Cross-cloud federated inference privacy protection method based on homomorphic encryption and tensor splitting

Abstract

The application discloses a cross-cloud federated inference privacy protection method based on homomorphic encryption and tensor splitting, relates to the technical field of cloud computing, and is suitable for a neural network calculation graph containing a linear operator and an element-by-element segmented nonlinear activation operator and comprises the following steps: step 1, a reasoning initiator sets a candidate splitting position sequence in the neural network calculation graph and receives FSS function shares distributed by the reasoning initiator; step 2, the reasoning initiator broadcasts a to-be-reasoned sample tensor in the form of CKKS ciphertext to n clouds as CKKS auxiliary branch initial ciphertext tensors; and step 3, at a reasoning output layer, the n clouds send CKKS auxiliary branch end ciphertext tensors and FSS main driven branch end share tensors to the reasoning initiator. According to the application, the multiplication depth consumption and the precision loss under pure homomorphic encryption can be significantly reduced, the multi-round inter-cloud interaction bottleneck of the linear operator under pure secret sharing can be avoided, and the overall reasoning time delay, reasoning precision and cross-cloud communication overhead are simultaneously improved.

Description

Technical Field

[0001] This invention relates to the field of cloud computing technology, and in particular to a cross-cloud federated inference privacy protection method based on homomorphic encryption and tensor partitioning. Background Technology

[0002] Cross-cloud federated inference is a crucial application scenario in the field of privacy computing. In industries such as financial risk control, medical diagnosis, and government collaboration, the tensors of the samples to be inferred and the neural network computation graphs often belong to different data holders and model holders, respectively. A single cloud cannot simultaneously undertake both inference services and privacy protection responsibilities; therefore, collaborative inference execution by multiple clouds has become the mainstream deployment model in the industry. Three typical technical approaches have been widely discussed and implemented for this scenario.

[0003] The first category consists of pure ciphertext inference schemes based on fully homomorphic encryption. Approximate arithmetic homomorphic encryption schemes such as CKKS offer good support for linear operators (convolution, fully connected layers, batch normalized inference stages, residual addition, etc.), and their ciphertext-plaintext homomorphic multiplication has low multiplication depth consumption, making them suitable for multi-layered cascaded linear operations. However, for element-wise piecewise nonlinear activation operators such as ReLU, Sigmoid, Tanh, and GELU, fully homomorphic encryption can only be implemented using high-order polynomial approximations. This leads to two prominent problems: 1) the cumulative error introduced by the polynomial approximation amplifies layer by layer along the forward propagation, resulting in significant loss of output accuracy in deep networks; 2) high-order homomorphic operations quickly exhaust the multiplication depth budget, forcing frequent insertion of homomorphic bootstrapping operations, causing single-layer latency to spike to the second level or even higher.

[0004] The second category is multi-party secure computation schemes based on additive secret sharing. In this system, nonlinear activation operators can be efficiently evaluated using secret sharing primitives such as distributed comparison functions, resulting in low local computational overhead and stable latency. However, linear operators in this system require multiple rounds of cloud-to-cloud interaction (typically a multiplication triplet protocol or one round of interaction triggered by a single multiplication). When deployed across availability zones or regions, the cumulative number of communication rounds can reach hundreds per second. Overall inference latency is severely constrained by network round-trip time, and the repeated transmission of plaintext weights and intermediate tensors between clouds also increases the leakage surface.

[0005] The third category is a hybrid scheme of the two technologies mentioned above, which attempts to use homomorphic encryption and secret sharing by layer. Existing hybrid schemes mostly use static layer granularity or fixed channel ratios for segmentation criteria, failing to dynamically adapt to the inter-layer statistical characteristics of each specific network, resulting in frequent conversions between the ciphertext domain and the share domain; moreover, cross-branch contributions are often delayed until the segmentation position for unified processing, accumulating the risk of numerical drift and fixed-point overflow in intermediate layers, and causing the number of conversions to get out of control; for differentiated scenarios such as small channels and large channels, dense mapping and sparse mapping, there is a lack of quantifiable channel-level criteria to drive segmentation decisions, resulting in high parameter tuning costs and unstable returns in engineering, and making it difficult to simultaneously consider inference accuracy, inference latency and cross-cloud communication overhead. Summary of the Invention

[0006] In view of this, the present invention provides a privacy protection method for cross-cloud federated inference based on homomorphic encryption and tensor partitioning. The present invention places fully homomorphic encryption and function secret sharing in their respective optimal execution domains. Through channel-level dynamic partitioning driven by bottleneck scoring and centralized reorganization of the main partition position, the invention significantly reduces the multiplication depth consumption and accuracy loss under pure homomorphic encryption, avoids the multi-round cloud interaction bottleneck of linear operators under pure secret sharing, and simultaneously improves the overall inference latency, inference accuracy and cross-cloud communication overhead. Furthermore, it rigorously protects the plaintext of intermediate tensors and the final output tensor under a semi-honest security model with at most n minus 1 cloud collusion.

