A private AI model calling method and system based on encrypted data interaction

Abstract

The application belongs to the technical field of artificial intelligence, and particularly relates to a private AI model calling method and system based on encrypted data interaction, which comprises the following steps: S1, a client generates a series of structured random numbers through a key derivation function based on a main random number seed and each dimension index, encrypts an original input vector into an initial ciphertext vector by using a partial homomorphism encryption public key and the structured random numbers, generates a conditional re-encoding key pair for nonlinear calculation in the AI model, and sends a re-encoding public key to a server. The application can eliminate the confusion ciphertext, so that the server side constructs a quasi-gradient noise based on the intermediate state of the calculation process and injects the result, resisting side channel attacks on the output ciphertext; and the client can reconstruct and remove the noise, so that the lossless calling result is obtained without sacrificing any calculation accuracy, and end-to-end privacy protection of the whole model reasoning process is realized.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically relating to a method and system for invoking a private AI model based on encrypted data interaction. Background Technology

[0002] To leverage powerful cloud-based models for inference, users need to upload sensitive data that may contain personal privacy information, such as medical images, financial records, and facial recognition data, to untrusted servers. Homomorphic encryption, as a core cryptographic tool, allows direct computation on ciphertext data, thus theoretically providing data protection throughout the entire computation process.

[0003] However, fully homomorphic encryption requires enormous computational overhead and communication bandwidth. While some homomorphic encryption schemes are more efficient at performing linear operations such as addition and scalar multiplication, they cannot directly support the nonlinear activation functions prevalent in neural networks. Polynomial approximation, such as using Taylor expansion or interpolation polynomials to approximate the activation function, inevitably introduces computational errors, thus reducing the model's prediction accuracy. Interactive protocols such as secure multi-party computation or obfuscated circuits require multiple rounds of communication between the client and server when performing nonlinear computations, increasing network latency and making them unsuitable for real-time inference scenarios. Furthermore, in the homomorphic computation of multi-layer neural networks, ciphertext noise accumulates with linear operations, and if left uncontrolled, it may exceed the decryption threshold, leading to computation failure.

[0004] Existing noise management mechanisms struggle to provide finer control based on the actual computation path. Even if both the model's input and output are in encrypted form, the server can still launch attacks such as gradient inversion by analyzing intermediate states or returned encrypted patterns during the computation process, thereby stealing sensitive information from user input. Summary of the Invention

[0005] This invention provides a method and system for invoking a private AI model based on encrypted data interaction, in order to solve the technical problems of insufficient efficiency, accuracy, noise control and security protection in cloud inference of sensitive data in the prior art.

[0006] In a first aspect, the present invention provides a method for invoking a private AI model based on encrypted data interaction, comprising the following steps:

[0007] S1: The client generates a series of structured random numbers based on the master random number seed and the indexes of each dimension through the key derivation function. It uses a partially homomorphic encryption public key and the structured random numbers to encrypt the original input vector into an initial ciphertext vector, and generates a conditional recoding key pair for nonlinear calculations in the AI ​​model. The recoding public key is then sent to the server.

[0008] S2, the server performs layer-by-layer calculations on the received initial ciphertext vector: in the linear computation layer, homomorphic multiplication and addition are performed, and the aggregation noise evaluation factor is calculated based on the preset correlation of each structured random number participating in the homomorphic addition; in the nonlinear activation function layer, the recoding public key is called to perform conditional recoding on the intermediate ciphertext output by the linear computation layer to realize the activation function calculation, and generate an activation state code representing the sparsity of neuron activation.

[0009] S3, after the server obtains the ciphertext of the prediction result, it uses a pseudo-gradient noise to obtain the decoupling ciphertext. The pseudo-gradient noise is calculated based on virtual anchor point data.

[0010] S4, the server homomorphically adds the obfuscated ciphertext and the predicted ciphertext, and returns the resulting output ciphertext, activation status code, and arithmetic mean to the client. The client uses its private key to decrypt the output ciphertext, and reconstructs the virtual anchor data consistent with the server based on the received activation status code and arithmetic mean, and then calculates the pseudo-gradient noise. The pseudo-gradient noise is subtracted from the decryption result to obtain the AI ​​model call result.

