Priority input queue processing method for privacy protection neural network reasoning

Abstract

The invention belongs to the technical field of network system optimization, and particularly relates to a priority input queue processing method for privacy protection neural network reasoning, which comprises a batch input privacy reasoning processing module, a homomorphic encryption-based slot multiplexing module and a priority input reasoning result recovery module. According to the method, joint calculation of priority input and existing input in the queue is realized, extra encryption calculation and communication overhead caused by a traditional queue jumping mode are avoided, and the overall reasoning efficiency and safety of the system are ensured. The method can achieve the quick response to the emergency request in a privacy protection neural network reasoning scene, and is suitable for the application fields of privacy protection machine learning service, cloud intelligent reasoning, safety data processing and the like.

Description

Technical Field

[0001] This application belongs to the field of network system optimization technology, specifically relating to a priority input queue processing method for privacy-preserving neural network inference. Background Technology

[0002] With the widespread application of machine learning models in fields such as computer vision, medical diagnosis, and financial analysis, model inference services are gradually shifting to cloud servers with high-performance computing power and large-scale models. By sending input data to the server and obtaining inference results, clients can obtain high-accuracy predictions at a lower cost. Privacy-preserving machine learning combines multi-party secure computation, homomorphic encryption, and other cryptographic techniques to complete inference computations without disclosing client input data and server model parameters, thus achieving privacy-preserving model inference services.

[0003] Existing privacy-preserving inference systems typically employ batch processing to improve overall throughput. This involves dividing the client input queue into several batches and executing encryption, inference, and result recovery operations sequentially. In this model, when high-priority or urgent inputs appear in the input queue, current technologies can only handle them by adjusting batch size or rearranging batch order. This results in subsequent inputs needing to wait for additional inference time, significantly increasing system latency and lacking flexible response capabilities to urgent tasks. In existing batch privacy-preserving inference schemes, the same encryption, computation, and communication processes are often repeatedly executed for different input samples. When a new or priority input appears, a new ciphertext often needs to be constructed separately and re-participated in the inference computation, introducing additional homomorphic encryption operations, ciphertext transmission, and multiple rounds of interactive communication, resulting in significant computational and communication overhead. Furthermore, in homomorphic encryption-based inference processes, multiple plaintext data elements are typically carried within a single ciphertext using ciphertext packaging. However, for different neural network layer structures and input sizes, there are often underutilized slots within the ciphertext. In existing technologies, these idle slots are usually ignored and cannot be directly used to assist in processing other inputs, resulting in a waste of homomorphic computing and communication resources.

[0004] In summary, existing privacy-preserving neural network inference technologies have low efficiency in processing priority inputs in batch inference scenarios. There is an urgent need for a privacy inference technology that can support efficient priority input processing while ensuring privacy and security. Summary of the Invention

[0005] To address the low efficiency of prioritization input processing in existing technologies, a prioritization input queue processing method for privacy-preserving neural network inference is proposed. This method is designed for privacy-preserving machine learning inference services executed collaboratively by the client and server. It achieves rapid response to prioritization inputs while ensuring client input privacy and server model parameter security, and avoids significantly impacting the inference efficiency of inputs in the original queue. The technical solution is as follows: A priority input queue processing method for privacy-preserving neural network inference, running in a privacy-preserving machine learning service system consisting of a client and a server, includes a batch input privacy inference processing module, a slot reuse module, and a priority input inference result recovery module: The batch input privacy inference processing module groups the inputs to be inferred in the queue according to a preset batch size, uses secret sharing for input and output, and combines homomorphic encryption computation to sequentially complete the batch inference computation of each layer function in the multilayer neural network under the privacy-preserving neural network inference framework, generating corresponding intermediate computation results. The multiple batch input privacy inference processing modules are connected in series according to the order of the calculated functions to complete the overall inference computation of the neural network. The slot reuse module, when a priority input is detected, fully utilizes the originally idle homomorphic ciphertext slots in the privacy inference process of the next batch, embedding the calculation of the priority input into the privacy inference calculation process of the highest priority batch; using the homomorphic ciphertext slot reuse method, the inference calculation of the priority input in each function of the neural network is completed without introducing additional homomorphic encryption calculation, and the corresponding encrypted intermediate results are obtained. The priority input inference result recovery module performs efficient result recovery processing on the encrypted intermediate results corresponding to the priority input after completing the inference calculation of the batch input, and obtains the inference result of the priority input. This ensures the efficiency and privacy security of the original input inference in the interrupted batch while achieving a fast privacy inference response for the priority input.

