Online anomaly detection and recovery method for homomorphic encryption neural network

Abstract

The invention discloses an online anomaly detection and recovery method for a homomorphic encryption neural network. The online anomaly detection and recovery method comprises the following steps: step 1, generating a detection vector and constructing an observation baseline; step 2, constructing a projection residual error and judging a self-adaptive threshold value; step 3, anomaly positioning of residual gradient field driving; 4, estimating disturbance amplitude; step 5, ciphertext domain online restoration: after the disturbance amplitude is obtained, affected parameters are directly updated in a homomorphic encryption environment, restoration is realized without decryption, and thus correctness and privacy of model reasoning are ensured; and step 6, closed-loop verification and termination conditions: after restoration, through recalculating a residual error and carrying out iterative judgment, verifying a restoration effect and determining whether to terminate, forming a detection-positioning-restoration closed-loop process, and ensuring that the system is restored to be stable. According to the method, a'detection-positioning-repairing 'closed-loop defense framework is formed, so that the robustness and safety of the reasoning process are guaranteed, and the privacy leakage risk caused by decryption is avoided.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, and in particular relates to an online anomaly detection and recovery method for homomorphic encrypted neural networks, specifically used to defend against security risks including bit flip attacks, fault injection attacks and other hardware-related threats. Background Technology

[0002] With the widespread application of deep neural networks (DNNs) in safety-critical fields such as autonomous driving, medical diagnosis, and financial risk control, the demand for ensuring data privacy and computational security is increasing. Homomorphic encryption (HE), as an important means of privacy-preserving computation, can directly support arithmetic operations such as addition and multiplication in encrypted form, thus achieving a "data usable but not visible" protection mechanism. By encrypting input data and model parameters, third-party platforms can complete inference calculations without decryption and restore the correct results upon final decryption. This characteristic has led to the application of homomorphic encryption technology in various tasks such as encrypted image classification, encrypted text generation, and federated learning, providing theoretical and practical support for privacy protection in artificial intelligence systems.

[0003] However, neural network inference protected by homomorphic encryption still faces severe security challenges. Due to the high computational complexity and noise accumulation of encryption operations, the system is less robust to external disturbances and more susceptible to hardware-related attacks. Among these, bit-flip attacks (BFA) are particularly threatening. Attackers can introduce faults into the memory or computing circuits storing weights through various means, such as using RowHammer technology to induce charge leakage in memory cells, or interfering with the stable operation of the chip through laser injection, dynamic voltage frequency modulation (DVFS), etc. These methods can all cause critical bits of the model parameters to flip, leading to a sharp drop in inference accuracy, functional abnormalities, or even the activation of hidden backdoors. Unlike random soft errors, bit-flip attacks are often highly targeted and stealthy. Attackers can use gradient sensitivity analysis to precisely locate the most critical bits for prediction and cause catastrophic inference errors with minimal modification cost.

[0004] Existing defense methods primarily focus on plaintext neural network environments. Common strategies include introducing redundant designs into the model structure, employing robust training to distribute sensitive weights, or detecting anomalies by monitoring neuron activation distribution. However, these methods largely rely on accessible intermediate features or plaintext parameters, making them unsuitable for homomorphic encryption networks operating entirely in the ciphertext domain. On one hand, all computations during HE inference are performed within the ciphertext domain, lacking interpretable intermediate variables, rendering traditional activation- or gradient-based detection mechanisms inapplicable. On the other hand, the inherent noise accumulation effect of homomorphic operations can mask anomalous signals triggered by external attacks, making it difficult for existing methods to promptly distinguish between attack behavior and normal noise growth. More seriously, current encryption models generally lack built-in fault repair mechanisms. Even if anomalies in inference results are detected, damaged parameters cannot be located and corrected within the ciphertext domain, ultimately leaving models with only the passive risk of performance degradation or even inference collapse. Therefore, given the lack of effective runtime defense capabilities in existing homomorphic encryption neural networks during inference and the inability to perform real-time detection and repair of hardware-related attacks such as bit flipping within the ciphertext domain, a new method is urgently needed to ensure their reliable application in security-critical scenarios. Summary of the Invention