[0011] Furthermore, based on the master random number seed and the indices of each dimension, the client generates a series of structured random numbers using a key derivation function, including:

[0012] A hash-based message authentication code key derivation function is used, with the master random number seed as the input key material and the indices of each dimension of the input vector as salt values, to generate a deterministic structured random number r for each dimension index i. i .

[0013] Furthermore, based on the preset correlation of each structured random number participating in the homomorphic addition, the aggregation noise evaluation factor is calculated, including:

[0014] For a linear computation layer that multiplies the model weight vector W with the input ciphertext vector C, the aggregate noise evaluation factor F is calculated using the following formula: in As weight.

[0015] Furthermore, the recoding public key is invoked to perform conditional recoding on the intermediate ciphertext output by the linear computation layer to compute the activation function and generate activation state codes representing the sparsity of neuron activation, including:

[0016] To implement the ReLU activation function, the client pre-generates a ciphertext Enc(0) of 0 and sends it to the server along with the re-encoding public key. The server securely compares the intermediate ciphertext Enc(x) output from the linear computation layer with Enc(0). If x < 0, the re-encoding public key is used to re-encode Enc(x) into Enc(0), and the activation state code of the neuron is recorded as 0. If x ≥ 0, Enc(x) remains unchanged, and the activation state code is recorded as 1.

[0017] Furthermore, the virtual anchor data is selected from the candidate anchor set using activation state codes and generated by slightly perturbing the arithmetic mean of the aggregated noise evaluation factors obtained from all linear computation layers, specifically:

[0018] The activation state codes generated by all nonlinear activation function layers are concatenated into a binary string. The hash value of the binary string is calculated using the SHA-256 hash function, and the hash value is modulo the size of the candidate anchor set to obtain an index, which is used to deterministically select an anchor data point from the candidate anchor set. Given L linear computation layers, the aggregate noise evaluation factor for all linear computation layers is calculated. arithmetic mean l=1, ..., L: ;

[0019] Add a small perturbation to each numerical component of the selected anchor point data. Generate virtual anchor point data, where It is a preset tiny positive number.

[0020] Furthermore, the pseudo-gradient noise is calculated based on virtual anchor point data, including:

[0021] Using virtual anchor point data as input, a virtual output is obtained through forward propagation of the AI ​​model. Using virtual labels preset in virtual output and virtual anchor data Substitute into the mean square error loss function : Calculate the gradient of the loss function with respect to the output of the last layer of the AI ​​model. The gradient value is used as pseudo-gradient noise.

[0022] Furthermore, the server homomorphically adds the obfuscated ciphertext and the predicted ciphertext, and returns the resulting output ciphertext, activation status code, and arithmetic mean to the client, including:

[0023] The server uses a partially homomorphic encryption public key to encrypt the calculated pseudo-gradient noise N, obtaining the obfuscated ciphertext Enc(N). The obfuscated ciphertext Enc(N) is then combined with the AI ​​model's prediction ciphertext Enc(P) using a homomorphic addition operation to obtain the output ciphertext Enc(P+N). Finally, the binary string consisting of Enc(P+N), the activation state codes of all neurons, and the arithmetic mean of the aggregated noise evaluation factor are combined. Package and return to the client.

[0024] Secondly, the present invention provides a private AI model invocation system based on encrypted data interaction, comprising the following modules:

[0025] The sending module is used by the client to generate a series of structured random numbers based on the master random number seed and the indexes of each dimension through the key derivation function, encrypt the original input vector into an initial ciphertext vector using a partially homomorphic encryption public key and the structured random numbers, generate conditional recoding key pairs for nonlinear calculations in the AI ​​model, and send the recoding public key to the server.

[0026] The first generation module is used by the server to perform layer-by-layer calculations on the received initial ciphertext vector: in the linear calculation layer, homomorphic multiplication and addition are performed, and the aggregation noise evaluation factor is calculated based on the preset correlation of each structured random number participating in the homomorphic addition; in the nonlinear activation function layer, the recoding public key is called to perform conditional recoding on the intermediate ciphertext output by the linear calculation layer to realize the activation function calculation, and generate an activation state code representing the sparsity of neuron activation.

