Polynomial chain verification method and device for outsourcing neural network inference

Abstract

The present application relates to the field of specific computing model and information security technology, aiming at the problems of high computing cost and high cost in existing outsourcing reasoning technology, a polynomial chain verification method and device for outsourcing neural network reasoning are proposed.The method comprises: data input;in the preprocessing stage, the client generates the mask matrix of the input data, the model end generates the mask and the verification auxiliary matrix of the model parameter, the input data, the mask matrix and the Beaver triple are divided into multiple shares and distributed to different computing servers;by constructing a verifiable polynomial chain, the verification amount and the mask are generated under additive secret sharing and returned to the client, and by designing a polynomial form of verification equation, the verification of the reasoning process is completed.The present application completes the reasoning verification by designing a polynomial equation, ensures the integrity of the whole process and the privacy, and realizes the low-overhead, low-cost step-level verification with constant-level online verification calculation time of parallel computing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of specific computing models and information security technology, and in particular to a polynomial chain verification method and device for outsourcing neural network inference. BACKGROUND

[0002] With the rapid development of artificial intelligence big data and deep learning technology, various neural networks including convolutional neural networks (CNN) have been widely used in image recognition, medical diagnosis, financial risk control, autonomous driving and other technical fields. However, neural network inference usually requires a large amount of computing resources, and many model providers with limited resources are difficult to complete the inference task independently, so they will outsource the inference task to a cloud server, and the user providing the input information data will directly provide the information data to the computing server for inference calculation, and finally the computing server will return the calculation and inference result to the user, which completes a complete neural network inference service for information data. However, this outsourcing inference method based on the computing server carrying the third-party provided model has also brought serious privacy and security problems:

[0003] Information data privacy leakage: the user's input data (such as medical images, face data) may contain highly sensitive information, and direct upload to the server poses a risk of leakage;

[0004] Model security threat: model providers (such as hospitals, financial companies, etc.) do not want model parameters to be leaked or misused;

[0005] Untrusted computing: outsourcing servers may use low-quality models, tamper with data, or return incorrect results for cost-saving or malicious purposes.

[0006] It is necessary to protect the privacy and security of information data transmission and computing inference process of users and model providers while realizing the verifiability of inference results. The mainstream method used by the existing technology is to use complex cryptography (such as ZKP) or TEE to realize it. Although these mainstream methods can achieve high security and verifiability, they also bring high computational overhead or high cost, which is not realistic in real deployment, so it is urgent to propose a safe and efficient inference verification method. Therefore, in view of the low-cost and high-efficiency verifiability of safe inference results, the present application proposes a step-level verification method that can complete verification only with polynomial equations and the online verification calculation time is constant. SUMMARY

[0007] In view of the above technical problems, the present application proposes a polynomial chain verification method and device for outsourcing neural network inference.

[0008] The application provides a polynomial chain verification method for outsourcing neural network inference, comprising the following steps:

[0009] In step 110, a weight matrix of a multifunctional layer designed neural network and polynomial coefficients of a nonlinear layer approximate activation function are input at the model end; the weight matrix at least comprises a convolution kernel matrix of a convolution layer, a weight matrix of a fully connected layer and a bias matrix; and a plurality of sensing data matrices are input at the client end;

[0010] In step 120, preprocessing operations of the client and the model end are performed; the weight matrix, the polynomial coefficients and a pre-constructed Beaver triple are respectively divided into a plurality of shares by additive secret sharing and distributed to different computing servers; and each computing server stores the received shares in a hardware-isolated secure storage area;

[0011] In step 130, each computing server calls a set parallel logic computing unit to perform online outsourcing inference calculation and verification on each functional layer in the outsourcing neural network inference process, comprising the following steps: each computing server calculates and outputs the verification quantity of each functional layer in an additive secret sharing state based on the stored shares in the secure storage area and the preset polynomial chain rule; the verification quantity is returned to the client after being masked; and the client verifies the masked verification quantity in the mask domain by using a polynomial form verification equation, if the verification is passed, the subsequent inference is continued, and if the verification is not passed, the inference is aborted;

[0012] In step 140, if all the functional layers are verified, the client calculates a trusted plaintext inference result according to the product of the public key and the multiplication factor of the last functional layer and the output share of the last functional layer.

[0013] In another aspect, the application provides a polynomial chain verification device for outsourcing neural network inference, comprising the following steps:

[0014] A first module is used for inputting a weight matrix of a multifunctional layer designed neural network and polynomial coefficients of a nonlinear layer approximate activation function at the model end; the weight matrix at least comprises a convolution kernel matrix of a convolution layer, a weight matrix of a fully connected layer and a bias matrix; and a plurality of sensing data matrices are input at the client end;

[0015] A second module is used for performing preprocessing operations of the client and the model end; the weight matrix, the polynomial coefficients and a pre-constructed Beaver triple are respectively divided into a plurality of shares by additive secret sharing and distributed to different computing servers; and each computing server stores the received shares in a hardware-isolated secure storage area;

[0016] The third module is configured to call the set parallel logical computing unit of each computing server to perform online outsourcing inference calculation and verification on each function layer in the outsourcing neural network inference process, including: each computing server calculates and outputs the verification quantity of each function layer in an additive secret sharing state based on the shares stored in the secure storage area and the preset polynomial chain rule; the verification quantity is returned to the client after being masked; the client verifies the masked verification quantity in the masking domain using the polynomial form of the verification equation, and if the verification is passed, the subsequent inference is continued, and if the verification is not passed, the inference is aborted.

[0017] The fourth module is configured to calculate the trusted plaintext inference result according to the product of the public key and the multiplicative factor of the last function layer and the output share of the last function layer if all the function layers are verified.

[0018] Compared with the prior art, the present application has the following advantages:

[0019] (1) By using additive secret sharing to distribute sensor data and model parameter shares to multiple computing servers, and by designing a chain verification mechanism based on a polynomial equation for each layer, the expensive global proof generation is abandoned. The computing server relies on the parallel logical computing unit and the random material pre-stored in the secure storage area, and only needs to add a cheap local operation to generate the verification quantity, which controls the overall cost at a very low level, making it possible to perform secure outsourcing inference in a resource-constrained scenario.

[0020] (2) By introducing step-level verification, the verification is performed immediately after each layer calculation. With the isolation characteristics of hardware security storage, the client can immediately abort the process if any layer fails the verification. This fast-failure mechanism avoids subsequent calculations based on incorrect results, significantly saving outsourcing calculation cost and time, especially for large-scale and high-frequency service scenarios.

[0021] (3) The verification mechanism provided by the present application is naturally compatible with the secure multi-party computing framework, and the verification material can be generated in the preprocessing phase. The verification equation is directly derived from the calculation logic of each function layer, without the need for complex model modification. The scheme is completely based on algorithms and fully utilizes the parallel computing and secure storage capabilities of general-purpose computing servers, making it easy to integrate and deploy, and greatly reducing the difficulty and cost of landing. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, brief descriptions will be given below for the drawings needed in the embodiments or prior art descriptions. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained from the structures shown in these drawings without creative labor.