[0005] To overcome the shortcomings of existing technologies, this invention provides an online anomaly detection and recovery method for homomorphic encrypted neural networks. This method utilizes the inherent noise characteristics in homomorphic encryption computation as a proxy observation signal, combining a pre-set detection vector and a sliding window mechanism to capture atypical noise patterns caused by fault injection in real time. Anomaly detection is performed using projection residuals and dynamic thresholds as discrimination criteria. When an anomaly is detected, the perturbed neuron weights are further located through the residual gradient field, and the parameter offset is determined using an amplitude estimation method based on perturbation inversion. Finally, a linear repair operation is directly performed in the ciphertext domain to achieve online recovery of the anomalous parameters. This forms a closed-loop defense framework of "detection-location-repair," ensuring both the robustness and security of the inference process while avoiding the privacy leakage risks associated with decryption.

[0006] The technical solution adopted by this invention to solve its technical problem is:

[0007] An online anomaly detection and recovery method for homomorphic encryption neural networks, the method comprising the following steps:

[0008] Step 1, Detection Vector Generation and Observation Baseline Construction: By generating sparse detection vectors and performing directional sampling of dense noise during inference, an observation baseline for subsequent anomaly detection is constructed, thereby establishing a monitoring channel that can perceive noise changes without decryption.

[0009] Step 2, Projection Residual Construction and Adaptive Threshold Determination: The moving average and residuals of the noisy observation sequence are calculated and combined with a dynamic threshold to achieve anomaly determination, distinguishing between normal noise fluctuations and abnormal disturbances caused by attacks.

[0010] Step 3, Anomaly localization driven by residual gradient field: After detecting an anomaly, the gradient mapping relationship between the residual and the parameters is calculated to locate the weight parameters that may be attacked, and then the specific anomaly location is found in the model structure.

[0011] Step 4, Disturbance Amplitude Estimation: After locating the candidate parameters, the offset of the disturbed parameters is estimated by the inversion optimization method to provide accurate compensation for subsequent repair;

[0012] Step 5, Online repair of ciphertext domain: After obtaining the perturbation amplitude, the affected parameters are directly updated in a homomorphic encryption environment to achieve repair without decryption, thereby ensuring the correctness and privacy of model inference;

[0013] Step 6, Closed-loop verification and termination conditions: After repair, the repair effect is verified by recalculating the residuals and performing iterative judgments, and a decision is made on whether to terminate the process, forming a closed-loop process of detection-location-repair to ensure that the system returns to stability.

[0014] Furthermore, the process of step 1 is as follows:

[0015] 1.1 For a space with observation dimension d, K sparse detection vector sets {v} are generated using the sparse Gaussian initialization and orthogonalization filtering method. k}, where each v k The number of non-zero elements is approximately ρd, and for any two distinct vectors v i ,v j The inner product is close to zero. Based on formula (1), sparse detection vectors are generated, resulting in a sparse and low-correlation set of detection vectors, R. d Represents a real vector space of dimension d;

[0016]

[0017] 1.2 In the t-th round of reasoning, the detection vector v k With ciphertext activation tensor and Perform equivalent inner product operations separately, where and Let z represent the ciphertext activation result obtained from two equivalent gate sequences at the same observation node. The difference between the inner product results of the two sequences is calculated using formula (2) and squared to obtain the noise intensity z in direction k for the t-th round. t,k ;

[0018]

[0019] 1.3 Stack the noise intensity vectors of the most recent W rounds in time sequence to form a trajectory matrix, and obtain the matrix Z using formula (3). t Then, the first-order difference of the matrix is ​​calculated along the time axis using formula (4) to obtain the difference matrix ΔZ. t This is used to highlight short-term mutation characteristics;

[0020] Z t =[z t-W+1 ,…,z t ]∈R K×W (3);

[0021] ΔZ t =Z t [:,2:W]-Z t [:,1:W-1], (4);

[0022] Among them, Z t Let z represent the noise intensity trajectory matrix at time t. t-W+1 Let z represent the noise intensity vector in the (t-W+1)th round. t R represents the noise intensity vector in round t. K×W Let represent a real matrix space of dimension K×W, where W represents the length of the sliding window and t represents the current observation round.