[0027] The second generation module is used by the server to obtain an anomaly-free ciphertext by using a pseudo-gradient noise after obtaining the ciphertext of the prediction result. The pseudo-gradient noise is calculated based on virtual anchor point data.

[0028] The calculation module is used by the server to homomorphically add the obfuscated ciphertext and the predicted ciphertext, and return the resulting output ciphertext, activation status code, and arithmetic mean to the client. The client uses its private key to decrypt the output ciphertext, and reconstructs the virtual anchor data consistent with the server based on the received activation status code and arithmetic mean, and then calculates the pseudo-gradient noise. The pseudo-gradient noise is subtracted from the decryption result to obtain the AI ​​model call result.

[0029] Furthermore, based on the master random number seed and the indices of each dimension, the client generates a series of structured random numbers using a key derivation function, including:

[0030] A hash-based message authentication code key derivation function is used, with the master random number seed as the input key material and the indices of each dimension of the input vector as salt values, to generate a deterministic structured random number r for each dimension index i. i .

[0031] Furthermore, based on the preset correlation of each structured random number participating in the homomorphic addition, the aggregation noise evaluation factor is calculated, including:

[0032] For a linear computation layer that multiplies the model weight vector W with the input ciphertext vector C, the aggregate noise evaluation factor F is calculated using the following formula: in As weight.

[0033] The beneficial effects are as follows: This invention solves the problem that some homomorphic encryption methods cannot directly handle nonlinear activation functions by generating and encrypting input using structured random numbers on the client side, combined with a conditional recoding mechanism on the server side. This avoids the accuracy loss caused by function approximation and the high latency of multi-party interactive protocol input. By using an aggregated noise evaluation factor calculated based on the correlation of structured random numbers, it achieves fine-grained control and compensation of accumulated noise in multi-layer linear computation, improving the stability and reliability of homomorphic evaluation results for deep models. The removable obfuscated ciphertext allows the server side to construct quasi-gradient noise based on the intermediate states of the computation process and inject it into the results, resisting side-channel attacks on the output ciphertext. The client can reconstruct and remove this noise, thus obtaining lossless calling results without sacrificing any computational accuracy, achieving end-to-end privacy protection throughout the entire model inference process. Attached Figure Description

[0034] Figure 1 This is a flowchart illustrating the method for invoking a private AI model based on encrypted data interaction. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] An embodiment of the private AI model invocation method based on encrypted data interaction provided by this invention:

[0037] like Figure 1 As shown, the method for invoking a private AI model based on encrypted data interaction includes the following steps:

[0038] S1: The client generates a series of structured random numbers based on the master random number seed and the indexes of each dimension through the key derivation function. It uses a partially homomorphic encryption public key and the structured random numbers to encrypt the original input vector into an initial ciphertext vector, and generates a conditional recoding key pair for nonlinear calculations in the AI ​​model. The recoding public key is then sent to the server.

[0039] The client generates a 256-bit master random number seed for each component x of an n-dimensional original input vector x. i The client uses a key derivation function based on a hash message authentication code, taking the master random number seed and dimension index i as input, to generate a deterministic structured random number r. i Since all r i Originating from the same seed, the clients can reconstruct them at any time. The client uses a public key pk, such as a Paillier cryptosystem, to encrypt each component, specifically by calculating the initial ciphertext c. i =Enc(pk, x) i )×Enc(pk, r i This yields the initial ciphertext vector C = Enc(pk, x + r). The client generates a dedicated pair of conditional recoding keys for the ReLU-like nonlinear activation function in the model, denoted as the recoding public key. and recoded private key and the public key Send to the server.

[0040] In an optional embodiment, the client generates a series of structured random numbers based on the master random number seed and the indices of each dimension, using a key derivation function, including:

[0041] A hash-based message authentication code key derivation function is used, with the master random number seed as the input key material and the indices of each dimension of the input vector as salt values, to generate a deterministic structured random number r for each dimension index i. i .