[0007] The technical solution adopted in this invention is as follows:

[0008] A cross-cloud federated inference privacy protection method based on homomorphic encryption and tensor partitioning, applicable to neural network computation graphs containing linear operators and element-wise piecewise nonlinear activation operators, includes the following steps:

[0009] Step 1: The inference initiator sets a sequence of candidate split positions in the neural network computation graph and records the channel dependency mapping between adjacent candidate split positions; it calculates a bottleneck score for the channel index under each candidate split position to divide the channel subset, and selects the main split position based on the scheduling cost; there are n clouds, and the n clouds collaboratively execute the CKKS key generation protocol and receive the FSS function share distributed by the inference initiator; the candidate split position sequence, channel subset, and channel dependency mapping are summarized to form an inference scheduling table;

[0010] Step 2: The inference initiator broadcasts the tensor of the sample to be inferred in CKKS ciphertext to n clouds as the initial ciphertext tensor of the CKKS auxiliary branch; the n clouds advance forward according to the inference schedule table, the CKKS auxiliary branch carries linear operators, the FSS main driving branch carries the FSS evaluation of nonlinear activation operators, and the cross-branch contribution between the two branches is unified by the representation transformation sub-operation; at each candidate split position, branch reorganization transformation is performed along the channel dependency mapping, and at the main split position, bidirectional reorganization is performed driven by the bottleneck score;

[0011] Step 3, at the inference output layer, n clouds send the ciphertext tensor at the end of the CKKS auxiliary branch and the share tensor at the end of the FSS main driving branch to the inference initiator; the inference initiator decrypts the CKKS plaintext tensor using the n-to-n joint decryption protocol and synthesizes the FSS plaintext tensor, then reverses and splices it according to the inference schedule table to obtain the complete output tensor, which is independently recovered by the inference initiator.

[0012] Furthermore, the linear operators include convolution, fully connected, batch normalized inference stage, and residual addition, and the element-wise piecewise nonlinear activation operator is one of ReLU, approximate Sigmoid, approximate Tanh, and approximate GELU; the method is executed under a semi-honest and at most n-1 cloud collusion security model.

[0013] Furthermore, in step 1, the candidate segmentation position sequence is composed of candidate segmentation positions located on the output side of each nonlinear activation operator in the neural network computation graph and the termination segmentation position located in the inference output layer of the neural network computation graph, arranged in an ordered forward direction; the channel dependency mapping defines the operator segment between two adjacent candidate segmentation positions, including the set of input channel indices that each output channel index of each linear operator in the operator segment depends on, and the output channel to input channel backtracking closure from the end position of the operator segment to the beginning position of the operator segment; the inference scheduling table also includes the target security representation attribution of each output channel index under the termination segmentation position, and the target security representation attribution indicates that this output channel index is carried by the CKKS auxiliary branch or the FSS main driving branch.

[0014] Furthermore, the bottleneck score in step 1 is calculated as follows: In the local environment, the inference initiator sequentially retrieves calibration samples from the pre-set calibration sample set during the deployment phase and inputs them into the neural network computation graph in plaintext form to perform one complete forward propagation. At each candidate segmentation position, a copy of the tensor obtained from this forward propagation is retained. For each channel index under each candidate segmentation position, the tensor elements of all calibration samples at the spatial or feature positions corresponding to this channel index are summarized in the order of retrieval to form an element value sequence. The sample range and absolute mean of the element value sequence are calculated. The sample range of all channel indices under the same candidate segmentation position are ranked from largest to smallest to obtain the range ranking, and the absolute mean is ranked from largest to smallest to obtain the intensity ranking. The difference between the range ranking and the intensity ranking of the same channel index is used as the bottleneck score of this channel index under this candidate segmentation position.

