiments can be realized in electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0087] The above describes the specific embodiments of the application in combination with the drawings, but is not a limitation on the protection scope of the application. Those skilled in the art should understand that various modifications or variations made by those skilled in the art on the basis of the technical solutions of the application without creative labor are still within the protection scope of the application. In order to solve the above problems, the application proposes a secure inference method and system for privacy protection machine learning, provides an efficient secure inference method based on Turbopack (TP) secret sharing technology, greatly reduces the communication and calculation overhead of the online stage of secure inference, and provides semi-honest security guarantee for the maximum number of malicious participants.

[0088] In order to achieve the above object, the application adopts the following technical solutions: In a first aspect, the application provides a secure inference method for privacy protection machine learning, comprising: Each sub-participant calculates a random vector compressed secret sharing according to the called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameter and the random vector compressed secret sharing held by each sub-participant, to reconstruct a secret value by the main participant and pack to obtain a TP secret sharing of the model linear layer operation result; For the input matrix of the non-linear layer in the TP secret sharing, a random number is used for mask calculation to obtain a mask random number, and the TP secret sharing of the first different position in the bit representation of the mask random number and the required mask random number is calculated, and the highest bit of the input matrix of the non-linear layer is determined according to this, the RELU function is calculated according to the highest bit of the input matrix of the non-linear layer, the truncation result is calculated according to the RELU function, and the Shamir secret sharing of the non-linear layer operation result is generated based on the truncation result and the random mask in the TP secret sharing.

[0089] As an optional implementation, all sub-participants locally calculate ; wherein, is obtained by secret sharing of 0; is the result vector of is the TP secret sharing of each element in the result vector of is the TP secret sharing of the first ​group input line; Shamir secret sharing of each element of input matrix X; Shamir secret sharing of each element of input vector ; TP secret sharing of random mask part in ; The main participant collects all secret shares and reconstructs the secret value , packs it into block vector as TP secret sharing of the result of model linear layer operation.

[0090] As an optional implementation, in the process of determining the first different position in the bit representation of the mask random number and the required mask random number, the XOR of each bit of the mask random number and the required mask random number is calculated and ; Through the forward XOR algorithm, a 01 bit string is obtained , the first bit of which is 0 and the subsequent positions are all 1, and through the subtraction between bits, only the first bit is 1 and the other positions are all 0 . .

[0091] As an optional implementation, let the sequence input to be , where , and the output sequence be , ); The specific process is as follows: For , calculate ; Let , for to : for to , calculate ; If : execute multiplication protocol ; ; Let , for to 1: for to , calculate ; If : all participants execute multiplication protocol​​ ; .

[0092] For : compute ; After the above step is completed, it is known that ; for : compute ; .

[0093] As an alternative embodiment, the multiplication protocol is called and is computed; the multiplication protocol is called again to compute the RELU function: , .

[0094] As an alternative embodiment, the process of generating Shamir secret sharing of the operation result of the nonlinear layer includes: The truncated random number generation protocol is called; Compute ; Collect the complete compressed sharing of from all sub-participants , and reconstruct , then compute the public value ; Compute the truncated result ; For , generate Shamir secret sharing and distribute the shares to other sub-participants; For , all sub-participants locally compute .

[0095] In a second aspect, the present application provides a secure inference system for privacy-preserving machine learning, comprising: A linear layer protocol module configured to calculate a compressed secret sharing of a random vector by each sub-participant according to the called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameters held by each sub-participant and the compressed secret sharing of the random vector, to reconstruct the secret value by the main participant and pack to obtain the TP secret sharing of the operation result of the model linear layer; The nonlinear layer protocol module is configured to perform a mask calculation on an input matrix of a nonlinear layer in the TP secret sharing by using a random number, obtain a mask random number, calculate a TP secret sharing of a first different position in a bit representation of the mask random number and a required mask random number, determine a highest bit position of the input matrix of the nonlinear layer according to the TP secret sharing, calculate a RELU function according to the highest bit position of the input matrix of the nonlinear layer, calculate a truncation result according to the RELU function, and generate a Shamir secret sharing of a nonlinear layer operation result based on the truncation result and the random mask in the TP secret sharing.

[0096] In a third aspect, the present application provides an electronic device, comprising a memory and a processor, and computer instructions stored in the memory and running on the processor, when the computer instructions are run by the processor, the method of the first aspect is completed.

[0097] In a fourth aspect, the present application provides a computer readable storage medium for storing computer instructions, when the computer instructions are executed by a processor, the method of the first aspect is completed.

[0098] In a fifth aspect, the present application provides a computer program product comprising a computer program, when the computer program is executed by a processor, the method of the first aspect is completed.

[0099] Compared with the prior art, the present application has the following beneficial effects: The present application provides a secure inference method and system for privacy protection machine learning, provides an efficient secure inference method based on Turbopack (TP) secret sharing technology, calculates secret shares according to Shamir secret sharing of model input matrix and model parameters and random vector compression secret sharing, reconstructs the secret value and packs to obtain the TP secret sharing of the model linear layer operation result; for the input matrix of the nonlinear layer in the TP secret sharing, a random number is used for mask calculation to obtain a mask random number, the TP secret sharing of the first different position in the bit representation of the mask random number and the required mask random number is calculated, the highest bit position of the input matrix of the nonlinear layer is determined, the RELU function is calculated, the truncation result is calculated according to the RELU function, the nonlinear layer output result is obtained based on the truncation result and the random mask in the TP secret sharing, the communication and calculation overheads of the online stage of the secure inference are greatly reduced, and semi-honest security is provided for the maximum number of malicious participants.