[0006] Preferably, the batch input privacy inference processing module includes the following processes: Step 1. The input to the privacy inference processing module is the priority input in secret sharing format and the input in the original queue. After completing the calculation of the nonlinear function and the subsequent linear function, the output results are distributed in secret sharing mode, and the subsequent privacy inference calculations are continued. Step 2. When performing the calculation of the nonlinear function, a secure comparison protocol based on unintentional transmission is adopted. According to the secret shared share of all inputs, the comparison and judgment between the real input value and the zero value is realized to obtain the intermediate result of the nonlinear function calculation. When performing batch inference calculations of linear functions, the intermediate results corresponding to the original queue inputs and the intermediate results corresponding to the priority inputs are mapped to the same set of homomorphic encrypted ciphertexts. This allows the homomorphic encrypted ciphertexts to simultaneously carry the calculation data of both the original queue inputs and the priority inputs, thereby obtaining the linear function output of the original queue inputs and all the intermediate results of the linear function output corresponding to the priority inputs.

[0007] Preferably, in the batch input privacy inference processing module, for any input in the batch input... Define the ReLU convolution composite function as follows: ; in, This represents the convolution function operation. Represents the ReLU activation function. For convolution operations, For convolution kernel parameters, For output channels, For input channels, For the high of the filter, This represents the width of the filter.

[0008] Express the ReLU activation function in its derivative form: ; The original expression can then be represented as: ; mod is the modulo operation, and p is the modulus. "This is element-wise multiplication; The activation function derivative and input are each split into secret shared shares held by the client and server, respectively: ; The "+" sign indicates element-wise addition. For bitwise XOR operation, This can be further expanded to: ; By introducing a client-generated random mask The above expression can be broken down into: ;

[0009] Random mask vector generated by the client .

[0010] Preferably, the computation is divided into an offline phase that is independent of the input. The offline phase specifically includes the following steps: Step 1: The server pre-generates the derivative of its nonlinear activation function. And inputx Secret sharing as well as and encrypt and the corresponding product terms The server then sends the encrypted ciphertext to the client. Step 2: The client generates a random mask vector. It is then homomorphically encrypted before being sent to the server; Step 3: The server, based on the received ciphertext and its local convolution kernel parameters, Calculate using homomorphic multiplication and homomorphic addition And introduce server-side random mask Generate mask result The result is sent to the client, so that both the client and the server hold [the relevant information]. Secret sharing and .

[0011] Preferably, the online phase related to input includes the following steps: Step 1: The client receives the input shared share. The server executes a secure comparison protocol based on unintended transmissions, where the server's input is a pre-generated... and The client thus obtains a secret sharing of the derivative of the nonlinear activation function. ; Step 2: The client calculates the intermediate ciphertext item according to the following formula: ;

[0012] and the obtained ciphertext Send to the server; Step 3: The server processes the received data. Decrypt and compare with locally held After adding them together, we perform a convolution operation to get: ;

[0013] The server uses a pre-generated random mask. ,Will Send it to the client in plaintext, so that both the client and the server each hold a copy. Secret Shares and .

[0014] Preferably, the slot reuse module fully fills the empty slots at the end of the intermediate ciphertext, thereby calculating the ciphertext corresponding to the priority input with almost zero additional overhead. The specific method is as follows: During batch inference, the corresponding intermediate ciphertext is input first. By utilizing server encryption and The tail slots are generated using homomorphic operations; Let the number of bits per ciphertext slot in a homomorphic encryption scheme be . ,enter The feature dimension is Then it is used for encryption. and The required number of ciphertexts is: ,in, This is for rounding up; because If there are empty slots in the last ciphertext, the number of which is defined as: .

[0015] The slot reuse module uses the aforementioned empty slots to fill the slots corresponding to the priority input. and The data allows the same ciphertext to simultaneously carry intermediate computational data of the original queue input and the priority input, thereby avoiding the generation of additional homomorphic ciphertext for the priority input.