[0015] Furthermore, in step 1, the channel subset is divided according to the bottleneck score as follows: the channel indexes under the same candidate split position are reordered from high to low according to the bottleneck score and divided into three equal parts according to the ranking. The channel indexes of the top 1 / 3 are assigned to the high-scoring channel subset, the channel indexes of the middle 1 / 3 are assigned to the medium-scoring channel subset, and the channel indexes of the bottom 1 / 3 are assigned to the low-scoring channel subset.

[0016] Furthermore, in step 1, for each candidate segmentation position, the scheduling cost is equal to the weighted sum of the proportion of the number of channels in the middle channel subset under this candidate segmentation position, the number of cross-branch channel dependencies of the adjacent operator segments of this candidate segmentation position, and the expected communication cost generated by the conversion between the CKKS ciphertext field and the FSS share field; the candidate segmentation position with the minimum scheduling cost is selected as the main segmentation position, and the next candidate segmentation position immediately adjacent to the main segmentation position along the forward direction is selected as the alternative segmentation position.

[0017] Furthermore, in step 1, the CKKS key generation protocol adopts an n-to-n joint decryption configuration, where each of the n clouds holds one CKKS joint decryption share. Decryption can only be completed when all CKKS joint decryption shares of the n clouds are merged. The FSS function share is generated by the inference initiator for each nonlinear activation operator in the neural network computation graph within a unified fixed-point coding domain. The input and output of the FSS function share are both fixed-point tensors in the form of additive secret sharing, and the input and output maintain the same fixed-point scale. The inference initiator distributes the FSS function share to each of the n clouds according to the cloud's identifier.

[0018] Furthermore, in step 2, the cross-branch contribution is uniformly completed by the representation transformation sub-operation as follows: Based on the channel dependency mapping, for each output channel index of each linear operator, the set of input channel indices to which this output channel index depends is divided into a ciphertext domain input subset and a share domain input subset according to the current branch; the ciphertext domain input subset is used to generate the partial contribution of this output channel in the ciphertext domain using the CKKS homomorphic linear computation method, and the share domain input subset is used to generate the partial contribution of this output channel in the share domain using the share domain local linear computation method; based on the output channel index in the inference scheduling table... The target security representation is determined by the channel subset at the next candidate split position. When the target is assigned to a high-scoring channel subset, the CKKS ciphertext field is used; when the target is assigned to a low-scoring channel subset, the FSS share field is used; and when the target is assigned to a medium-scoring channel subset, the CKKS ciphertext field or FSS share field specified by the medium-splitting merging strategy preset in the inference scheduling table is used. The partial contribution in another security representation is transformed to the target security representation through the representation transformation sub-operation, and then added to the partial contribution in the target security representation. In this linear operator output stage, the complete output representation of this output channel index under a single security representation is formed.

[0019] Furthermore, the FSS evaluation method for the nonlinear activation operator in step 2 is as follows: At each nonlinear activation operator, it is first confirmed that all input channel indices of this nonlinear activation operator have completed cross-branch contribution accumulation in the output stage of the previous linear operator; then, the ciphertext tensor currently located in the CKKS auxiliary branch is converted into a share tensor by performing a downlink ciphertext repackaging operation and merged into the existing share tensor of the FSS main driving branch according to the channel dimension; n clouds perform FSS evaluation on the merged share tensor with FSS function share to obtain the share tensor on the output side of this nonlinear activation operator; the branch reorganization transformation and bidirectional reorganization methods in step 2 are as follows: along the reverse tracing closure, the high-scoring channel subset and the middle-scoring channel subset of the CKKS ciphertext domain specified by the middle-scoring merging strategy are identified. The set of input channels that the output channels corresponding to the middle-scoring channel subset of the CKKS ciphertext domain depend on at the current candidate split position are denoted as the ciphertext-bearing target closure. The current ciphertext tensor located in the FSS main driving branch is reorganized into a share tensor by performing a downlink ciphertext repackaging operation and merging the ciphertext tensor into a share tensor according to the channel dimension. Share slices whose channel indices fall into the ciphertext-bearing target closure in the branch share tensor are converted into CKKS ciphertext slices using the share back-injection sub-operation and then concatenated to the CKKS auxiliary branch ciphertext tensor in channel index order. Similarly, the share-bearing target closure defined by the low-scoring channel subset and the medium-scoring merging strategy designated as the FSS share domain are identified. For the ciphertext slices currently located in the CKKS auxiliary branch ciphertext tensor whose channel indices fall into the share-bearing target closure, the following ciphertext repackaging sub-operation is used to convert them into share tensor slices and concatenate them to the FSS main driving branch share tensor in channel index order. At the main split position, the bottleneck score-driven bidirectional reorganization is performed in a centralized manner, that is, the high-scoring channel subset and the medium-scoring merging strategy designated as the CKKS ciphertext domain are carried by the CKKS auxiliary branch, and the remaining channels are carried by the FSS main driving branch. At other candidate split positions, the channel subset division under this candidate split position is performed in the same way.