[0042] Specifically, the client holds a pre-generated master random number seed, such as a 128-bit binary string 1101...0010. For an input vector of dimension 10, the dimension indices are 0 to 9. To generate a structured random number r0 corresponding to the first dimension, the client calls the HKDF function, using the master random number seed as the input key and dimension index 0 as the salt. Internally, HKDF uses an algorithm such as SHA-256, through extraction and expansion steps, to output a deterministic pseudo-random number, say 0.753.

[0043] To generate a random number r1 for the second dimension, the client keeps the master random number seed unchanged and only changes the salt value to dimension index 1. Calling the HKDF function again yields a pseudo-random number that is different from r0 but still deterministic, say -0.219. This process is repeated until corresponding random numbers r0 to r9 have been generated for all 10 dimensions. A set of structured random numbers corresponding one-to-one with the dimensions of the input vector is obtained. The key characteristic is that as long as the master random number seed and dimension index are determined, the generated random values ​​are fixed and reproducible.

[0044] S2, the server performs layer-by-layer calculations on the received initial ciphertext vector: in the linear computation layer, homomorphic multiplication and addition are performed, and the aggregation noise evaluation factor is calculated based on the preset correlation of each structured random number participating in the homomorphic addition; in the nonlinear activation function layer, the recoding public key is called to perform conditional recoding on the intermediate ciphertext output by the linear computation layer to realize the activation function calculation, and generate an activation status code representing the sparsity of neuron activation.

[0045] For y=W x A linear layer with +b, where the server receives the input ciphertext vector. Where x' and r' are the output and accumulated structured noise of the previous layer. The server uses homomorphic properties to compute the output ciphertext. The result was that the ciphertext contained new aggregation noise. × The server does not know the specific value of r', but based on various... Based on the deterministic relationship with the dimension index, calculate a publicly available aggregation noise evaluation factor, for example... Where H is a public hash function. Aggregate noise evaluation factor. This will be recorded. For non-linear activation function layers, the server will record the intermediate ciphertext output by the linear layer. Input a public key that has been recoded This implements a non-interactive computing module that outputs the activated ciphertext. During this process, the server determines Whether the value is greater than zero indicates whether the neuron is activated, and this state is recorded as a binary code, for example, 1 for activation and 0 for inactivation. The state codes of all neurons are combined to form the activation state code of the layer.

[0046] In an optional embodiment, the aggregation noise evaluation factor is calculated based on the preset correlation of each structured random number participating in the homomorphic addition, including:

[0047] For a linear computation layer that multiplies the model weight vector W with the input ciphertext vector C, the aggregate noise evaluation factor F is calculated using the following formula: in As weight.

[0048] Specifically, this process is used to represent the degree of noise accumulation in homomorphic encryption operations. Assuming a neural network model has a linear computation layer, and the model weight vector W contains three weight values: W0 = 0.2, W1 = -1.5, and W2 = 0.8. Before performing the dot product operation between the ciphertext input and this model weight vector, the noise level of the input needs to be pre-evaluated.

[0049] According to the formula, the aggregation noise evaluation factor F is calculated by summing the squares of each element in the weight vector. The resulting value of F is 2.93. This value of 2.93 represents the contribution of this linear computation layer to the total noise growth, and it will be used in subsequent noise compensation and anchor data generation processes.

[0050] In an optional embodiment, the recoding public key is invoked to perform conditional recoding on the intermediate ciphertext output by the linear computation layer to compute the activation function and generate an activation state code representing the sparsity of neuron activation, including:

[0051] To implement the ReLU activation function, the client pre-generates a ciphertext Enc(0) of 0 and sends it to the server along with the re-encoding public key. The server securely compares the intermediate ciphertext Enc(x) output from the linear computation layer with Enc(0). If x < 0, the re-encoding public key is used to re-encode Enc(x) into Enc(0), and the activation state code of the neuron is recorded as 0. If x ≥ 0, Enc(x) remains unchanged, and the activation state code is recorded as 1.