[0016] Preferably, the slot reuse module fully fills the empty slots at the end of the intermediate ciphertext, calculating the convolution corresponding to the priority input with almost zero additional overhead. Specifically: During the offline phase, a random mask will be applied to the client side. Convert to matrix form using the im2col transformation: And flatten the server-side convolution kernel into a matrix: This will enable convolution operations Equivalently converted to matrix multiplication, let the number of bits per ciphertext slot in the homomorphic encryption scheme be . Because each row The length is The number of lines that can be packed into a single ciphertext is . ,in, This is a floor function; The client needs to construct A homomorphic ciphertext is used to complete the corresponding operation of an original queue input. Encryption. Due to Free slots are generated at the end of each ciphertext, and their number is defined as follows: .

[0017] Preferably, the slot reuse module will prioritize inputting the corresponding slot. Convert to matrix form using the im2col transformation, and then... Divide the columns into submatrices, sequentially dividing the columns into submatrices of number 1 and 2. Each submatrix is ​​filled row-wise into the empty slots, such that each input to the original queue... The ciphertext simultaneously encapsulates the original queue input and the corresponding random masked rows of data. The server then uses homomorphic multiplication and homomorphic addition to calculate the original queue input. When performing matrix multiplication, complete the input first. This corresponds to matrix multiplication, which in turn allows the user and server to obtain the original queue input and the priority input. The secret shared share.

[0018] Preferably, the slot multiplexing module organizes the data fragments about the priority input into a complete ciphertext about the priority input. And about Shared share.

[0019] Preferably, for the ciphertext entered first. :set up for and The greatest common divisor is then completed. After calculating the intermediate ciphertext input from the original queue, the client can additionally obtain... The complete intermediate ciphertext corresponding to each priority input. without introducing any additional homomorphic encryption operations; For the random mask item corresponding to the priority input :set up for and The greatest common divisor is then completed. After offline encryption calculation of the original queue input, the complete result is obtained. Each priority input corresponds to a random mask. The encrypted representation, thus allowing the user and server to obtain their respective... The original queue input is about While sharing the share, obtain Priority input about Shared share; Priority input about Secret Share: Calculated during the user's online phase After inputting y from the original queue, we get Each priority input corresponds to y, and then the priority input is combined with information about... The shared share, and priority input about The secret shared share.

[0020] Compared with the prior art, the beneficial effects of this application are as follows: In batch privacy inference, the computational capabilities of inputs within the same batch are fully utilized. By reusing computation slots in homomorphic encrypted ciphertexts, the inference computation of priority inputs is embedded without interrupting the computation process of the original queue inputs and with almost no reduction in inference efficiency. This significantly reduces the additional waiting costs introduced by the original queue inputs that are interrupted due to queue insertion. Specifically, by co-designing the linear and nonlinear computation stages in batch inference, priority inputs can reuse existing intermediate computational resources and encrypted computational structures in batch inference, completing the inference computation of priority inputs without introducing additional homomorphic encrypted computation operations. Attached Figure Description

[0021] Figure 1 This is a diagram illustrating the interaction between the server and the client. Figure 2 This is a schematic diagram of a slot reuse module based on homomorphic encryption disclosed in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] The method of the present invention comprises the following functional modules: a batch input privacy inference processing module, a slot reuse module based on homomorphic encryption, and a priority input inference result recovery module; the modules work together to complete batch inference and priority input processing under privacy protection conditions.

[0024] Batch input privacy inference processing module: The batch input privacy inference processing module is used to perform batch neural network inference calculations on the original inputs in the input queue under privacy protection conditions.

[0025] This module first groups the existing inputs in the input queue according to a preset batch value. Then, based on the secret shared share of the batch inputs, combined with homomorphic encryption and unintended transmission, it sequentially performs batch inference calculations for linear and nonlinear functions in the multi-layer neural network, generating corresponding intermediate calculation results. The user ultimately receives the neural network output. Here, the input to the batch input privacy inference processing module includes the secret shared share between the user and the server regarding the priority input and the original inputs in the queue. After completing the privacy calculation for each function block, the user and the server obtain the secret shared share of the output result of that function block, which is then used as the input for the next function block. By sequentially calculating the function blocks in the neural network, the entire privacy inference process from input to output is completed.

[0026] The basic function blocks processed by this module consist of adjacent nonlinear-linear functions. When calculating nonlinear functions, a secure comparison protocol based on unintended transmission is used to obtain intermediate results for the next linear function calculation. When calculating linear functions, the encrypted intermediate results corresponding to the original input and the encrypted intermediate results corresponding to the priority input are jointly mapped to a set of homomorphic ciphertexts. This allows the homomorphic ciphertexts to simultaneously carry the computational data of both the original and priority inputs. Thus, while obtaining the shared share of the linear function output from the original input, the synchronous calculation of the output results corresponding to the priority input is achieved through the reuse of idle slots in the homomorphic ciphertexts.