[0020] Furthermore, step 2 indicates that the conversion sub-operations include a downlink ciphertext repackaging sub-operation to convert ciphertext into shares and a share injection sub-operation to convert shares back into ciphertext. The share injection sub-operation is executed as follows: each of the n clouds encrypts its own share slices to be injected into CKKS single-cloud ciphertext slices using the public CKKS encryption key parameters of the participating parties. The CKKS single-cloud ciphertext slices of the n clouds are then accumulated between the clouds using CKKS homomorphic addition to obtain a CKKS aggregated ciphertext slice. The downlink ciphertext repackaging sub-operation is executed as follows: one of the n clouds is pre-designated as the receiving cloud, and each of the other clouds independently generates a copy of the downlink ciphertext slice after decoding. Random mask tensors with the same shape as the plaintext tensors are encapsulated into CKKS mask ciphertext and then sequentially subtracted from the downlink ciphertext slice using CKKS homomorphic subtraction until the CKKS mask ciphertexts of n-1 clouds other than the receiving cloud are subtracted to obtain the subtracted intermediate ciphertext slice. The n clouds then collaboratively perform one n-choose-n joint decryption on the subtracted intermediate ciphertext slice. The plaintext result of this joint decryption is only received by the receiving cloud and used as the downlink share slice held by the receiving cloud. Each cloud other than the receiving cloud uses its local random mask tensor as its own downlink share slice. The downlink share slices held by the n clouds are synthesized into a downlink share tensor slice using an additive secret sharing method.

[0021] By adopting the above technical solutions, this invention achieves the following beneficial effects: In the offline stage, this invention divides the channel index at each candidate segmentation position into three equal parts based on bottleneck scoring, and selects the main segmentation position based on minimizing scheduling cost. This eliminates reliance on manual experience or fixed-level granularity for segmentation decisions, instead driving them directly through the network's own channel-wise activation strength and intra-batch variability statistics. This fundamentally aligns with the real information manifold of various neural network computation graphs, improving the network adaptability and cross-scenario generalization ability of the segmentation criteria. In the online inference stage, CKKS auxiliary branches carry linear operators, while FSS main driving branches carry nonlinear activation operators for FSS evaluation. This places the linear operations most suited to by fully homomorphic encryption and the element-wise piecewise nonlinear activation most suited to by function secret sharing in their respective optimal execution domains. This avoids the precision loss and multiplication depth exhaustion problems caused by high-order polynomial approximation under pure homomorphic encryption, and also avoids the communication bottleneck caused by multi-round interactions between linear operators in pure secret sharing. Overall, inference latency and precision loss are significantly improved simultaneously. Enforcing closed cross-branch contributions at the output stage of each linear operator ensures that each output channel carries the complete value in a single-1 secure representation before entering the next layer, avoiding long-standing engineering problems such as uncontrolled representation transformation counts, fixed-point scale drift, and cumulative noise expansion that have plagued hybrid schemes. At the main splitting position, a centralized bidirectional reorganization is performed driven by bottleneck scoring, merging the fragmented transformations of multiple candidate splitting positions into the most discriminative position. The round overhead of n-to-n joint decryption is batch-distributed, with particularly significant communication benefits in cross-availability zone and cross-regional deployments. The complete output tensor is recovered independently only by the inference initiator, rigorously protecting the plaintext of intermediate tensors and the final output tensor under a semi-honest and at most n-minus-1 cloud collusion security model. Attached Figure Description

[0022] Figure 1 This is a schematic diagram illustrating the topological relationship between the candidate segmentation position sequence and the reverse tracing closure in an embodiment of the present invention;