[0052] Specifically, the server executes a function to simulate the ReLU activation function without decrypting the data. The client sends a special recoded public key and an encrypted zero value, denoted as Enc0, to the server. Assume that after computation through a linear layer, the server obtains the ciphertext outputs of two neurons, Enc-2.5 and Enc3.8, respectively.

[0053] The server processes the first ciphertext, Enc-2.5. It uses a secure two-party computation protocol to compare Enc-2.5 with Enc0 provided by the client. The comparison shows that the internal plaintext value is less than zero. Based on this result, the server invokes the recoding public key to convert the Enc-2.5 ciphertext into a new ciphertext representing zero, resulting in a new Enc0. The server records the activation state code of this neuron as 0. For the second ciphertext, Enc3.8, the comparison shows that the internal plaintext value is not less than zero, so the server does not make any changes to the ciphertext and records the activation state code as 1. The server obtains the updated ciphertext sequence and an activation state code sequence consisting of 0s and 1s.

[0054] S3. After obtaining the ciphertext of the prediction result, the server uses a pseudo-gradient noise to obtain an unavoidable obfuscated ciphertext. The pseudo-gradient noise is calculated based on virtual anchor point data.

[0055] After completing all layer calculations, the server obtains the encrypted prediction results. The server concatenates the activation state codes generated by all nonlinear layers into a long string S. The server holds a publicly available set A of candidate anchor points consisting of multiple data samples. By calculating the hash value of S, such as H(S)modK, the server deterministically selects an anchor data point from set A. Where K is the set size. The server calculates the aggregate noise evaluation factor for all linear layer records. arithmetic mean The server uses the arithmetic mean to perform a small perturbation on the selected anchor points, generating virtual anchor point data. Where ε is a small publicly disclosed perturbation coefficient vector. The server uses this virtual anchor data. As input, a backpropagation calculation is performed on the model to obtain a gradient relative to the output layer, which is the pseudo-gradient noise N. The server uses the public key pk to encrypt the pseudo-gradient noise, resulting in the obfuscated ciphertext Enc(pk, N).

[0056] In an optional embodiment, the virtual anchor data is selected from the candidate anchor set using activation state codes and generated by slightly perturbing the arithmetic mean of the aggregated noise evaluation factors obtained from all linear computation layers, specifically:

[0057] The activation state codes generated by all nonlinear activation function layers are concatenated into a binary string. The hash value of the binary string is calculated using the SHA-256 hash function, and the hash value is modulo the size of the candidate anchor set to obtain an index, which is used to deterministically select an anchor data point from the candidate anchor set. Given L linear computation layers, the aggregate noise evaluation factor for all linear computation layers is calculated. arithmetic mean l=1, ..., L: ;

[0058] Add a small perturbation to each numerical component of the selected anchor point data. Generate virtual anchor point data, where It is a preset tiny positive number.

[0059] Specifically, suppose a model has two activation layers, and the activation state codes they produce are concatenated to form the binary string 11010110. The client has a pre-set set containing 256 candidate anchor data. The client calculates the SHA-256 hash value of the string 11010110, obtaining a 256-bit hash result. This hash result is interpreted as a large integer, and then modulo 256 is taken, assuming the result is 78. The client selects the anchor data with index 78 from the candidate set, for example, vector 2.1, -0.5.

[0060] Assuming the model has two linear layers, and the previously calculated aggregation noise evaluation factors are F1=4.5 and F2=8.3, calculate their arithmetic mean. The value is 6.4. Assuming the preset small normal number α is 0.0001, the perturbation Δ is 0.00064. Adding the perturbation to each component of the selected anchor data generates virtual anchor data, resulting in 2.10064 and -0.49936.

[0061] In an optional embodiment, the pseudo-gradient noise is calculated based on virtual anchor point data, including:

[0062] Using virtual anchor point data as input, a virtual output is obtained through forward propagation of the AI ​​model. Using virtual labels preset in virtual output and virtual anchor data Substitute into the mean square error loss function : Calculate the gradient of the loss function with respect to the output of the last layer of the AI ​​model. The gradient value is used as pseudo-gradient noise.