[0023] Furthermore, the process of step 2 is as follows:

[0024] 2.1 For each detection direction, calculate the mean value from the most recent W rounds of observations, and obtain the moving average value μ according to formula (5). t,k Then, using formula (6), the difference between the current observed value and the mean is calculated to obtain the projected residual r. t,k ;

[0025]

[0026] r t,k =z t,k -μ t,k (6);

[0027] Among them, z τ,k This represents the noise intensity in the τ-th round and the k-th detection direction;

[0028] 2.2 Further calculate the standard deviation σ within the sliding window. t,k And construct the dynamic threshold τ according to formulas (7) and (8). t,k This is used to determine whether the residual is abnormal;

[0029]

[0030] τt,k =μ t,k +β·σ t,k (8);

[0031] Where β represents the dynamic threshold adjustment coefficient, used to control the sensitivity of residual determination;

[0032] 2.3 If the detection direction satisfies r at least M times in T consecutive rounds. t,k >τ t,k If the direction is abnormal, then the global maximum residual is taken using formula (9). If it exceeds the threshold Γ, then the current round is judged to have a global anomaly and a warning is issued.

[0033] Furthermore, the process of step 3 is as follows:

[0034] 3.1 Establish an approximate linear relationship between the residual vector and the parameter perturbation vector, and obtain the mapping between the residual and the parameter offset according to formula (9);

[0035] r t ≈J t δθ+ε (9);

[0036] Where, r t J represents the projected residual vector at time t. t Let δθ represent the Jacobian matrix of the residual with respect to the parameters, δθ represent the parameter perturbation vector, and ε represent the noise term.

[0037] 3.2 Calculate the gradient vector g of the residual with respect to the parameter according to formula (10), and use formula (11) to filter and obtain the set of candidate abnormal parameters S;

[0038]

[0039] Among them, R t Let g represent the residual gradient vector at time t. i This represents the gradient value of the i-th parameter. κ represents the mean of the parameter gradient, s represents the layer weight factor, and s represents the mean of the parameter gradient. g This represents an importance score based on gradients;

[0040] 3.3 Introduce hierarchical weighting factors to the candidate parameters in the set, and obtain the importance score s according to formula (12). i The parameters most likely to be attacked are selected by sorting.

[0041] s i =α l(i) ·|g i | (12);

[0042] Where s represents the importance score of the candidate parameter, α l(i)This represents the layer weight factor corresponding to the i-th candidate parameter in the l-th layer.

[0043] The process of step 4 is as follows:

[0044] 4.1 Construct a least-squares optimization problem with L2 regularization, and obtain the optimal perturbation compensation vector according to formulas (13) and (14).

[0045]

[0046] Among them, J t,S Let δθ represent the residual Jacobian matrix for the candidate parameter subset S at time t. S Let λ represent the perturbation vector of the candidate parameter subset S, λ represent the L2 regularization coefficient, and I represent the identity matrix.

[0047] 4.2 L1 regularization constraint is used to enhance sparsity, and the compensation result is obtained according to formula (15);

[0048]

[0049] Where λ1 represents the L1 regularization coefficient, which is used to enhance the sparsity of the disturbance compensation results.

[0050] The process of step 5 is as follows:

[0051] 5.1 The compensation vector is encrypted, and the target parameters are updated using formulas (16) and (17) to obtain the repaired parameters;

[0052]

[0053] in, Let S represent the optimal perturbation compensation vector for the candidate parameter subset S, and Enc represent the homomorphic encryption operator. S represents the subset of candidate parameters in the encrypted state;

[0054] 5.2 To avoid excessive noise accumulation, the noise budget of the repaired ciphertext is dynamically monitored. If it exceeds the noise threshold, Bootstrapping is triggered for refresh.

[0055] The process of step 6 is as follows:

[0056] 6.1 After the repair is completed, resample and calculate the residual r. t+1,k The repair effect is judged according to formula (18). If the maximum residual is lower than the threshold Γ′, the repair is considered effective.