[0023] Figure 1 Figure 1 is a schematic diagram of the steps of a polynomial chain verification method for outsourcing neural network inference according to an embodiment of the present application;

[0024] Figure 2 Figure 2 is a schematic diagram of an application scenario framework according to an embodiment of the present application, wherein, each weight matrix of the model end is split into parts and sent to a computing server; each sensor data matrix of the client is split into parts and sent to a computing server;

[0025] Figure 3 Figure 3 is a schematic diagram of an intermediate verification part overview according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of the present application.

[0027] In one embodiment, as shown in Figure 1 the present application provides a polynomial chain verification method for outsourcing neural network inference, comprising:

[0028] Step 110, input the weight matrix of the neural network designed by the multi-functional layer and the polynomial coefficient of the nonlinear layer approximate activation function at the model end; the weight matrix at least includes the convolution kernel matrix of the convolution layer, the weight matrix of the fully connected layer and the bias matrix; input a plurality of sensor data matrices at the client end;

[0029] Step 120, perform preprocessing operations at the client end and the model end; use additive secret sharing to respectively split the weight matrix, the polynomial coefficient and the pre-constructed Beaver triple into a plurality of shares and distribute them to different computing servers; each computing server stores the received shares in a hardware-isolated secure storage area;

[0030] ​​​​Step 130, each computing server calls the set parallel logic computing unit, and performs online outsourcing inference calculation and verification on each function layer in the outsourcing neural network inference process, including: each computing server calculates and outputs the verification quantity of each function layer in an additive secret sharing state based on the shares stored in the secure storage area and the preset polynomial chain rule; the verification quantity is returned to the client after being masked; the client verifies the masked verification quantity in the masking domain using the polynomial form of the verification equation, and if the verification is passed, the subsequent inference is continued, and if the verification is not passed, the inference is aborted;

[0031] Step 140, if all function layers are verified, the client calculates the trusted plaintext inference result according to the product of the public key of the last function layer and the same multiplication factor and the output share of the last function layer.

[0032] In one embodiment, the input client's said sensor data matrix is derived from the to-be-processed information of a perception signal in the physical world.

[0033] The perception signal at least includes a visual signal captured by an optical image sensor, an audio signal captured by an acoustic sensor, a medical biological signal captured by a medical sensor, or a time sequence monitoring signal captured by an industrial sensor.

[0034] The sensor data matrix is obtained after the to-be-processed information of the perception signal is digitized, preprocessed, and characterized.

[0035] If the to-be-processed information is text data, the client first converts the text data into a word vector matrix as the input sensor data matrix.

[0036] If the to-be-processed information is a structured database, the client first constructs one or more rows of records of the structured database as a feature vector to form a sensor data matrix for input.

[0037] In one embodiment, considering the application scenario of outsourcing neural network inference verification, as shown in Figure 2 , there is a semi-honest client and a semi-honest model , a malicious majority of computing servers . The Dishonest Majority means that the honest party does not account for the majority, and the multiple computing servers participating in the calculation form a group of MPC participants. In the MPC protocol, the honest party does not account for the majority, which means the worst-case assumption and the strongest security mode.

[0038] In one embodiment, the computing server is at least configured with:

[0039] Parallel logic computing unit, used to process the core operation of the output share participation of each functional layer at the same time;

[0040] Secure storage area, used to isolate the storage of the output share, intermediate calculation share and verification state (verification pass or abort reasoning) of each functional layer during the calculation process, to prevent unauthorized data exchange with non-secure memory area;

[0041] Dedicated verification quantity generation calculation module, which realizes parallel scheduling of the calculation process and the main reasoning calculation process in hardware, so that most of the verification overhead is hidden.

[0042] The client will distribute the reasoning data to multiple computing servers through additive secret sharing, and the model side will distribute its weight matrix to the corresponding multiple computing servers through additive secret sharing, then each server will perform CNN reasoning on the obtained share, and finally return the result to the client. The client verifies the result returned by the computing server, and the overview of the intermediate verification part is as shown in Figure 3 If the verification is passed, the result is accepted and the reasoning is continued; if the verification is not passed, the result is rejected and the reasoning is aborted.

[0043] The security goals to be achieved include:

[0044] Privacy: ensure the privacy and security of the client input data and the model input model;

[0045] Computational correctness: the result returned by the computing server is correct, that is, the client's data and the final result are not tampered with;

[0046] Model reliability: the computing server indeed uses the model provided by the model side for reasoning, and does not use a low-quality model for reasoning (that is, the computing server does not tamper with the model weight or structure).

[0047] In one embodiment, the neural network (CNN) used for outsourcing neural network reasoning in the present application includes at least nine different functional layers, namely: a first convolutional layer, a first activation layer, a first pooling layer, a second convolutional layer, a second activation layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer. The specific representation is as follows:

[0048] ;

[0049] Wherein, represents the input sensor data matrix; represents the convolution operation of the first convolutional layer, which is used to extract low-level features of the information to be processed and generate feature maps; represents the operation of the first activation layer, which uses the activation function Introducing nonlinearity, enhancing the expressive ability of the model, and outputting the feature map after nonlinear transformation; representing the average pooling operation of the first pooling layer, used for dimension reduction and reducing the amount of calculation while retaining important features, and outputting the feature map after dimension reduction; representing the convolution operation of the second convolution layer, used for further extracting high-level features (such as shape, pattern), and outputting the high-level feature map; representing the operation of the second activation layer, also using the activation function Introducing nonlinearity, enhancing the expressive ability of the model, and outputting the feature map after nonlinear transformation again; representing the average pooling operation of the second pooling layer, used for further dimension reduction and reducing the size of the feature map, and outputting the feature map after dimension reduction again; representing the operation of the first fully connected layer, used for flattening the pooled feature map into a one-dimensional vector and performing linear transformation to learn high-level feature combinations; outputting the hidden feature vector; representing the operation of the second fully connected layer, used for further processing features, possibly reducing dimensions or increasing nonlinearity, and outputting higher-level feature vectors; representing the operation of the output layer, used for generating the final inference result . Among all the above nine functional layers, the first convolution layer, the first pooling layer, the second convolution layer, the second pooling layer, and the first fully connected layer are encryption target functional layers that need to be encrypted. The first activation layer, the second activation layer, and the output layer are nonlinear layers that do not need to be encrypted but need to set activation functions. The encryption target functional layer and the second fully connected layer are both linear functional layers.

[0050] The approximate activation function used in the activation layer is:

[0051] ;

[0052] wherein, represents the input data of the approximate activation function, is the polynomial coefficient of the approximate activation function ;

[0053] The approximate activation function used in the output layer is:

[0054] ;

[0055] wherein, is the polynomial coefficient of the approximate activation function .

[0056] Specifically, in step 110, the edge will input: convolution kernel matrices (W1, W2, …, Wn) , , These correspond to the number of kernels in the first and second convolutional layers, respectively, and the kernel matrix of the first convolutional layer. The convolution kernel matrix of the second convolutional layer The weight matrices of the first fully connected layer and the second fully connected layer. , Bias matrix , , and the polynomial coefficients of each approximate activation function; Several terminal inputs A private sensor data matrix.