[0063] Specifically, the client uses the virtual anchor data generated in the previous step to calculate a noise value to obfuscate the results. Assume the generated virtual anchor data are vectors 1.2 and 3.4, and a virtual label is preset. =5.0. The client inputs this virtual anchor data 1.2 and 3.4 into the plaintext AI model held locally, performs a complete forward propagation calculation, and obtains a virtual output of the model. Let's assume the calculated result is 5.6.

[0064] The client uses the mean squared error loss function to evaluate the difference between the virtual output and the virtual label. The loss L = 0.36. To obtain the pseudo-gradient noise, this loss L needs to be calculated for the virtual predicted output. The partial derivative of . According to the differentiation rule, this partial derivative is the pseudo-gradient noise, with a value of 1.2.

[0065] S4, the server homomorphically adds the obfuscated ciphertext and the predicted ciphertext, and returns the resulting output ciphertext, activation status code, and arithmetic mean to the client. The client uses its private key to decrypt the output ciphertext, and reconstructs the virtual anchor data consistent with the server based on the received activation status code and arithmetic mean, and then calculates the pseudo-gradient noise. The pseudo-gradient noise is subtracted from the decryption result to obtain the AI ​​model call result.

[0066] Specifically, the server performs a homomorphic addition operation, multiplying the obfuscated ciphertext with the predicted ciphertext to obtain the output ciphertext. Where P is the actual prediction result. It is all the structured random number noise accumulated throughout the entire computation process. The server will use Enc(P+N), the activation state codes S of all layers, and the arithmetic mean. Package and send to the client.

[0067] After receiving the data, the client uses the private key sk to decrypt Enc(P+N), obtaining a mixed result containing three parts. The client uses the received activation status code S and the arithmetic mean... Perform the exact same steps as the server: select from the same public candidate anchor set A using the hash value of S. Then use By performing micro-perturbations, we can obtain The pseudo-gradient noise N, completely identical to that on the server, is reconstructed through backpropagation. The client, using its master random number seed, can then reconstruct all the original structured random numbers. The accumulated total structured noise was calculated by simulating the forward computation path. The client subtracts two known noise terms from the decryption result P', i.e. This allows us to obtain the results of the AI ​​model call.

[0068] In an optional embodiment, the server homomorphically adds the obfuscated ciphertext and the predicted ciphertext, and returns the resulting output ciphertext, activation status code, and arithmetic mean to the client, including:

[0069] The server uses a partially homomorphic encryption public key to encrypt the calculated pseudo-gradient noise N, obtaining the obfuscated ciphertext Enc(N). The obfuscated ciphertext Enc(N) is then combined with the AI ​​model's prediction ciphertext Enc(P) using a homomorphic addition operation to obtain the output ciphertext Enc(P+N). Finally, the binary string consisting of Enc(P+N), the activation state codes of all neurons, and the arithmetic mean of the aggregated noise evaluation factor are combined. Package and return to the client.

[0070] Specifically, assume the server has completed AI model inference on the user's original encrypted data and obtained the predicted ciphertext EncP (with a plaintext value of 15.8). The server receives the pseudo-gradient noise N (with a value of 1.2) calculated locally on the client. The server uses the homomorphic encryption public key provided by the client to encrypt the pseudo-gradient noise value 1.2, generating the obfuscated ciphertext EncN, i.e., Enc1.2.

[0071] The server utilizes the addition property of homomorphic encryption to directly add the predicted ciphertext EncP to the confused ciphertext EncN. This operation is performed in the ciphertext field, resulting in a new ciphertext Enc(P+N), or Enc(15.8+1.2), which is equivalent to encrypting the plaintext value 17.0. The server then packages the output ciphertext, along with the activation state code string 11010110 previously recorded in each activation layer, and the arithmetic mean of the calculated aggregate noise evaluation factor, 6.4, and sends it back to the client.

[0072] An embodiment of the private AI model invocation system based on encrypted data interaction provided by this invention includes the following modules:

[0073] The sending module is used by the client to generate a series of structured random numbers based on the master random number seed and the indexes of each dimension through the key derivation function, encrypt the original input vector into an initial ciphertext vector using a partially homomorphic encryption public key and the structured random numbers, generate conditional recoding key pairs for nonlinear calculations in the AI ​​model, and send the recoding public key to the server.