[0057]

[0058] 6.2 If the convergence condition is met for H consecutive rounds, the repair process terminates; otherwise, return to step 3 to continue execution. This determination is achieved using formula (22):

[0059]

[0060] The technical concept of this invention is as follows: To address the lack of runtime defense capabilities and the inability to detect and repair hardware attacks such as bit flips in the ciphertext domain during inference in homomorphic encryption neural networks, this invention proposes a method for detecting and repairing bit flip attacks in homomorphic encryption neural networks. This method utilizes the inherent noise characteristics of encrypted computation as proxy features. By pre-setting a sparse detection vector and combining it with a sliding window mechanism, it extracts noise trajectories in real time and calculates the projected residuals, constructing an anomaly criterion based on a dynamic threshold to achieve efficient detection of attack perturbations. Upon detecting an anomaly, this invention further constructs a residual gradient field, mapping the observed residuals to the parameter space to locate the perturbed weights, and uses a regularized inversion optimization method to estimate the parameter offsets. Based on this, leveraging the linear adjustability of homomorphic encryption, it directly compensates and updates the anomalous parameters in the ciphertext domain, and combines this with posterior residual verification to form a closed-loop adjustment mechanism, thereby achieving integrated "detection-location-repair" defense while ensuring privacy. This invention does not require access to plaintext features or modification of the model structure, has low computational overhead, and is applicable to various architectures such as convolutional neural networks and Transformers. It can significantly improve the robustness and reliability of encrypted neural networks under hardware threats such as bit-flip attacks.

[0061] The beneficial effects of this invention are mainly reflected in the following aspects: First, this invention utilizes the inherent noise characteristics of homomorphic computation as a proxy observation signal, and captures abnormal trajectories in real time through sparse detection vectors and a sliding window mechanism, enabling efficient and reliable attack detection without decryption. Second, this invention achieves precise localization of abnormal parameters through residual gradient fields, and combines regularized inversion optimization to estimate the perturbation amplitude, directly completing weight repair within the ciphertext domain, avoiding the privacy leakage risk caused by plaintext access. Third, this invention forms a closed-loop feedback mechanism for detection, localization, and repair, maintaining the stability and correctness of model inference in fault injection scenarios such as bit-flip attacks, significantly improving the robustness and security of the system. Finally, the method of this invention is lightweight and has low overhead, requiring no modification to the original model structure, and is applicable to various architectures such as convolutional neural networks and Transformers, possessing good versatility and deployability. Attached Figure Description

[0062] Figure 1 This is a flowchart of an online anomaly detection and recovery method for homomorphic encryption neural networks.

[0063] Figure 2 This is a schematic diagram illustrating the impact of defense methods on the accuracy and latency of various neural networks.

[0064] Figure 3 This is a comparison chart of the accuracy of non-target samples and the success rate of attacks before and after defending against TBFA attacks. Detailed Implementation

[0065] The present invention will now be further described with reference to the accompanying drawings.

[0066] Reference Figures 1-3 An online anomaly detection and recovery method for homomorphic encryption neural networks, the method comprising the following steps:

[0067] Step 1, Detection Vector Generation and Observation Baseline Construction: By generating sparse detection vectors and performing directional sampling of dense noise during inference, an observation baseline for subsequent anomaly detection is constructed. This establishes a monitoring channel capable of sensing noise changes without decryption. The process is as follows:

[0068] 1.1 For a space with observation dimension d, K sparse detection vector sets {v} are generated using the sparse Gaussian initialization and orthogonalization filtering method. k}, where each v k The number of non-zero elements is approximately ρd, and for any two distinct vectors v i ,v j The inner product is close to zero. Based on formula (1), sparse detection vectors are generated, resulting in a sparse and low-correlation set of detection vectors, R. d Represents a real vector space of dimension d;

[0069]

[0070] 1.2 In the t-th round of reasoning, the detection vector v k With ciphertext activation tensor and Perform equivalent inner product operations separately, where and Let z represent the ciphertext activation result obtained from two equivalent gate sequences at the same observation node. The difference between the inner product results of the two sequences is calculated using formula (2) and squared to obtain the noise intensity z in direction k for the t-th round. t,k ;

[0071]

[0072] 1.3 Stack the noise intensity vectors of the most recent W rounds in time sequence to form a trajectory matrix, and obtain the matrix Z using formula (3). t Then, the first-order difference of the matrix is ​​calculated along the time axis using formula (4) to obtain the difference matrix ΔZ. t This is used to highlight short-term mutation characteristics;

[0073] Z t =[z t-W+1 ,…,z t ]∈R K×W (3);

[0074] ΔZ t =Z t [:,2:W]-Z t [:,1:W-1], (4);

[0075] Among them, Z t Let z represent the noise intensity trajectory matrix at time t. t-W+1 Let z represent the noise intensity vector in the (t-W+1)th round. t R represents the noise intensity vector in round t. K×W Let represent a real matrix space of dimension K×W, where W represents the length of the sliding window and t represents the current observation round.