[0027] Specifically, for any input vector in the original queue input... Define adjacent ReLU-convolution function blocks as follows: (1); in, Represents the ReLU activation function. These are the parameters of the convolution kernel. The ReLU – convolutional composite function operation steps are as follows: Equivalent representation of a nonlinear function: The ReLU activation function can be expressed as the product of its derivative and the input: ;

[0028] Therefore, equation (1) can be rewritten as: (2);

[0029] Secret sharing modeling: The input vector and the derivative of the activation function are split using secret sharing methods in addition and XOR forms, respectively: ;

[0030] in, The secret share held by the client; A secret share held by the server; This represents the element-wise XOR operation. Using the Boolean-to-arithmetic conversion identity: ;

[0031] Then formula (2) can be expanded as follows: (3);

[0032] Expanding formula (3) yields an equivalent rewrite as: (4);

[0033] This includes introducing a random mask vector generated by the client. This allows the server to compute the first convolution in plaintext during the online phase, associated with the input, without exposing any information. Meanwhile, since the second convolution is independent of the input data, it can be computed offline.

[0034] Offline phase: The offline phase includes the following steps: The server generates the derivative of the nonlinear activation function and the secret shared share of the original input to the queue, respectively. as well as And calculate the product terms: Subsequently The product terms mentioned above are homomorphically encrypted and sent to the client; Client generates random mask vector The matrix is ​​converted into matrix form using the im2col transformation and then sent to the server after homomorphic encryption. The server, based on the received information... The ciphertext, and the local plaintext convolution kernel parameters. Through homomorphic encryption operations, calculate Subsequently, a server-side random mask was introduced. The ciphertext result is obtained through homomorphic subtraction: And send it to the client. Client decryption According to the corresponding ciphertext, we get The secret shared share is the plaintext. At the same time, the server will The secret sharing share is .

[0035] Online phase: The online phase includes the following steps: The client obtains a secret share of the input. And perform a secure comparison protocol based on unintentional transmission with the server to obtain secret share .

[0036] The client calculates the intermediate ciphertext using the following formula: (5);

[0037] and the ciphertext Send to the server.

[0038] server Decrypt and compare with locally held items. After adding them, calculate: (6);

[0039] Subsequently, the server introduced a random mask. and will The data is sent to the client in plaintext, allowing both the server and the user to hold a secret share of the first convolution result. and .

[0040] Slot reuse module and priority input inference result recovery module based on homomorphic encryption: A slot multiplexing module based on homomorphic encryption is used to process priority inputs during batch inference computation. During batch inference, the slot multiplexing module continuously detects whether there are priority inputs that need to be processed. When a priority input is detected, without interrupting the current batch inference process, it utilizes intermediate computing resources already generated during homomorphic encryption computation to allocate a computation slot for the priority input and embeds the computation of the priority input into the ongoing batch inference computation process. This module can fully fill the empty slots at the end of the intermediate ciphertext, achieving computation of the ciphertext corresponding to the priority input with almost zero additional overhead by using this module. And calculate the convolution corresponding to the priority input. .

[0041] The priority input inference result recovery module is used to recover the results of priority inputs embedded in the batch inference process after the original batch input inference calculation is completed. When the batch input inference calculation is finished, this module organizes and recovers the encrypted intermediate results corresponding to the priority inputs to obtain the final calculation result for the priority inputs. This ensures both the efficiency and privacy security of the original queue input inference while achieving a fast inference response for priority inputs. This module can organize data fragments related to priority inputs into a complete ciphertext of the priority inputs. And about Shared share.

[0042] To achieve priority input ciphertext The calculation steps are as follows, with almost zero additional overhead: According to the aforementioned formula, the intermediate ciphertext Secretly shared from the server side and product terms It is obtained element-wise through homomorphic constant multiplication and homomorphic addition. Therefore, in the implementation of homomorphic encryption, the server will... and Encryption is performed using a compact packing method, with each homomorphic ciphertext slot storing one element; each ciphertext can hold a maximum of [number missing]. One element; encryption or The required amount of ciphertext is: .