[0074] The first generation module is used by the server to perform layer-by-layer calculations on the received initial ciphertext vector: in the linear calculation layer, homomorphic multiplication and addition are performed, and the aggregation noise evaluation factor is calculated based on the preset correlation of each structured random number participating in the homomorphic addition; in the nonlinear activation function layer, the recoding public key is called to perform conditional recoding on the intermediate ciphertext output by the linear calculation layer to realize the activation function calculation, and generate an activation state code representing the sparsity of neuron activation.

[0075] The second generation module is used by the server to obtain an anomaly-free ciphertext by using a pseudo-gradient noise after obtaining the ciphertext of the prediction result. The pseudo-gradient noise is calculated based on virtual anchor point data.

[0076] The calculation module is used by the server to homomorphically add the obfuscated ciphertext and the predicted ciphertext, and return the resulting output ciphertext, activation status code, and arithmetic mean to the client. The client uses its private key to decrypt the output ciphertext, and reconstructs the virtual anchor data consistent with the server based on the received activation status code and arithmetic mean, and then calculates the pseudo-gradient noise. The pseudo-gradient noise is subtracted from the decryption result to obtain the AI ​​model call result.

[0077] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A private AI model calling method based on encrypted data interaction, characterized in that, The method comprises the following steps: S1, the client generates a series of structured random numbers based on the master random seed and the dimension indexes through a key derivation function, encrypts the original input vector into an initial ciphertext vector using the partial homomorphic encryption public key and the structured random numbers, generates a conditional re-encoding key pair for the nonlinear calculation in the AI model, sends the re-encoding public key to the server, and performs secure comparison on the intermediate ciphertext Enc(x) output by the linear calculation layer and the ciphertext Enc(0) of 0. S2, the server performs layer-by-layer calculation on the received initial ciphertext vector: in the linear calculation layer, homomorphic multiplication and addition are performed, and the aggregation noise evaluation factor is calculated based on the square sum of each element in the weight vector, including: multiplying the model weight vector W and the input ciphertext vector C in the linear calculation layer; in the nonlinear activation function layer, the re-encoding public key is called to perform conditional re-encoding on the intermediate ciphertext output by the linear calculation layer to realize activation function calculation, and an activation state code representing the activation sparsity of neurons is generated. S3, the server obtains the prediction result ciphertext, and obtains the confusion ciphertext that can be eliminated by using a quasi-gradient noise, wherein the quasi-gradient noise is calculated based on the virtual anchor point data. S4, the server homomorphically adds the confusion ciphertext and the prediction result ciphertext, and returns the obtained output ciphertext, activation state code and arithmetic mean to the client; the client decrypts the output ciphertext using the private key, and reconstructs the virtual anchor point data consistent with the server side according to the received activation state code and arithmetic mean to calculate the quasi-gradient noise, and then subtracts the quasi-gradient noise from the decrypted result to obtain the AI model calling result. The virtual anchor point data is generated by perturbing the arithmetic mean of the aggregate noise evaluation factors of all linear calculation layers after selecting from the candidate anchor point set using the activation state code, specifically: concatenate the activation state codes generated by all nonlinear activation function layers into a binary string; calculate the hash value of the binary string using the SHA-256 hash function, and take the modulus of the hash value with the size of the candidate anchor point set to obtain an index, which is used to deterministically select an anchor point data from the candidate anchor point set; set L linear calculation layers, calculate the arithmetic mean of the aggregate noise evaluation factors of all linear calculation layers , l = 1,..., L: ; add a perturbation amount to each numerical component of the selected anchor point data to generate the virtual anchor point data, wherein is a predetermined small normal number.​ 2. The private AI model calling method based on encrypted data interaction according to claim 1, characterized in that, The client generates a series of structured random numbers based on the master random seed and the dimension indexes through a key derivation function, including: A key derivation function based on a hash-based message authentication code is used, with a master random seed as input key material, and each dimension index of the input vector as a salt value, to generate a deterministic structured random number r for each dimension index i i . 3.The method of claim 1, wherein, The re-encoding public key is called to perform conditional re-encoding on the intermediate ciphertext output by the linear calculation layer to realize activation function calculation, and an activation state code representing the activation sparsity of neurons is generated, including: To realize the ReLU activation function, the client pre-generates the ciphertext Enc(0) of 0 and sends it to the server together with the re-encoding public key; the server securely compares the intermediate ciphertext Enc(x) output by the linear calculation layer with Enc(0), and if x<0, the client re-encodes Enc(x) into Enc(0) using the re-encoding public key, and records the activation state code of the neuron as 0; if x≥0, Enc(x) remains unchanged, and the activation state code is recorded as 1.