[0057] Furthermore, in the preprocessing stage of step 120, the client randomly generates a verification value and constructs a mask matrix for each sensor data matrix in conjunction with the random reference matrix provided by the model. The model generates multiple sets of random key triples, multiplication factors, random compression variables, and random reference matrices, and constructs mask matrices for model parameters and each functional layer. This step prepares the basic data and random materials for subsequent efficient online parallel computing and verification, and relies on a secure storage area for isolation and protection.

[0058] In one embodiment, the preprocessing stage in step 120 includes:

[0059] Step 121, Client ( Preprocessing operations at the terminal:

[0060] (1) Randomly generate verification values ; It is the sensor data matrix input by the client.

[0061] (2) Use the verification value and the random parameter matrix sent by the model to analyze each input. Masking:

[0062] ;

[0063] in, The random reference matrix generated by the model is compared with the input. Same dimension, The elements are independent and random.

[0064] (3) Using additive secret sharing to share each and its mask matrix Each disassembled into Distribute to The computing server; the Each computing server received a share , The obtained shares are then stored in the corresponding secure storage area for hardware isolation.

[0065] Step 122, the pre-processing operation of the model end (server end) The parallel logic computing unit efficiently generates a large number of random materials, which are pre-stored in the secure storage area of each server for use in the online stage. The pre-processing operation mainly includes:

[0066] (1) Generate multiple sets of random key triplets, which contain keys composed of three random numbers, to prevent the client from inversely deducing the model parameters or intermediate results through the intermediate masking results.

[0067] In each set of random key triplets, the first two random numbers are private keys, and the third random number is a public key composed of the product of the first two independent random numbers (private keys); the random key triplets provide an entropy source for subsequent masking and verification. The last set of random key triplets is assigned to the second fully connected layer and the output layer.

[0068] Generate a global scalar factor, which is equal to a random power of 2 and less than the finite field size in the Beaver triplet ;

[0069] Generate an additional random masking balance factor, and generate a random compression variable for each encrypted target function layer (first convolutional layer, first pooling layer, second convolutional layer, second pooling layer, first fully connected layer) to represent the output dimension of the corresponding encrypted target function layer; the number of random compression variables is the same as the number of encrypted target function layers (including the first convolutional layer, the first pooling layer, the second convolutional layer, the second pooling layer, and the first fully connected layer).

[0070] Generate a general random reference matrix .

[0071] Send the random materials required for the masking process to each computing server; the random materials at least include the scalar factor, multiple sets of random key triplets, and random compression variables.

[0072] In one embodiment, for a four-layer model example, four sets of random key triplets are generated:

[0073] ;

[0074] wherein , and are private keys, is a public key, and and are independent of each other, and the public key is composed of ; the last set of ​a random key triad is assigned to the second fully connected layer and the output layer.

[0075] re-generate a random number as a co-ride factor, wherein, t is a random positive integer, and , is a finite computation field size (a large prime number); re-generate two additional random mask balancing factors , and five random compression variables representing the corresponding encryption target function layer output dimensions and a random reference matrix .

[0076] Finally, the co-ride factor , four sets of random key triads and random compression variables are sent to each computing server, and the random reference matrix and the product of the public key of the last function layer and the co-ride factor are sent to the client.

[0077] (2) Take the random reference matrix as input, and pre-compute the corresponding flattened (flatten the matrix into a vector) output of each linear function layer in the neural network model. The first activation layer / second activation layer does not need to be pre-computed.

[0078] Generate mask values for model parameters and intermediate calculation shares, which are used to convert high-dimensional vector verification into efficient scalar verification, including:

[0079] Using the co-ride factor and the random key triad, mask the model parameters to generate mask values; the model parameters at least include: the polynomial coefficients of the approximate activation function and , and additional random random mask balancing factors;

[0080] Using the random compression variable, the co-ride factor and the random key triad, calculate the inner product of the flattened output of each function layer obtained by pre-computation to generate compressed scalar mask values.

[0081] Send the random reference matrix , the product of the public key of the last function layer and the co-ride factor, the scalar mask value, and the mask value of the original output of the last layer to the client.

[0082] In one embodiment, the respective flattened outputs of the first convolutional layer, the first pooling layer, the second convolutional layer, the second pooling layer, the first fully connected layer, and the second fully connected layer are respectively: , , , , , .

[0083] Then use With the activation function coefficients of the convolutional layer , Multiply to get the mask value , ;use and , , Multiply them separately to obtain the mask value , , ;

[0084] use and , , Multiply them separately to obtain the mask value , , ;

[0085] use and , , Multiply them separately to obtain the mask value , , ;

[0086] use and , Multiply them separately to obtain the mask value , ;

[0087] use and , , , , Multiply them separately to obtain the mask value , , , , ;

[0088] use and , , Multiply them separately to obtain the mask value , , ;

[0089] Compute inner product respectively , , , , , , , , , , get the corresponding scalar mask value: , , , , , , , , , ;

[0090] Wherein, represents a constant matrix with elements , and the length of the vector obtained after flattening is the same as / for computing inner product; is a constant matrix with elements used by the first pooling layer / second pooling layer, and the length of the vector obtained after flattening is the same as / for computing inner product. The upper and lower index marks of the above mask value / scalar mask value do not refer to any specific numerical variable, but only distinguish the variable, and subsequent details will not be explained one by one.

[0091] Finally, all the scalar mask values and the mask values of the original output (uncompressed) of the last functional layer (output layer) are:

[0092] ;

[0093] ;

[0094] All are sent to end.

[0095] The above , are only used to identify the related operations in the bias matrix , , and do not refer to any specific numerical variable. The corresponding upper and lower index marks of other matrices in the subsequent description represent the same, and details will not be explained one by one.

[0096] (3) Use additive secret sharing to share each weight matrix ( , , or 、 、 ) and polynomial coefficients of an approximate activation function 、 、 、 、 、 into shares and distributed to computing servers; the th computing server gets the share: 、 、 、 、 、 、 . represents the share distributed to the th computing server.

[0097] Step 123, using the multiplication gate operation, generates a Beaver triple and splits it into shares using additive secret sharing and distributes them to computing servers.

[0098] The Beaver triple, as the basis of secure computation random material, is the core of random key triple data operations (especially multiplication operations), used to efficiently and securely handle multiplication operations in subsequent privacy-preserving inference calculations. By protecting data and models through secret sharing and random masking, most of the computational burden is transferred to the offline preprocessing phase, and multiple computing servers are also supported for parallel collaboration, thereby improving computational efficiency and scalability.

[0099] For the input lines (two lines connected to the input end of the multiplication gate, each secretly holding the input value, that is, the two parties performing secret sharing) of the multiplication gate (multiplication operation) and , the Beaver triple is represented as:

[0100] ;

[0101] is an independent random number, is a random number determined by , satisfying:

[0102] ;

[0103] where denotes the modulo operation; denotes the modulo operation, is the finite field size in Beaver triplets.

[0104] The specific preprocessing steps are shown in Table 1.

[0105] Table 1: Preprocessing steps of Beaver triplets

[0106]

[0107] wherein, denotes the modulo of the (integer ring) finite field; denotes random sampling.