[0043] Issue with empty tail slots: Because in actual network structures there often exist Therefore, there must be an empty slot in the last ciphertext. Let the number of empty slots at the end be: (7);

[0044] Taking a typical backbone layer in a ResNet network as an example, when , , At that time, there were 7168 idle slots at the tail, with a slot utilization rate of only about 12%. Since homomorphic operations and ciphertext transmission always operate on the entire ciphertext, these idle slots will lead to a significant waste of computing and communication resources.

[0045] The splicing calculation idea based on slot reuse: The slot reuse module uses the aforementioned empty slots to fill the slots corresponding to the priority input. and The data allows the same ciphertext to simultaneously carry intermediate computational data of the original queue input and the priority input, thereby avoiding the generation of additional homomorphic ciphertext for the priority input.

[0046] Determining the priority input quantity: set up for and The greatest common divisor is then completed. After calculating the intermediate ciphertext input from the original queue, the client can additionally obtain... The complete intermediate ciphertext corresponding to each priority input. This does not require introducing any additional homomorphic encryption operations. When after... After each input is entered into the queue, the server can concatenate them to obtain a complete ciphertext of the priority input. And perform the same convolution operation on it to obtain the corresponding output y.

[0047] Implement a random mask item for the ciphertext input. The near-zero overhead calculation steps are as follows: In the foregoing embodiments, convolution terms Completed in the offline phase, where the client holds a random mask. The server holds the convolution kernel parameters. To facilitate homomorphic computation, this convolution operation is first converted into matrix multiplication form using the im2col transformation.

[0048] Matrix multiplication transformation: Specifically, the client will use a random mask. Convert to matrix form using the im2col transformation: The server flattens the convolution kernel parameters into a matrix: Then convolution calculation It is equivalent to matrix multiplication.

[0049] Homomorphic computation and ciphertext structure properties During the offline phase, the client accesses the matrix. Homomorphic encryption is performed before sending to the server. The server performs matrix multiplication only using homomorphic multiplication and homomorphic addition. Because the matrix... The length of each line is The number of slots for homomorphic ciphertext is When the following conditions are met: In this case, empty slots will inevitably be generated at the end of each ciphertext, a situation that often exists in mainstream neural network structures such as ResNet.

[0050] Slot reuse mechanism based on row splicing Regarding the aforementioned issue of empty slots, the corresponding [slots] will be entered first. Convert to matrix form using the im2col transformation, and then... The columns are divided into submatrices, where The number of free slots generated in each ciphertext: .

[0051] Column number is sequentially Each submatrix is ​​filled row-wise into the empty slots, such that each input to the original queue... The ciphertext simultaneously encapsulates the original queue input and the corresponding random masked rows of data. The server then uses homomorphic multiplication and homomorphic addition to calculate the original queue input. When performing matrix multiplication, complete the input first. This corresponds to matrix multiplication, which in turn allows the user and server to obtain the original queue input and the priority input. The secret shared share.

[0052] Determining the priority input quantity: Let the number of complete lines that each ciphertext can hold be: Encrypt a complete The required amount of ciphertext is: Then for each input from the original queue The ciphertext can be padded with information from the first input at the end. Each element. Filled by accumulating ciphertext from multiple queued inputs, it can be completed. After normal computation of the original queue inputs, they are concatenated to obtain a complete priority input. Furthermore, consider optimization using the greatest common divisor; Let a and b be the greatest common divisor, where if: ; Then in encryption After inputting from the original queue, it can be completed without additional cost. The complete set of priority inputs Encryption and convolution computation.

[0053] System Implementation: In this embodiment, the method of the present invention is implemented based on the CryptoFlow2 framework, and different network environments are simulated using network traffic control tools under the Linux system. The computing platform used for testing includes a multi-core processor and a large amount of memory, and all experiments are run under single-threaded conditions.

[0054] In the experiment, the method proposed in this invention was compared with existing privacy inference schemes CrypTFlow2, Cheetah and FIT. The comparison focused on the computational and communication overhead generated by different methods in the offline and online stages when queue interruption occurs, as well as the efficiency performance of the original queue input itself in the system.

[0055] Implementation environment and comparison schemes: In a local area network (LAN) environment, the network bandwidth was set to approximately 3Gbps, and the round-trip time (RTT) was approximately 0.8ms. In a wide area network (WAN) environment, four different configuration conditions were constructed: WAN1: network bandwidth of 100Mbps, network RTT of 40ms; WAN2: network bandwidth of 100Mbps, network RTT of 80ms; WAN3: network bandwidth of 200Mbps, network RTT of 40ms; WAN4: network bandwidth of 200Mbps, network RTT of 80ms. These network configuration parameters are consistent with the experimental settings of the existing privacy inference system, used to simulate changes in communication conditions in a real deployment environment.