[0023] Figure 2 This is a schematic diagram illustrating the principle of the dual-branch scheduling rule and the unification of cross-branch contributions in an embodiment of the present invention;

[0024] Figure 3 This is a schematic diagram of the bottleneck scoring-driven bidirectional recombination principle at the main segmentation position in an embodiment of the present invention;

[0025] Figure 4 This is a schematic diagram of the scheduling cost distribution and main splitting position selection on the candidate splitting position sequence in an embodiment of the present invention. Detailed Implementation

[0026] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0027] A cross-cloud federated inference privacy protection method based on homomorphic encryption and tensor partitioning, applicable to neural network computation graphs containing linear operators and element-wise piecewise nonlinear activation operators, includes the following steps:

[0028] Step 1: The inference initiator sets a sequence of candidate split positions in the neural network computation graph and records the channel dependency mapping between adjacent candidate split positions; it calculates a bottleneck score for the channel index under each candidate split position to divide the channel subset, and selects the main split position based on the scheduling cost; there are n clouds, and the n clouds collaboratively execute the CKKS key generation protocol and receive the FSS function share distributed by the inference initiator; the candidate split position sequence, channel subset, and channel dependency mapping are summarized to form an inference scheduling table;

[0029] Step 2: The inference initiator broadcasts the tensor of the sample to be inferred in CKKS ciphertext to n clouds as the initial ciphertext tensor of the CKKS auxiliary branch; the n clouds advance forward according to the inference schedule table, the CKKS auxiliary branch carries linear operators, the FSS main driving branch carries the FSS evaluation of nonlinear activation operators, and the cross-branch contribution between the two branches is unified by the representation transformation sub-operation; at each candidate split position, branch reorganization transformation is performed along the channel dependency mapping, and at the main split position, bidirectional reorganization is performed driven by the bottleneck score;

[0030] Step 3, at the inference output layer, n clouds send the ciphertext tensor at the end of the CKKS auxiliary branch and the share tensor at the end of the FSS main driving branch to the inference initiator; the inference initiator decrypts the CKKS plaintext tensor using the n-to-n joint decryption protocol and synthesizes the FSS plaintext tensor, then reverses and splices it according to the inference schedule table to obtain the complete output tensor, which is independently recovered by the inference initiator.

[0031] The candidate segmentation position sequence is set according to the dual anchor principle of "nonlinear activation operator output side + inference output layer". The inference initiator first performs an offline topological scan of the neural network computation graph to be protected - traversing each operator node layer by layer in the forward direction. When a nonlinear activation operator (including ReLU, approximate Sigmoid, approximate Tanh, approximate GELU, etc., piecewise functions) is scanned, a candidate segmentation position marker is inserted at the output tensor port of this nonlinear activation operator; when the inference output layer is scanned (usually the output end of the last fully connected layer for classification networks, and usually the output end of the last convolution or upsampling for regression or segmentation networks), a special marker is inserted, called the termination segmentation position. All inserted markers are concatenated in the original topological order in the forward direction to obtain the candidate segmentation position sequence.

[0032] There are two reasons for choosing the output of the nonlinear activation operator instead of other positions. First, in the proposed dual-branch scheduling rule, the nonlinear activation operator is evaluated by the FSS main driving branch using FSS function shares. After evaluation, the resulting tensors are all located in the FSS share domain. At this point, the split does not require additional calls to the conversion primitive between the ciphertext domain and the share domain, thus minimizing the conversion cost. Second, the output of the nonlinear activation operator is statistically more stable—the tensors after nonlinear transformation have truncated most extreme values ​​and noise. The channel-by-channel statistics (range, absolute value mean, etc.) here better reflect the "effective information carried by the channel," making the subsequent bottleneck scoring more discriminative. The termination split position is used to mark the normalized termination point of the forward propagation—at this point, the tensors at the ends of the CKKS auxiliary branch and the FSS main driving branch need to be sent back to the inference initiator for final joint decryption and splicing. In certain special networks, such as the end position of the last residual block in a residual network or the output of the last LayerNorm in a Transformer-type network, the inference initiator may add candidate split positions at these positions as needed for deployment. However, the added positions must still fall at the output of a certain nonlinear operator to ensure the consistency of subsequent scheduling rules.