[0108] After being split into shares by additive secret sharing, the server holds the share as shown in Table 2.

[0109] Table 2: Server holding share

[0110]

[0111] and globally satisfy:

[0112] ;

[0113] The entire preprocessing process is described as: one multiplication gate operation → all computing servers synchronize to consume their own share, and all shares are used up and discarded. That is, one multiplication consumes one triplet.

[0114] Specifically, in step 130, each computing server calls the set parallel logical computing unit to perform online outsourcing inference calculation and verification for each functional layer in the outsourcing neural network inference process, including:

[0115] In the first convolutional layer / second convolutional layer, the online outsourcing inference calculation and verification are performed:

[0116] Each computing server calls the parallel logical computing unit to securely complete the convolution operation based on the secret shared input shares and convolution kernel weight shares in the secure storage area, generate the output shares of the first convolutional layer / second convolutional layer and store them in the secure storage area;

[0117] The dedicated verification quantity generation calculation module works synchronously, and generates the verification quantity of the first convolutional layer / second convolutional layer: the mask projection value, by performing consistency transformation on the output shares and the corresponding mask convolution result;

[0118] Each computing server returns the mask projection value to the client;

[0119] The client determines the correctness of the current layer of convolution calculation by verifying whether the preset verification equation is satisfied between the mask projection values, so as to determine whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped.

[0120] The calculation and verification of online outsourcing reasoning are performed in the first activation layer / second activation layer:

[0121] Each computing server approximates the nonlinear activation function as a polynomial function, calls a parallel logical calculation unit, and based on the input shares secret shared in the secure storage area, uses the pre-shared random key triplets to securely complete the polynomial function calculation to obtain the activation output shares and the corresponding intermediate calculation shares;

[0122] The mask projection values for verification are generated by performing consistency transformation on the activation output shares and the corresponding intermediate calculation shares;

[0123] The client determines the correctness of the current layer of activation calculation by verifying whether the verification equation determined by the coefficients of the polynomial function and the verification result of the previous functional layer is satisfied between the mask projection values, so as to determine whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped.

[0124] The calculation and verification of online outsourcing reasoning are performed in the first pooling layer / second pooling layer:

[0125] Each computing server calls a parallel logical calculation unit, performs a linear pooling operation on the activation output shares and the corresponding intermediate calculation shares of the previous functional layer, obtains the pooling output shares by local calculation, and stores them in the secure storage area;

[0126] A dedicated verification quantity generation calculation module synchronously works, and generates mask projection values for verification by performing consistency transformation on the pooling output shares;

[0127] The client determines the correctness of the current layer of pooling calculation by verifying whether the verification equation determined by the coefficients of the polynomial function and the verification result of the previous functional layer is satisfied between the mask projection values, so as to determine whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped.

[0128] The calculation and verification of online outsourcing reasoning are performed in the first fully connected layer:

[0129] Each computing server calls a parallel logical calculation unit, performs a linear pooling operation on the activation output shares and the corresponding intermediate calculation shares of the previous functional layer, obtains the pooling output shares by local calculation, and stores them in the secure storage area;

[0130] The output shares of the first full connection layer and the intermediate calculation shares of the previous functional layers are uniformly transformed to generate mask projection values for verification;

[0131] The client verifies whether the verification equations determined by the weight coefficients of the current functional layer, the verification results of the previous functional layers, and the coefficients of the polynomial function are satisfied between the mask projection values, to determine the correctness of the full connection calculation of the current layer and whether to continue reasoning: if the verification equations are satisfied, the reasoning is continued, otherwise the reasoning is stopped;

[0132] The calculation and verification of online outsourcing reasoning are performed in the second full connection layer:

[0133] Each computing server calls a parallel logical calculation unit to perform a full connection operation with bias on the input output shares of the first full connection layer and the corresponding mask output, and performs a full connection operation without bias on the intermediate calculation shares corresponding to the previous functional layers, to obtain the output shares of the second full connection layer and the corresponding intermediate calculation shares;

[0134] The output shares of the second full connection layer and the intermediate calculation shares corresponding to the previous functional layers are uniformly transformed to generate verification quantities for verification: mask values;

[0135] The client verifies whether the verification equations determined by the weight coefficients of the current functional layer, the verification results of the previous functional layers, and the coefficients of the polynomial function are satisfied between the mask projection values, to determine the correctness of the full connection calculation of the current layer and whether to continue reasoning: if the verification equations are satisfied, the reasoning is continued, otherwise the reasoning is stopped;

[0136] The calculation and verification of online outsourcing reasoning are performed in the output layer:

[0137] Similar to the previous activation layer, each computing server calls a parallel logical calculation unit to approximate the non-linear output layer function to a polynomial function, and based on the input shares of the secret sharing in the secure storage area, the polynomial function calculation is securely completed using the pre-shared random key triplets, to obtain the output shares of the output layer and the corresponding intermediate calculation shares;

[0138] A dedicated verification quantity generation calculation module works synchronously, and the output shares of the output layer and the corresponding intermediate calculation shares are uniformly transformed to generate mask values (without projection) for verification;

[0139] The client verifies whether the verification equations determined by the weight coefficients of the current functional layer, the verification results of the previous functional layers, and the coefficients of the polynomial function are satisfied between the mask projection values, to determine the correctness of the full connection calculation of the current layer and whether to continue reasoning: if the verification equations are satisfied, the reasoning is continued, otherwise the reasoning is stopped;

[0140] In one embodiment, each functional layer performs the computation and verification of online outsourcing inference, specifically including:

[0141] (1) The first convolutional layer

[0142] Input: , , ;

[0143] Operation:

[0144] The sliding window of is pulled into a matrix:

[0145] The window volume is , and the number of output pixels is

[0146] The sliding window of is pulled into a matrix:

[0147] The window volume is , and the number of output pixels is

[0148] The sliding window of is pulled into a matrix:

[0149] The number of output channels, i.e., the number of convolutional kernels, is

[0150] Each computing server locally expands each share to obtain: .

[0151] The calculation needs to be performed:

[0152] ;

[0153] For each element :

[0154] Take the Beaver triple share (size 1x1, a total of groups).

[0155] Local calculation is performed:

[0156] ;

[0157] Broadcast and reconstruct:

[0158] ;

[0159] Local recalculation:

[0160] ; ​

[0161] Beaver triples are invalid.

[0162] Restoring the tensor: (shape ) Obtained by using the reshape function Similarly, the mask matrix can be calculated. Convolution output This refers to the result after convolving the mask matrix. The `reshape` function is a commonly used tensor operation function used to change the shape (dimensional layout) of a tensor without changing the data elements it contains.

[0163] Output: , ;

[0164] Masking operations:

[0165] ;

[0166] ;

[0167] Verification returned: , ;

[0168] Client-side verification: The client reconstructs the mask result. , (The client cannot directly reconstruct the original plaintext), then verify the equation:

[0169] ;

[0170] If the equation is true, continue the reasoning; otherwise, stop the reasoning.