[0056] Regarding the hardware platform, the computing device used in this embodiment is configured as follows: the computing device adopts an Intel® Core™ i9-14900KF multi-core central processing unit with 32 logical computing cores; the computing device is equipped with 128GB of system memory to support the storage and processing of homomorphic encrypted ciphertext, secret shared data, and intermediate calculation results of neural networks. During system operation, all experiments are completed in single-threaded execution mode.

[0057] In this embodiment, to verify the performance of the proposed privacy-preserving queue-jumping calculation method, a typical convolutional neural network basic calculation module under the ImageNet dataset is selected as the evaluation object to evaluate the computational efficiency of the method in the queue-jumping scenario.

[0058] Explanation of computational overhead in queue insertion scenarios: In this embodiment, common basic computational modules in neural networks were tested to evaluate the additional computational overhead incurred by subsequent queue inputs when priority input interruption occurs. This additional overhead includes computational and communication costs introduced in both offline and online phases. Table 1 compares the additional computational overhead incurred by subsequent queue inputs in different schemes disclosed in this embodiment when priority input interruption occurs.

[0059] Table 1. Experimental Results of Communication Overhead and Time Overhead .

[0060] Experimental results show that, compared with existing privacy inference schemes such as CryptoFlow2, Cheetah, and FIT, the method proposed in this invention introduces only minimal additional overhead to subsequent queue inputs when queue insertion occurs, and its communication overhead and computation time are significantly reduced, with a reduction of one to two orders of magnitude.

[0061] The reason for this is that the present invention employs a method of embedding priority input computation within the batch inference process. This reuses and embeds the computation process that would otherwise need to be executed separately for priority inputs into the ongoing batch queue input computation, thus making the priority input computation process nearly costless. In contrast, existing solutions typically require restarting a complete privacy inference computation process for priority inputs, leading to significant waiting times and accumulated overhead for subsequent queue inputs.

[0062] Furthermore, because the present invention merges and transmits the final shared results of the priority inputs during the communication process, it merges and sends the shared results of the priority inputs with the shared results of the last queue input in the batch, thereby further reducing the number of communication rounds and the amount of communication, so that the additional time overhead introduced in different network environments remains at a low level.

[0063] Considering that offline computation is independent of specific inputs, while online computation directly impacts system real-time performance, this embodiment further compares and analyzes the additional overhead of the online computation. Results show that even in low-latency environments such as local area networks, compared to the more efficient FIT scheme, the method of this invention can still reduce the additional overhead in queue-jumping scenarios by approximately 4 to 21 times.

[0064] Meanwhile, although Cheetah employs a more efficient homomorphic encryption and unintentional transmission underlying implementation, its overall overhead is lower than CryptoFlow2 and FIT. However, by effectively eliminating the homomorphic encryption computation and additional communication overhead required for priority input, this invention can further reduce the additional overhead by an order of magnitude in queue-jumping scenarios, thus demonstrating significant technical advantages.

[0065] Inference performance evaluation based on the original queue input: In this embodiment, in addition to focusing on the additional overhead of priority input queueing scenarios, the inference performance of normal queue input in the system itself was also evaluated to verify that the present invention does not reduce the original inference efficiency.

[0066] Experimental results show that, during the overall inference process with normal queue input, the method proposed in this invention is comparable to the existing efficient privacy inference scheme FIT in terms of computation time, and its overall performance is better than CrypTFlow2; in terms of communication overhead, it remains on the same order of magnitude as FIT, without introducing significant additional communication burden. Table 2 is a comparison table of the inference performance evaluation of normal queue input in different scheme systems disclosed in the embodiments of this invention.

[0067] Table 2 .

[0068] Further analysis of the online performance shows that this method is significantly better than CrypTFlow2 in terms of online computation time, and is basically on par with FIT. In a local area network environment, the online inference time of this solution is even lower than that of the comparative solution, indicating that it has good adaptability to low-latency scenarios.

[0069] While the Cheetah scheme outperforms Cheetah in terms of traffic, this is primarily due to its further optimization of the inadvertent transmission module. By replacing the corresponding comparison module and employing a more efficient homomorphic encryption backend, the online computation and communication overhead of this scheme can be further reduced to a level comparable to Cheetah.