4. The private AI model calling method based on encrypted data interaction according to claim 1, characterized in that, The quasi-gradient noise is calculated based on the virtual anchor point data, including: The virtual anchor point data is input, and a virtual output is obtained by forward propagation of an AI model , the virtual output is substituted into a preset virtual label in the virtual anchor point data , and substituted into a mean square error loss function : The gradient of the loss function to the output of the last layer of the AI model is calculated , and the gradient value is used as the quasi-gradient noise.

5. The method of claim 1, wherein the method further comprises: The server homomorphically adds the confusion ciphertext and the prediction result ciphertext, and returns the obtained output ciphertext, activation state code and arithmetic mean to the client, including: The server side uses part of the homomorphic encryption public key to encrypt the calculated gradient noise N to obtain the obfuscated ciphertext Enc(N); the obfuscated ciphertext Enc(N) and the prediction result ciphertext Enc(P) of the AI model are combined through homomorphic addition operation to obtain the output ciphertext Enc(P+N); the Enc(P+N), the binary string composed of the activation state codes of all neurons and the arithmetic mean of the aggregation noise evaluation factors Packed back to the client.

6. A system for implementing the method of calling a private AI model based on encrypted data interaction according to any one of claims 1-5, characterized in that, The method comprises the following modules: A sending module is configured to generate a series of structured random numbers based on the master random seed and the dimension indexes through a key derivation function, encrypt the original input vector into an initial ciphertext vector using the partial homomorphic encryption public key and the structured random numbers, generate a conditional re-encoding key pair for the nonlinear calculation in the AI model, send the re-encoding public key to the server, and perform secure comparison on the intermediate ciphertext Enc(x) output by the linear calculation layer and the ciphertext Enc(0) of 0. The first generation module is configured to perform layer-by-layer calculation on the received initial ciphertext vector on the server side: in the linear calculation layer, homomorphic multiplication and addition are performed, and an aggregated noise evaluation factor is calculated based on the preset relevance of each structured random number participating in the homomorphic addition; in the nonlinear activation function layer, a re-encoding public key is called to perform conditional re-encoding on the intermediate ciphertext output by the linear calculation layer to realize activation function calculation, and an activation state code representing neuron activation sparsity is generated; The second generation module is configured to obtain a cancellable confusion ciphertext by using a quasi-gradient noise after obtaining the prediction result ciphertext on the server side, and the quasi-gradient noise is calculated based on virtual anchor point data; The calculation module is configured to homomorphically add the confusion ciphertext and the prediction result ciphertext on the server side, and return the obtained output ciphertext, the activation state code and the arithmetic mean value to the client together; The client uses a private key to decrypt the output ciphertext, and reconstructs the virtual anchor point data consistent with the server side according to the received activation state code and arithmetic mean value, and then calculates the quasi-gradient noise, subtracts the quasi-gradient noise from the decryption result, and obtains the AI model calling result.

7. The system of claim 6, wherein, The client generates a series of structured random numbers based on the master random number seed and the dimension index, including: A key derivation function based on a hash-based message authentication code is used, with a master random seed as input key material, and each dimension index of the input vector as a salt value, to generate a deterministic structured random number r for each dimension index i i .

8. The system of claim 6, wherein, Based on the square sum of each element in the weight vector, the aggregated noise evaluation factor is calculated, including: The linear calculation layer of multiplying the model weight vector W and the input ciphertext vector C.

Images