[0171] In the above process, each computing server uses a secretly shared convolutional kernel matrix. For the actual input share and mask input share Perform the same secret-shared convolution operation to obtain two output shares. (use These represent the outputs of the first convolutional layer, the second convolutional layer, the first fully connected layer, and the second fully connected layer, respectively. )and ;

[0172] Then, random compression variables were used. (Its main function is to offload the main computation process to the computing server, reducing the computational overhead of online verification on the client side) and mask factor Calculate the inner product together and As the verification share of this layer and , and send to client;

[0173] Client aggregates the reconstructed global scalar: with , and combines with the reference value pre-computed at model side ( denotes the linear transformation of the first convolution layer operation), verify:

[0174] ;

[0175] The values in the verification equation are all scalars;

[0176] If the equation holds, continue, otherwise abort.

[0177] The construction principle of the above verification equation: the convolution layer operation belongs to linear operation, which does not change the relationship between the real input and the mask input, so the verification equation still satisfies the similar linear relationship, that is:

[0178] ;

[0179] Add mask becomes is to meet the privacy security requirements, that is, not to let the client obtain the plaintext intermediate result, so as to prevent it from inversely deducing the model parameters.

[0180] (2) The first activation layer

[0181] Input: ;

[0182] Operation: approximate the activation function as a quadratic polynomial function:

[0183] ;

[0184] For each element , , (where is the output channel number; is the high direction row number of the output feature map; is the wide direction column number of the output feature map);

[0185] Calculate the square term by one Beaver triple multiplication operation:

[0186] Take Beaver triple share ;

[0187] Local calculation:

[0188] ;

[0189] Broadcast and reconstruct:

[0190] ;

[0191] Local computation:

[0192] ;

[0193] Beaver triplets are invalidated;

[0194] Obtain linear and constant terms of linear operation (linear gate) respectively:

[0195] (Local scalar product);

[0196] Directly use pre-distributed fragments to obtain .

[0197] Merge by local accumulation:

[0198] ;

[0199] After completion, obtain active sharing , shape same as input.

[0200] Let = ,

[0201] Obtain intermediate results:

[0202] = ;

[0203] Output: , ;

[0204] Mask operation:

[0205] ;

[0206] ;

[0207] Verification returns: , ;

[0208] Client verification: the client reconstructs the mask result , , and then verifies the equation:

[0209] ;

[0210] If the equation is true, continue reasoning; otherwise, abort reasoning.

[0211] In summary, each computing server computes the real result of the first convolutional layer output , applies a quadratic polynomial approximation , computes the square term share through a secure multiplication protocol (existing), and generates the real path activation output share using linear combination ;

[0212] Then use random compression variables to perform inner product compression on the real result and its square term respectively, generating multiple scalar verification shares;

[0213] After the client reconstructs these scalars, combined with the reference value calculated and compressed by the model side based on plaintext, the algebraic identity derived from the polynomial expansion is verified to ensure that the nonlinear transformation has not been tampered with.

[0214] The construction principle of the verification equation: because theoretically the input and the output After reconstruction, the following theoretical equation should be satisfied:

[0215] ;

[0216] But the computing server may tamper with the intermediate result, so the data verified in the previous layer can be embedded in this verification equation, because the data of the previous layer satisfies , that is:

[0217] ;

[0218] Substitute the theoretical equation of this layer: , get the final verification equation:

[0219] ;

[0220] Finally, add a mask to each scalar to get the client's verification equation for this layer:

[0221] ;

[0222] Since and already exist in the previous layer and have been verified, they can be used directly, so the computing server only needs to return , .

[0223] (3) The first pooling layer

[0224] Input: , , ;

[0225] Operation:

[0226] First consider average pooling, by window summation, perform local addition operation on all elements within each pooling window (no interaction, no communication overhead), get the summation result:

[0227] ;

[0228] Convert the summation result to the average value by using the multiplicative inverse:

[0229] ;

[0230] Where, represents the number of elements within the pooling window; is the multiplicative inverse in the finite field .

[0231] Preferably, the multiplicative inverse can be obtained by pre-computing the constant inverse, stored locally; this pre-computation is completed in the protocol initialization phase, avoiding online computation overhead.

[0232] The shape of the output tensor is , where, is the output channel number; is the high direction row number of the output feature map; is the wide direction column number of the output feature map;

[0233] Output: , , ;

[0234] Mask operation:

[0235] ;

[0236] ;

[0237] ;

[0238] Verification returns: , , ;

[0239] Client verification: the client reconstructs the mask result , , (the client cannot directly reconstruct the original plaintext), and then verifies the equation:

[0240] ;

[0241] If the equation holds, continue reasoning; otherwise, abort reasoning.

[0242] Note that since average pooling is a linear operation, it does not change the verification structure of the previous layer, only that each item in it is the pooling output (pooling of a constant is still a constant, so it is ):

[0243] ;

[0244] As before, the calculation server only returns the content of part of the items in the verification equation, and the client already has the pre-computed (as reference value embedded in the verification equation) on the model side, so the calculation server only needs to return , , .

[0245] The entire average pooling process only involves local calculation and constant multiplication, and has extremely high efficiency under the secure multi-party computing framework, without the need for interaction and communication between the parties.

[0246] (4) Second convolutional layer

[0247] Input: , , , ;

[0248] Operation: same as the first convolutional layer, use Beaver triplets to complete matrix multiplication. Let the convolution operation be , then the following output is obtained:

[0249] ;

[0250] ;

[0251] ;

[0252] ;

[0253] Output: , , , ;

[0254] Mask operation:

[0255] ;

[0256] ;

[0257] ;

[0258] ;

[0259] Verification return: , , , ;

[0260] Client verification: Client reconstructs the masked result , , , (The client cannot directly reconstruct the original plaintext), and then verifies the equation:

[0261] ;

[0262] If the equation is true, continue reasoning; otherwise, abort reasoning.

[0263] In fact, since the convolution layer is also a linear layer, it does not change the structure of the previous layer verification equation, only each item in it is the output of the second convolution layer, and by analogy, the precomputed reference value is embedded , the calculation server only needs to return , , .

[0264] (5) The second activation layer

[0265] Input: ;

[0266] Operation: Same as the first activation layer, calculate the square term using Beaver triplets, and calculate other terms locally. Get the intermediate result:

[0267] ;

[0268] Output: , ;

[0269] Mask operation: ;

[0270] ;

[0271] Verification return: , ;

[0272] Client verification: Client reconstructs the masked result , (The client cannot directly reconstruct the original plaintext), and then verifies the equation:

[0273] ;

[0274] If the equation holds, continue reasoning; otherwise, abort reasoning.

[0275] In the second activation layer, similar to the processing of the first activation layer, the existing output and pre-computed reference value in the last layer (in the second convolution layer) are used: 、 、 、 .

[0276] (6) Second pooling layer

[0277] Input: 、 、 、 、 ;

[0278] Operation: Same as the first pooling layer operation.

[0279] Output: 、 、 、 、 ;

[0280] Mask operation:

[0281] ;

[0282] ;

[0283] ;

[0284] ;

[0285] ;

[0286] Verification return: 、 、 、 、 ;

[0287] Client verification: The client reconstructs the mask result 、 、 、 、 (The client cannot directly reconstruct the original plaintext), and then verifies the equation:

[0288] ;

[0289] If the equation holds, continue reasoning; otherwise, abort reasoning.