[0076] Step 2, Projection Residual Construction and Adaptive Threshold Determination: By calculating the moving average and residuals of the noisy observation sequence and combining them with a dynamic threshold, anomaly determination is achieved, distinguishing between normal noise fluctuations and abnormal disturbances caused by attacks. The process is as follows:

[0077] 2.1 For each detection direction, calculate the mean value from the most recent W rounds of observations, and obtain the moving average value μ according to formula (5). t,k Then, using formula (6), the difference between the current observed value and the mean is calculated to obtain the projected residual r. t,k ;

[0078]

[0079] r t,k =z t,k -μ t,k (6);

[0080] Among them, z τ,k This represents the noise intensity in the τ-th round and the k-th detection direction;

[0081] 2.2 Further calculate the standard deviation σ within the sliding window. t,k And construct the dynamic threshold τ according to formulas (7) and (8). t,k This is used to determine whether the residual is abnormal;

[0082]

[0083] τ t,k =μ t,k +β·σ t,k (8);

[0084] Where β represents the dynamic threshold adjustment coefficient, which is used to control the sensitivity of residual determination;

[0085] 2.3 If the detection direction satisfies r at least M times in T consecutive rounds. t,k >τ t,k If the direction is abnormal, then the global maximum residual is taken using formula (9). If it exceeds the threshold Γ, then the current round is judged to have a global anomaly and a warning is issued.

[0086] Step 3, Anomaly Localization Driven by Residual Gradient Field: After detecting an anomaly, the gradient mapping relationship between the residual and the parameters is calculated to locate the weight parameters that may be attacked, thereby finding the specific anomaly location in the model structure; the process is as follows:

[0087] 3.1 Establish an approximate linear relationship between the residual vector and the parameter perturbation vector, and obtain the mapping between the residual and the parameter offset according to formula (9);

[0088] r t ≈J t δθ+ε (9);

[0089] Where, r t J represents the projected residual vector at time t. t Let δθ represent the Jacobian matrix of the residual with respect to the parameters, δθ represent the parameter perturbation vector, and ε represent the noise term.

[0090] 3.2 Calculate the gradient vector g of the residual with respect to the parameter according to formula (10), and use formula (11) to filter and obtain the set of candidate abnormal parameters S;

[0091]

[0092] Among them, R t Let g represent the residual gradient vector at time t. i This represents the gradient value of the i-th parameter. κ represents the mean of the parameter gradient, s represents the layer weight factor, and s represents the mean of the parameter gradient. g This represents an importance score based on gradients;

[0093] 3.3 Introduce hierarchical weighting factors to the candidate parameters in the set, and obtain the importance score s according to formula (12). i The parameters most likely to be attacked are selected by sorting.

[0094] s i =α l(i) ·|g i | (12);

[0095] Where s represents the importance score of the candidate parameter, α l(i)This represents the layer weight factor corresponding to the i-th candidate parameter in the l-th layer.

[0096] Step 4, Perturbation Amplitude Estimation: After locating the candidate parameters, the offset of the perturbed parameters is estimated using an inversion optimization method to provide accurate compensation for subsequent repair. The process is as follows:

[0097] 4.1 Construct a least-squares optimization problem with L2 regularization, and obtain the optimal perturbation compensation vector according to formulas (13) and (14).

[0098]

[0099] Among them, J t,S Let δθ represent the residual Jacobian matrix for the candidate parameter subset S at time t. S Let λ represent the perturbation vector of the candidate parameter subset S, λ represent the L2 regularization coefficient, and I represent the identity matrix.