[0100] The security limitation of the current nonlinear layer protocol based on compression secret sharing technology is derived from its dependence on the general DN multiplication on the compression secret sharing, which requires the share degree number to satisfy and , resulting in and the corruption threshold There is a gap between Thus, the present application introduces an enhancement method, replacing the PS in the non-linear layer with a TurboPack method, which computes the multiplication gate using compressed Beaver triples, this adjustment brings the security to the standard threshold under the honest majority setting.

[0101] Advantages of the additional aspects of the application will become apparent from the following description.

Claims

1. A secure inference method for privacy-preserving machine learning, characterized in that, The method comprises the following steps: Each sub-participant calculates a random vector compressed secret sharing according to a called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameter and the random vector compressed secret sharing held by each sub-participant, so as to reconstruct a secret value by the main participant and obtain a TP secret sharing of a model linear layer operation result; The input matrix of the nonlinear layer in the TP secret sharing is masked and calculated by using a random number to obtain a mask random number, the TP secret sharing of the first different position in the bit representation of the mask random number and the required mask random number is calculated, and the highest bit of the input matrix of the nonlinear layer is determined according to the calculation result; the RELU function is calculated according to the highest bit of the input matrix of the nonlinear layer; the truncated result is calculated according to the RELU function; and the Shamir secret sharing of the nonlinear layer operation result is generated based on the truncated result and the random mask in the TP secret sharing.

2. The secure inference method for privacy-preserving machine learning of claim 1, wherein, All child-parties compute locally ; wherein, is generated by a secret sharing of 0 ; is a TP secret sharing of the result vector ; is the input vector ; is a Shamir secret sharing of each element of the input matrix X; is a Shamir secret sharing of each element of the input vector ; is a random mask part of the TP secret sharing ; The master participant collects all the secret shares and reconstructs the secret value , the packed into a block vector , the TP secret sharing as a model linear layer operation result.

3. The secure inference method for privacy-preserving machine learning of claim 1, wherein, In the process of determining the first different position in the bit representation of the mask random number and the demand mask random number, the mask random number is calculated and the demand mask random number Each bit and XOR , to Get the 01 bit string through the forward XOR algorithm The first bit of the bit string is 0, and the following positions are all 1, and only the first bit is 1 and the other positions are all 0 through subtraction between bits .

4. The secure inference method for privacy-preserving machine learning of claim 3, wherein, Let the input sequence to be where , and the output sequence be , ); The specific process is as follows: For , compute ; Set , for to : for to , compute ; If : performing a multiplication protocol ; ; Set For to 1 : For to : Calculate ; If : all participants perform a multiplication protocol ; ; For : compute ; After the above step is completed, it is known that ; for : the calculation ; .

5. The secure inference method for privacy-preserving machine learning of claim 1, wherein, Calling a multiplication protocol and computing ; The multiplication protocol is invoked again to compute the RELU function: , .

6. The secure inference method for privacy-preserving machine learning of claim 1, wherein, The process of generating the Shamir secret sharing of the nonlinear layer operation result comprises the following steps: Invoking a truncated random number generation protocol ; Computing ; collecting complete compressed shares from all sub-parties and reconstructing the public value ; Computing the truncated result ; For , a Shamir secret share is generated and distributed to the other child-participants; For , all sub-parties locally compute .

7. A secure inference system for privacy-preserving machine learning, characterized in that, The method comprises the following steps: The linear layer protocol module is configured to calculate a random vector compressed secret sharing by each sub-participant according to a called hybrid random number generation protocol; each sub-participant calculates a secret share according to the Shamir secret sharing of the model input matrix and the Shamir secret sharing of the model parameter and the random vector compressed secret sharing held by each sub-participant, so as to reconstruct a secret value by the main participant and obtain a TP secret sharing of a model linear layer operation result; The nonlinear layer protocol module is configured to mask and calculate the input matrix of the nonlinear layer in the TP secret sharing by using a random number to obtain a mask random number, calculate the TP secret sharing of the first different position in the bit representation of the mask random number and the required mask random number, and determine the highest bit of the input matrix of the nonlinear layer according to the calculation result; calculate the RELU function according to the highest bit of the input matrix of the nonlinear layer; calculate the truncated result according to the RELU function; and generate the Shamir secret sharing of the nonlinear layer operation result based on the truncated result and the random mask in the TP secret sharing.

8. An electronic device, comprising: The computer program product comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor, and when the computer instructions are executed by the processor, the method in any one of claims 1-6 is completed.

9. A computer-readable storage medium, characterized in that, The computer program product comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor, and when the computer instructions are executed by the processor, the method in any one of claims 1-6 is completed.

10. A computer program product, characterised in that, The computer program product comprises a memory and a processor, and computer instructions stored in the memory and executed on the processor, and when the computer instructions are executed by the processor, the method in any one of claims 1-6 is completed.

Images