[0290] (7) The first fully connected layer

[0291] Input: , , , , , ;

[0292] Operation:

[0293] Use Flatten operation (local operation): each computing server locally flattens the share to a vector:

[0294] ;

[0295] where, denotes a module finite field of dimension ;

[0296] Use weight matrix multiplication to calculate:

[0297] ;

[0298] where the weight matrix is used, and the inner product each time uses a Beaver triple (same as the convolution layer logic)

[0299] Add bias:

[0300] ;

[0301] Let the above operation be :

[0302] ;

[0303] And so on.

[0304] In addition, let the operation of the fully connected layer without bias be .

[0305] Output: , 、 、 、 、 ;

[0306] Mask operation:

[0307] ;

[0308] ;

[0309] ;

[0310] ;

[0311] ;

[0312] ;

[0313] Verification returns: , 、 , 、 、 ;

[0314] Client verification: the client reconstructs the mask result , , , , , (The client cannot directly reconstruct the original plaintext), and then verifies the equation:

[0315] ;

[0316] If the equation is true, continue reasoning; otherwise, abort the reasoning.

[0317] It should be noted that the only difference between the operation of the first fully connected layer and the convolutional layer is the additional bias: the additional bias is generated after the weight multiplication based on the verification of the equation in the previous layer (the first fully connected layer), and then an additional bias is added to each term on both sides of the equation After coefficient integration, the redundant is obtained.

[0318] For further explanation, an example is given (the symbol variables involved in this example are irrelevant to the variables set in the present application, and are only for explaining the operation above): for example, the equation , first multiply the weights on both sides to get , note that this is a full connection operation without bias, and then add a bias to get:

[0319] ;

[0320] This is the same as the original equation , only an additional bias is added to both sides Item, next complete the offset operation:

[0321] ;

[0322] ;

[0323] ;

[0324] Get:

[0325] ;

[0326] Adjustment after integration:

[0327] .

[0328] (8) the second full connection layer

[0329] Input: , , , , , ,

[0330] ;

[0331] Operation: same as the first full connection layer;

[0332] Output: , , , , , , ;

[0333] Mask operation:

[0334] ;

[0335] ;

[0336] ;

[0337] ;

[0338] ;

[0339] ;

[0340] ;

[0341] Verification return: 、 、 、 、 、 、 ;

[0342] Client verification: Client reconstructs the masked result 、 、 、 、 、 、 (Client cannot directly reconstruct the original plaintext), and then verify the equation:

[0343] ;

[0344] If the equation is true, continue reasoning; otherwise, abort reasoning.

[0345] (9) Output layer

[0346] Input: ;

[0347] Operation: Same as the activation layer operation. But approximate the activation function of the output layer as a quadratic polynomial function:

[0348] ;

[0349] Output: 、 ;

[0350] Masking operation: = 、 = ; The output layer masking operation does not need to be compressed;

[0351] Verification return: 、 ;

[0352] Client verification: Client reconstructs the masked result 、 (Client cannot directly reconstruct the original plaintext), and then verify the equation:

[0353] ;

[0354] If the equation is established, the result is accepted, otherwise it is not accepted.

[0355] The output layer is similar to the activation layer, but in this layer, because the original result is to be calculated, the compression variable is not used for compression, and the original mask result is directly returned.

[0356] Finally, in step 140, if all function layers pass the verification in step 130, the client calculates the trusted plaintext inference result according to the mask inference result (output share) output by the last function layer and the public key of the last function layer and the same multiplication factor : , to obtain the trusted plaintext inference result.

[0357] Specifically, after the foregoing verification, the client locally obtains the following trusted plaintext inference result:

[0358] .

[0359] In summary, by using the method provided by the present application, the following beneficial effects can be obtained:

[0360] (1) The client's private sensing data matrix and the model's key parameters are split into multiple shares by using additive secret sharing and distributed to multiple computing servers equipped with parallel logical computing units and secure storage areas. By abandoning the idea of generating a global cryptographic proof, a chain verification mechanism based on polynomial equations is designed for each layer of calculation, so that the computing server does not need to perform expensive proof generation operations. The computing server only needs to perform secure calculation using parallel logical computing units, and additionally perform inexpensive local masking and random scalar multiplication (the required random material is pre-stored in the secure storage area), to generate the mask result required for verification. This scheme controls the calculation and communication overhead of the overall verification to a very low level, making it possible to perform secure outsourcing inference on resource-constrained edge devices or in delay-sensitive application scenarios.

[0361] (2) By introducing a step-level verification mechanism, the client can immediately verify the output of each layer after the calculation of each layer is completed. The computing server stores the output share and verification status of each layer in the hardware secure storage area, ensuring the independence of the verification. Once any layer fails the verification, the client can immediately abort the subsequent process. This hardware-supported fast failure mechanism avoids unnecessary calculations on incorrect or tampered intermediate results, saving a lot of outsourcing calculation costs and waiting time for the model party and the user. The cost-saving effect is particularly significant for large-scale and high-frequency outsourcing inference services.

[0362] (3) The verification mechanism adopted by the present application is naturally compatible with the underlying secure multi-party computation framework. The data required for verification, such as the mask matrix, can be generated together with the Beaver triple in the preprocessing stage and stored in the secure storage area of the computing server. The design of the verification equation is directly derived from the inherent computing logic of each functional layer of the neural network, which is a natural extension of the computing process, and does not require complex modification of the model structure. Since the scheme is completely based on algorithm implementation and makes full use of general parallel logic computing units and secure storage modules, it is easy to integrate into existing machine learning workflows and can be deployed on any general-purpose computing server, significantly reducing the difficulty of landing and deployment costs.

[0363] In one embodiment, the present application provides a polynomial chain verification device for outsourcing neural network inference, comprising:

[0364] A first module for inputting a weight matrix of a neural network designed with multiple functional layers and polynomial coefficients of an approximate activation function of a nonlinear layer at the model end; the weight matrix at least includes a convolution kernel matrix of a convolution layer, a weight matrix of a fully connected layer, and a bias matrix; and a plurality of sensor data matrices are input at the client end;

[0365] A second module for performing preprocessing operations at the client end and the model end; using additive secret sharing, the weight matrix, the polynomial coefficients, and the pre-constructed Beaver triple are respectively divided into a plurality of shares and distributed to different computing servers; each computing server stores the received shares in a hardware-isolated secure storage area;

[0366] A third module for each computing server to call the set parallel logic computing unit to perform online outsourcing inference calculation and verification for each functional layer in the outsourcing neural network inference process, including: each computing server calculates and outputs the verification quantity of each functional layer in an additive secret sharing state based on the shares stored in the secure storage area and the preset polynomial chain rule; the verification quantity is returned to the client after being masked; the client verifies the masked verification quantity using the verification equation in polynomial form in the masking domain, and if the verification is passed, the subsequent inference is continued, and if the verification is not passed, the inference is aborted;

[0367] A fourth module for, if all functional layers are verified, the client calculates a trusted plaintext inference result based on the product of the public key and the same multiplication factor of the last functional layer and the output share of the last functional layer.