[0100] 4.2 L1 regularization constraint is used to enhance sparsity, and the compensation result is obtained according to formula (15);

[0101]

[0102] Where λ1 represents the L1 regularization coefficient, which is used to enhance the sparsity of the disturbance compensation results.

[0103] Step 5, Online Repair of Ciphertext Domain: After obtaining the perturbation amplitude, the affected parameters are directly updated under a homomorphic encryption environment to achieve repair without decryption, thereby ensuring the correctness and privacy of model inference. The process is as follows:

[0104] 5.1 The compensation vector is encrypted, and the target parameters are updated using formulas (16) and (17) to obtain the repaired parameters;

[0105]

[0106] in, Let S represent the optimal perturbation compensation vector for the candidate parameter subset S, and Enc represent the homomorphic encryption operator. S represents the subset of candidate parameters in the encrypted state;

[0107] 5.2 To avoid excessive noise accumulation, the noise budget of the repaired ciphertext is dynamically monitored. If it exceeds the noise threshold, Bootstrapping is triggered for refresh.

[0108] Step 6, Closed-Loop Verification and Termination Conditions: After repair, the repair effect is verified by recalculating the residuals and performing iterative judgments to determine whether to terminate the process, forming a closed-loop process of detection-location-repair to ensure system stability. The process is as follows:

[0109] 6.1 After the repair is completed, resample and calculate the residual r. t+1,k The repair effect is judged according to formula (18). If the maximum residual is lower than the threshold Γ′, the repair is considered effective.

[0110]

[0111] 6.2 If the convergence condition is met for H consecutive rounds, the repair process is terminated; otherwise, the process returns to step 3 and continues. This determination is achieved using formula (22):

[0112]

[0113] The specific operation process of this invention is as follows: Figure 1 As shown. In addition, using ResNet-50 / CIFAR-10, ResNet-50 / CIFAR-100, and ViT-B / 16 / ImageNet models (with partial homomorphic encryption implemented) and datasets as examples, the results of our proposed method are presented (see [reference]). Figure 2 and Figure 3 ).

[0114] In this embodiment, Figure 2 The figure illustrates the changes in clean sample classification accuracy and inference latency of the model after applying the method of this invention, compared to when the method is not used. It is clear from the figure that in the three sets of experiments—ResNet-50 / CIFAR-10, ResNet-50 / CIFAR-100, and ViT-B / 16 / ImageNet—the method of this invention can maintain or even improve the accuracy of clean samples while only incurring low latency overhead. Specifically, the accuracy of each model after the defense is improved by approximately 1%–3% compared to before the defense, while the increase in inference latency remains within an acceptable range, indicating that this invention achieves a good balance between security and efficiency. Furthermore, to further evaluate the effectiveness of this invention in resisting attacks, Figure 3 This paper presents a comparison of classification accuracy and attack success rate (ASR) for non-target samples before and after defense against TBFA attacks. The results show that on all three models and datasets, the accuracy for non-target samples significantly improved after defense, while the attack success rate decreased dramatically, with reductions generally exceeding 90%. This demonstrates that the present invention can effectively suppress performance degradation caused by hardware-related threats such as TBFA attacks, while maintaining the model's predictive stability for normal inputs, thereby significantly improving the system's robustness and security.

[0115] The embodiments described in this specification are merely examples of implementations of the inventive concept and are for illustrative purposes only. The scope of protection of this invention should not be considered limited to the specific forms described in these embodiments; rather, it extends to equivalent technical means conceived by those skilled in the art based on the inventive concept.

Claims

1. An online anomaly detection and recovery method for homomorphic encryption neural networks, characterized in that, The method comprises the following steps: Step 1, detection vector generation and observation baseline construction: by generating a sparse detection vector and directionally sampling the ciphertext noise in the inference process, an observation baseline for subsequent anomaly detection is constructed, and a monitoring channel for perceiving noise changes is established without decryption; Step 2, projection residual construction and adaptive threshold determination: by calculating the sliding mean and residual of the noise observation sequence, and combining the dynamic threshold, the anomaly determination is realized, and the normal noise fluctuation and the abnormal disturbance caused by the attack are distinguished; Step 3, abnormal positioning driven by residual gradient field: after detecting the abnormality, the gradient mapping relationship between the residual and the parameter is calculated to locate the weight parameter that may be attacked, and then the specific abnormal position in the model structure is found; Step 4, disturbance amplitude estimation: after locating the candidate parameter, the offset of the disturbed parameter is estimated by the inversion optimization method, and accurate compensation is provided for subsequent repair; Step 5, online repair in ciphertext domain: after obtaining the disturbance amplitude, the affected parameters are directly updated in the homomorphic encryption environment to realize repair without decryption, thereby ensuring the correctness and privacy of model inference; Step 6, closed-loop verification and termination condition: after repair, the repair effect is verified and it is decided whether to terminate by recalculating the residual and iterative judgment, forming a closed-loop process of detection-positioning-repair to ensure system recovery stability.