[0070] In summary, this invention achieves fast response to priority input while maintaining inference performance for normal queue input, thereby effectively reducing the negative impact on the overall system throughput caused by the introduction of the queue-jumping mechanism.

[0071] A priority input queue processing apparatus for privacy-preserving neural network inference includes a memory and a processor. The memory stores a computer program, and the processor invokes the program instructions to execute the method described in this application.

[0072] In this specification, the present invention has been described with reference to specific embodiments. These embodiments are preferred embodiments of the present patent and are not intended to limit the scope of the invention. It should be noted that the present invention is not limited to the specific embodiments described above. Improvements, variations, combinations, substitutions, etc., made by those skilled in the art without departing from the principles of the present invention are all within the scope of protection claimed in the claims of the present invention.

[0073] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A method for processing a priority input queue for privacy-preserving neural network inference, characterized in that, This includes a batch input privacy inference processing module, a slot reuse module, and a priority input inference result recovery module: The batch input privacy inference processing module groups the inputs to be inferred in the queue according to a preset batch size, uses secret sharing for input and output, and combines homomorphic encryption computation to sequentially complete the batch inference computation of each layer function in the multilayer neural network under the privacy-preserving neural network inference framework, generating corresponding intermediate computation results. The multiple batch input privacy inference processing modules are connected in series according to the order of the calculated functions to complete the overall inference computation of the neural network. The slot reuse module, when a priority input is detected, makes full use of the originally idle homomorphic ciphertext slots in the privacy inference process of the next batch, and embeds the calculation of the priority input into the privacy inference calculation process of the highest priority batch. By utilizing the homomorphic ciphertext slot multiplexing method, the inference calculations of the priority inputs in each function of the neural network are completed, and the corresponding encrypted intermediate results are obtained. The priority input inference result recovery module performs efficient result recovery processing on the encrypted intermediate results corresponding to the priority inputs after completing the inference calculation of the batch inputs, and obtains the inference results of the priority inputs.

2. The priority input queue processing method for privacy-preserving neural network inference according to claim 1, characterized in that, The batch input privacy inference processing module includes the following processes: Step 1. The input to the privacy inference processing module is the priority input in secret sharing format and the input in the original queue. After completing the calculation of the nonlinear function and the subsequent linear function, the output results are distributed in secret sharing mode, and the subsequent privacy inference calculations are continued. Step 2. When performing the calculation of the nonlinear function, a secure comparison protocol based on unintentional transmission is adopted. According to the secret shared share of all inputs, the comparison and judgment between the real input value and the zero value is realized to obtain the intermediate result of the nonlinear function calculation. When performing batch inference calculations of linear functions, the intermediate results corresponding to the original queue inputs and the intermediate results corresponding to the priority inputs are mapped to the same set of homomorphic encrypted ciphertexts. This allows the homomorphic encrypted ciphertexts to simultaneously carry the calculation data of both the original queue inputs and the priority inputs, thereby obtaining the linear function output of the original queue inputs and all the intermediate results of the linear function output corresponding to the priority inputs.

3. The priority input queue processing method for privacy-preserving neural network inference according to claim 1, characterized in that, In the batch input privacy inference processing module, for any input in the batch input... Define the ReLU convolution composite function as follows: ； in, This represents the convolution function operation. Represents the ReLU activation function. For convolution operations, For convolution kernel parameters, For output channels, For input channels, For the high, The width of the filter; Express the ReLU activation function in its derivative form. : ； The original expression can then be represented as: ； mod is the modulo operation, where p is the modulus. "This is element-wise multiplication; The activation function derivative and input are each split into secret shared shares held by the client and server, respectively: ； Split into secret shared shares Secretly shared shares Input x is split into secret shared shares. Secretly shared shares ; Where "+" means adding element by element. For bitwise XOR operation, This can be further expanded to: ； By introducing a client-generated random mask The above expression can be broken down into: ； Random mask vector generated by the client .

4. The priority input queue processing method for privacy-preserving neural network inference according to claim 3, characterized in that, The computation is divided into an offline phase that is independent of the input. The offline phase specifically includes the following steps: Step 1: The server pre-generates the derivative of its nonlinear activation function. And input x Secret sharing as well as and encrypt and the corresponding product terms The server then sends the encrypted ciphertext to the client. Step 2: The client generates a random mask vector. It is then homomorphically encrypted before being sent to the server; Step 3: The server, based on the received ciphertext and its local convolution kernel parameters, Calculate using homomorphic multiplication and homomorphic addition And introduce server-side random mask Generate mask result The result is sent to the client, so that both the client and the server hold [the relevant information]. Secret Shares and .