[0368] In another aspect, the present application also provides, in an embodiment, a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the steps of the method for outsourcing neural network inference polynomial chain verification provided in any of the above embodiments.

[0369] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware, and the computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, the processes of the above-mentioned embodiments can be included. Any reference to memory, storage, database or other medium used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct RAM bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0370] The details of the present application are as described above.

[0371] The technical features of the above embodiments can be combined in any manner. To make the description concise, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0372] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the application. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the protection scope of the present application.

[0373] The above merely provides the preferred embodiments of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the principles and technical scope of the present application shall fall into the scope of the present application.

Claims

1. A polynomial chain verification method for outsourcing neural network inference, characterized in that, The method comprises the following steps: Step 110: inputting a weight matrix of a multi-functional layer designed neural network and polynomial coefficients of an approximate activation function of a non-linear layer at a model end; The weight matrix at least comprises a convolution kernel matrix of a convolution layer, a weight matrix of a fully connected layer and a bias matrix; and a plurality of sensing data matrices are inputted at a client end; Step 120: performing a preprocessing operation at the client end and the model end; using additive secret sharing, the weight matrix, the polynomial coefficients and a pre-constructed Beaver triple are respectively divided into a plurality of shares and distributed to different computing servers; each computing server stores the received shares in a hardware-isolated secure storage area; Step 130: each computing server calls a set parallel logical computing unit to perform online outsourcing inference calculation and verification for each functional layer in an outsourcing neural network inference process, which comprises: each computing server calculates and outputs a verification quantity of each functional layer in an additive secret sharing state based on the stored shares in the secure storage area and a preset polynomial chain rule; the verification quantity is returned to the client end after being masked; the client end verifies the masked verification quantity using a verification equation in a polynomial form in a mask domain; if the verification is passed, subsequent inference is continued; if the verification is not passed, the inference is aborted; Step 140: if all the functional layers are verified, the client end calculates a trusted plaintext inference result according to a product of a public key of the last functional layer and a multiplication factor and an output share of the last functional layer.

2. The method of claim 1, wherein, The sensing data matrices inputted by the client end are derived from to-be-processed information of perception signals in a physical world; The perception signals at least comprise visual signals captured by an optical image sensor, audio signals captured by an acoustic sensor, medical biological signals captured by a medical sensor or time sequence monitoring signals captured by an industrial sensor; The sensing data matrices are obtained after the to-be-processed information of the perception signals is digitized, preprocessed and characterized.

3. The method of claim 1, wherein, The security model / threat model used by the outsourcing neural network inference at least comprises a semi-honest client, a semi-honest model end and a plurality of malicious majority computing servers; The computing servers are at least configured with: a parallel logical computing unit for simultaneously processing core operations participated by the output shares of each functional layer; a secure storage area for isolating storage of the output shares, intermediate calculation shares and verification states of each functional layer during the calculation process to prevent unauthorized data exchange with a non-secure memory area; a dedicated verification quantity generation computing module for realizing parallel scheduling of the calculation process and the main inference calculation process on hardware, so that most of the verification overheads are hidden.

4. The method of claim 1, wherein, The neural network used by the outsourcing neural network inference at least comprises the following functional layers: a first convolution layer, a first activation layer, a first pooling layer, a second convolution layer, a second activation layer, a second pooling layer, a first fully connected layer, a second fully connected layer and an output layer. The first convolutional layer, the first pooling layer, the second convolutional layer, the second pooling layer, and the first fully connected layer are encryption target function layers; the first activation layer, the second activation layer, and the output layer are nonlinear layers that do not need to be encrypted but need to be set with activation functions; the encryption target function layers and the second fully connected layer are linear function layers; an approximation activation function employed by the first activation layer or the second activation layer is given by ； wherein, represents input data to an approximation activation function, is a polynomial coefficient of the approximation activation function ​ The output layer adopts an approximate activation function: ； wherein, are polynomial coefficients of an approximation of the activation function ​ The model end input: Convolution kernel matrix of the first convolution layer ; Convolution kernel matrix of the second convolution layer ; weight matrix of the first fully connected layer ; weight matrix of the second fully connected layer ; and a bias matrix: , ; The polynomial coefficients of each approximate activation function; The client inputs a sensing data matrix.

5. The method of claim 4, wherein, The step 120 comprises: The step 121, a preprocessing operation of the client, comprises: Randomly generating a check value ; is the input matrix of sensor data; Using the check value and the random reference matrix sent by the model end, a mask is performed on each input to obtain a mask matrix of the sensing data matrix: ； wherein, is a matrix of the same dimension as the input matrix of sensor data and elements are mutually independent random variables. By using additive secret sharing, each input sensor data matrix and the corresponding mask matrix is respectively split into shares and distributed to computing servers and stored in the corresponding secure storage areas, wherein the th computing server obtains the shares respectively denoted as: , ; The step 122, a preprocessing of the model end, comprises: A plurality of groups of random key triplets are generated, each group of random key triplets comprising a private key of two independent random numbers and a public key of a third random number, wherein the public key is a product of the first two independent private keys, and the random key triplet of the last group is assigned to the second fully connected layer and the output layer; generating a global cofactor equal to a random power of 2 and less than the size of the finite field in the beaver triple ; An additional random mask balance factor and a random compression variable are generated for each encryption target function layer, which is used to represent the output dimension of the corresponding encryption target function layer; the number of random compression variables is the same as the number of layers of the encryption target function layers; Generating a general random reference matrix ; Random materials required by the mask process are sent to each computing server; the random materials at least comprise a same multiplication factor, a plurality of groups of random key triplets, and a random compression variable; a random reference matrix As input, the flattening output corresponding to each linear functional layer in the neural network model is pre-computed in advance, and the first activation layer / second activation layer does not need to be pre-computed; Mask values of model parameters and intermediate calculation shares are generated, which are used to convert the verification of high-dimensional vectors into efficient scalar verification, comprising: The model parameters at least include: polynomial coefficients of an approximate activation function and and an additional random mask balance factor The flattened outputs of each function layer obtained by pre-computation are calculated by using the random compression variable, the same multiplication factor, and the random key triplet, and an inner product is generated, and a compressed scalar mask value is generated; sending the random reference matrix the product of the public key of the last functional layer and the same multiplication factor, the scalar mask value, and the masked value of the original output of the last layer to the client; polynomial coefficients of the weight matrix and the activation function are split into shares using additive secret sharing , , , , , , shares, distributed to computing servers; let denote the corresponding share distributed to the th computing server; Step 123, the multiplication gate operates, generates the Beaver triple, and splits it into portions, distributed to computing servers; Each multiplication gate operation, all computing servers synchronously consume their own assigned shares, and all shares are used up and discarded.