2. The online anomaly detection and recovery method for homomorphic encryption neural network of claim 1, wherein, The process of step 1 is as follows: 1.1 For a space with observation dimension d, using sparse Gaussian initialization and orthogonal screening method, generate K sparse detection vector sets {v k}, where the number of non-zero elements of each v k is approximately ρd, and the inner product of any two different vectors v i ,v j is close to zero, generate sparse detection vectors, and get a sparse and low correlation detection vector set; 1.2 In the t-th round of reasoning, the detection vector v k is calculated by performing the equivalent inner product operation on the ciphertext activation tensor and respectively, where and represent the ciphertext activation results obtained by two equivalent gate sequences under the same observation node, the difference between the inner product results of the two is calculated and squared to obtain the noise intensity z t,k in the direction k in the t-th round 1.3 Stack the noise intensity vectors of the recent W wheels in time sequence as a trajectory matrix, obtaining matrix Z t , and then calculate the first-order difference along the time axis of the matrix, obtaining difference matrix ΔZ t , for highlighting short-time mutation features.

3. The online anomaly detection and recovery method for homomorphic encryption neural network according to claim 1 or 2, characterized in that, The process of step 2 is as follows: 2.1 For each detection direction, compute the mean of the last W observations and obtain the sliding mean μ t,k (ii) Compute the difference between the current observation and the mean to obtain the projection residual r t,k ; 2.2 Further compute standard deviation σ within sliding window t,k and construct dynamic threshold τ t,k for deciding whether residuals are abnormal or not; 2.3 If the detection direction has at least M times in the consecutive T rounds that satisfy r t,k >τ t,k then mark this direction as abnormal; and take the global maximum residual using equation (9), if it exceeds the threshold Γ, then determine that there is a global abnormality in the current round and issue a warning.

4. The online anomaly detection and recovery method for homomorphic encryption neural network according to claim 1 or 2, characterized in that, The process of step 3 is as follows: 3.1 An approximate linear relationship between the residual vector and the parameter disturbance vector is established to obtain the mapping between the residual and the parameter offset; 3.2 The gradient vector g of the residual with respect to the parameter is calculated and screened to obtain a candidate abnormal parameter set S; 3.3 Introduce a hierarchical weight factor to the candidate parameters in the set, resulting in an importance score s i Select the most likely to be attacked parameter in a ranked manner.

5. The online anomaly detection and recovery method for homomorphic encryption neural network according to claim 1 or 2, characterized in that, The process of step 4 is as follows: 4.1 Formulate the least-squares optimization problem with L2 regularization to obtain the optimal perturbation compensation vector 4.2 L1 regularization constraint is used to enhance sparsity to obtain the compensation result.

6. The online anomaly detection and recovery method for homomorphic encryption neural network according to claim 1 or 2, wherein, The process of step 5 is as follows: 5.1 The compensation vector is encrypted, and the target parameter is updated to obtain the repaired parameter; 5.2 To avoid excessive accumulation of noise, the repaired ciphertext is dynamically monitored for noise budget, and if the noise threshold is exceeded, Bootstrapping refresh is triggered.

7. The online anomaly detection and recovery method for homomorphic encryption neural network according to claim 1 or 2, wherein, The process of step 6 is as follows: 6.1 Re-sample and compute residual r after inpainting is done t+1,k , judge the inpainting effect, if the maximum residual is below a threshold Γ', consider the inpainting effective; 6.2 If the convergence condition is met for H consecutive rounds, the repair is terminated, otherwise step 3 is returned to continue execution.

Images