5. The priority input queue processing method for privacy-preserving neural network inference according to claim 3, characterized in that, The online phase related to input specifically includes the following steps: Step 1: The client obtains the input secret shared share. The server executes a secure comparison protocol based on unintended transmissions, where the server's input is a pre-generated... and The client thus obtains a secret share of the derivative of the nonlinear activation function. ; Step 2: The client calculates the intermediate ciphertext item according to the following formula: ； and the obtained ciphertext Send to the server; Step 3: The server processes the received data. Decrypt and compare with locally held After adding them together, we perform a convolution operation to get: ; The server uses a pre-generated random mask. ,Will Send it to the client in plaintext, so that both the client and the server each hold a copy. Secret Shares and .

6. The priority input queue processing method for privacy-preserving neural network inference according to claim 1, characterized in that, The slot reuse module fills all the empty slots at the end of the intermediate ciphertext and calculates the priority input ciphertext. The specific method is as follows: During batch inference, the corresponding intermediate ciphertext is input first. By utilizing server encryption and The slots at the tail are generated using homomorphic operations; Let the number of bits per ciphertext slot in a homomorphic encryption scheme be . ,enter The feature dimension is Then it is used for encryption. and The required number of ciphertexts is: ,in, For floor operations, These represent the number of input channels and the height and width of the input channels, respectively. because The last ciphertext contains the number of free slots. Its definition is: ； The slot reuse module uses idle slots to fill the slots corresponding to the priority input. and The data allows the same ciphertext to simultaneously carry intermediate computational data from both the original queue input and the priority input.

7. The priority input queue processing method for privacy-preserving neural network inference according to claim 6, characterized in that, The slot reuse module fully fills the empty slots at the end of the intermediate ciphertext and calculates the convolution corresponding to the priority input. Specifically: During the offline phase, a random mask will be used on the client side. Convert to matrix form using the im2col transformation: And flatten the server-side convolution kernel into a matrix: This will enable convolution operations Equivalently converted to matrix multiplication, let the number of bits per ciphertext slot in the homomorphic encryption scheme be . Because each row The length is The number of lines that can be packed into a single ciphertext is . ,in, For floor operations, , These represent the height and width of the output channel, respectively. The client needs to construct A homomorphic ciphertext is used to complete the corresponding operation of an original queue input. Encryption; because The number of free slots generated at the end of each ciphertext Its definition is: 。 8. The priority input queue processing method for privacy-preserving neural network inference according to claim 6, characterized in that, The slot reuse module will prioritize inputting the corresponding slot. Convert to matrix form using the im2col transformation, and then... Divide the columns into submatrices, successively dividing the columns into submatrices. Each submatrix is ​​filled row-wise into the empty slots, such that each input to the original queue... The ciphertext simultaneously encapsulates the original queue input and the corresponding random masked rows of data. The server then uses homomorphic multiplication and homomorphic addition to calculate the original queue input. When performing matrix multiplication, the input is completed first. This corresponds to matrix multiplication, which in turn allows the user and server to obtain the original queue input and the priority input. The secret shared share.

9. The priority input queue processing method for privacy-preserving neural network inference according to claim 8, characterized in that, The slot multiplexing module organizes data fragments about the priority input into a complete ciphertext about the priority input. And about The secret shared share.

10. The priority input queue processing method for privacy-preserving neural network inference according to claim 9, characterized in that, For the ciphertext entered first :set up for and The greatest common divisor is then completed. After calculating the intermediate ciphertext input from the original queue, the client can additionally obtain... The complete intermediate ciphertext corresponding to each priority input. ; For the random mask item corresponding to the priority input :set up for and The greatest common divisor is then completed. After offline encryption calculation of the original queue input, the complete result is obtained. Each priority input corresponds to a random mask. The encrypted representation, thus allowing the user and server to obtain their respective... The original queue input is about While secretly sharing shares, they obtain Priority input about Secretly shared shares; Priority input about Secret Share: Calculated during the user's online phase After inputting y from the original queue, we get Each priority input corresponds to y, and then the priority input is combined with information about... The secret shared share, to get priority input about The secret shared share.

Images