6. The method of claim 5, wherein, In the step 122: Four groups of random key triplets are generated: ； wherein, , and the random number and are mutually independent private keys, and the random number is a public key, composed of ; the last group of random key triplets is assigned to the second fully connected layer and the output layer; generating a random number as a copilot factor, and wherein, t is a random positive integer, and ; Randomly generate two additional random mask balancing factors , and a random compression variable ; The linear function layers: a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, a first full connection layer, and a second full connection layer, and the corresponding flattened outputs are respectively: , , , , , ; With Convolution layer activation function coefficients , Mask value , ; Use With , , respectively multiplied to get the mask value , , ; Use With , , respectively multiplied to get the mask value , , ; with and , , respectively multiplied to get the mask value , , ; With With , respectively multiplied to obtain the mask value , ; with and , , , , respectively multiplied to get the mask value , , , , ; Use With , , respectively multiplied to get the mask value , , ; The inner product is calculated for pre-computation: 、 、 、 、 、 、 、 、 、 , resulting in a corresponding scalar mask value: 、 、 、 、 、 、 、 、 、 ; wherein, represents a constant matrix with elements , and the length of the vector obtained after flattening is the same as the inner product / ; is a constant matrix with elements used by the first pooling layer / second pooling layer, and the length of the vector obtained after flattening is the same as the inner product / ; The mask value of the original output of the last function layer is: ； 。 7. The method of claim 6, wherein, In the step 130, further comprising: The calculation and verification of online outsourcing inference are performed on the first convolutional layer / second convolutional layer: Each computing server calls a parallel logical calculation unit, based on the input shares and convolution kernel weight shares secret shared in the secure storage area, and uses the pre-shared random key triplet to safely complete the convolution operation, to generate the output shares of the first convolutional layer / second convolutional layer and store them in the secure storage area; A dedicated verification quantity generation calculation module works synchronously, and generates the verification quantity of the first convolutional layer / second convolutional layer by performing consistency transformation on the output shares and the corresponding mask convolution results: mask projection values; Each computing server returns the mask projection values to the client; The client determines the correctness of the convolution calculation of the current layer by verifying whether the mask projection values satisfy a preset verification equation, so as to decide whether to continue inference: if the verification equation is established, the inference is continued, otherwise the inference is stopped; The calculation and verification of online outsourcing inference are performed on the first activation layer / second activation layer: Each computing server approximates the nonlinear activation function as a polynomial function, calls the parallel logical computing unit, and based on the input shares of the secret sharing in the secure storage area, uses the pre-shared random key triplets to securely complete the polynomial function calculation to obtain the activation output shares and the corresponding intermediate calculation shares; The activation output shares and the corresponding intermediate calculation shares are subjected to consistent transformation to generate mask projection values for verification; The client verifies whether the mask projection values satisfy the verification equation determined by the coefficients of the polynomial function and the verification results of the previous functional layer, judges the correctness of the activation calculation of the current layer, and decides whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped; The calculation and verification of online outsourcing reasoning are performed in the first pooling layer / second pooling layer: Each computing server calls the parallel logical computing unit, performs linear pooling operation on the activation output shares and the corresponding intermediate calculation shares of the previous functional layer, obtains the pooling output shares through local calculation, and stores them in the secure storage area; The dedicated verification quantity generation calculation module works synchronously, generates mask projection values for verification through consistent transformation on the pooling output shares; The client verifies whether the mask projection values satisfy the verification equation determined by the coefficients of the polynomial function and the verification results of the previous functional layer, judges the correctness of the pooling calculation of the current layer, and decides whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped.

8. The method of claim 7, wherein, In step 130, it also includes: The calculation and verification of online outsourcing reasoning are performed in the first fully connected layer: Each computing server calls the parallel logical computing unit, performs bias-connected fully connected operation on the input pooling output shares and the corresponding mask output, and performs bias-free fully connected operation on the intermediate calculation shares corresponding to the previous functional layers, to obtain the output shares of the first fully connected layer and the corresponding intermediate calculation shares; The output shares of the first fully connected layer and the intermediate calculation shares of the previous functional layers are subjected to consistent transformation to generate mask projection values for verification; The client verifies whether the mask projection values satisfy the verification equation determined by the weight coefficients of the current functional layer, the verification results of the previous functional layers, and the coefficients of the polynomial function, judges the correctness of the fully connected calculation of the current layer, and decides whether to continue reasoning: if the equation is established, the reasoning is continued, otherwise the reasoning is stopped; The calculation and verification of online outsourcing reasoning are performed in the second fully connected layer: Each computing server calls the parallel logical computing unit, performs bias-connected fully connected operation on the input output shares of the first fully connected layer and the corresponding mask output, and performs bias-free fully connected operation on the intermediate calculation shares corresponding to the previous functional layers, to obtain the output shares of the second fully connected layer and the corresponding intermediate calculation shares; The output shares of the second fully connected layer and the corresponding intermediate calculation shares of the previous functional layers are subjected to consistent transformation to generate verification quantities for verification: mask values; The client determines the correctness of the full connection calculation of the current layer by verifying whether the verification equation determined by the weight coefficient of the current function layer, the verification result of the previous function layer and the coefficient of the polynomial function is satisfied between the mask values, so as to determine whether to continue reasoning: if the verification equation is established, the reasoning is continued, otherwise the reasoning is stopped.

9. The method of claim 8, wherein, In step 130, the calculation and verification of online outsourcing reasoning in the output layer are also included: Each computing server calls the parallel logical calculation unit, approximates the nonlinear output layer function to a polynomial function, based on the input share secret shared in the secure storage area, uses the pre-shared random key triple to securely complete the polynomial function calculation, and obtains the output share of the output layer and the corresponding intermediate calculation share; The dedicated verification quantity generation calculation module works synchronously, generates the mask value used for verification by consistent transformation on the output share of the output layer and the corresponding intermediate calculation share; The client determines the correctness of the output layer calculation by verifying whether the verification equation determined by the coefficient of the polynomial function and the verification result of the previous function layer is satisfied between the mask values, so as to determine whether the final plaintext result is calculated: if the verification equation is established, the final plaintext result is calculated and output, otherwise the calculation is stopped.

10. A polynomial chain verification device for outsourced neural network inference, characterized in that, Comprise: The first module is used for inputting the weight matrix of the multi-functional layer designed neural network and the polynomial coefficient of the nonlinear layer approximation activation function at the model end; The weight matrix at least includes: the convolution kernel matrix of the convolution layer, the weight matrix of the full connection layer and the bias matrix; a plurality of sensing data matrices are input at the client end; The second module is used for preprocessing operation of the client and the model end; the weight matrix, the polynomial coefficient and the pre-constructed Beaver triple are respectively divided into a plurality of shares by additive secret sharing and distributed to different computing servers; each computing server stores the received share in the hardware isolated secure storage area; The third module is used for each computing server to call the set parallel logical calculation unit to calculate and verify the online outsourcing reasoning of each function layer in the outsourcing neural network reasoning process, including: each computing server calculates and outputs the verification quantity of each function layer in the additive secret sharing state based on the share stored in the secure storage area and the preset polynomial chain rule; the verification quantity is returned to the client after being masked; the client verifies the masked verification quantity in the mask domain by using the verification equation in the form of polynomial, if the verification is passed, the subsequent reasoning is continued, if not, the reasoning is stopped; The fourth module is used for calculating the trusted plaintext reasoning result according to the product of the public key and the same multiplication factor of the last function layer and the output share of the last function layer if all the function layers are verified.

Images