[0033] Here's a concrete example. Suppose the computational graph of the neural network to be protected has 5 nonlinear activation operators along the forward direction, denoted as follows: The inference output layer is denoted as ,in Indicates the first A nonlinear activation operator, The node representing the inference output layer at the end of the forward computation graph is represented by the candidate segmentation position sequence. ,in lie in The output terminal, That is, the termination point of the split is located at The output terminal, This represents the candidate segmentation position sequence.

[0034] The channel dependency mapping records for two adjacent candidate split positions and Regarding the operator segments between, and These represent the first and second adjacent candidate segment positions in the forward direction, respectively. Assume the operator segment contains... The linear operators (convolution, fully connected, batch normalization inference stage, and residual addition 1) are denoted as follows: , This indicates the number of linear operators within the operator segment. Indicates the first There are 1 linear operator. For each linear operator... Index of each output channel The set of input channel indices it depends on is denoted as , express output channel The set of input channel indices on which it depends. The connection topology of this operator determines that for ordinary convolution, That is, the output channel depends on all input channels. Representing linear operators The number of input channels; for depthwise separable convolutions, there are The output channel only depends on the input channel with the same sign; the same applies to fully connected channels. ;For the batch normalization inference stage For residual addition, let the two inputs come from the branches respectively. and branch road ,but ,in and Branch roads and branch road Middle and output channels Input channel indices with the same sign. Within the operator segment... By merging the dependency sets of linear operators in a concatenated order, we can obtain the result from... The output channel of the terminal is traced back to The reverse tracing closure of the input channel of the terminal is denoted as... ,in Indicates position and Between Index of a certain output channel The reverse tracing closure, Indicates the candidate segmentation position The total number of channels at each location.

[0035] In the program implementation, the construction of the reverse tracing closure adopts an iterative closure expansion method from back to front. Initialization Then from Traverse in reverse Update in each iteration , Indicates tracing back to the first The intermediate closure before each linear operator; finally The time complexity of this iterative closure expansion method is linearly related to the number of operators in the operator segment. Even for the last candidate split position in a deep residual network, the computation can be completed in milliseconds, making it suitable for offline, one-time execution on a locally controlled host of the inference initiator. If all operators within an operator segment are channel-independent (such as batch normalized inference stage, depthwise separable convolution, residual addition), the backtracking closure degenerates into... Channel dependency mappings are extremely sparse; if the operator segment contains fully connected or ordinary convolution, Usually degenerates into The channel dependency mapping is highly dense. This polarization is precisely the source of the importance of the "number of cross-branch channel dependencies" in the subsequent scheduling cost calculation—dense mapping means that once the target security representation of any output channel is flipped across branches, the representation transformation sub-operation of all input channel contributions of the other branch must be performed, and the cost increases sharply.

[0036] refer to Figure 1 The entire graph unfolds horizontally along a single feedforward path of a neural network computation graph. This path sequentially connects four linear operators and three nonlinear activation operators, terminating at an inference output layer node. The linear operators are denoted as... The nonlinear activation operator is denoted as The inference output layer is denoted as . This represents the first through fourth linear operators in the forward computation graph. This represents the first to third element-wise piecewise nonlinear activation operators. This represents the inference output layer node at the end of the forward computation graph. One-way arrows indicate the data flow direction between operator nodes, and the overall order strictly follows the topological forward direction from left to right.

[0037] To reflect the physical distribution of candidate segmentation positions on the computational graph, a vertical dashed line running through the entire graph is drawn from the output of each nonlinear activation operator, and another identical vertical dashed line is drawn from the output of the inference output layer. The positions of the first three vertical dashed lines are denoted as follows: , respectively corresponding Candidate segmentation positions at the output end; the position of the last vertical dashed line is denoted as ,correspond The termination point at the output end. Indicates the first in the forward direction One candidate segmentation position, .Bundle to Arranged in an orderly fashion in the forward direction, the candidate segmentation position sequence is obtained. The termination segmentation position is indicated in smaller text below to distinguish it from the ordinary candidate segmentation position. The termination segmentation position undertakes the additional function of determining the target security representation attribution in the subsequent output aggregation stage.

[0038] The figure uses three parallel channel comparison subplots to depict the channel dependency mapping differences between two adjacent candidate split positions. Each subplot consists of two rows of small circles, one above the other, with the upper row corresponding to the previous candidate split position. The channel at the end corresponds to the next candidate segmentation position below. Channels at the end. Each small circle represents a channel index. Hollow circles represent ordinary channels, and solid circles represent channels that fall within the backtracking closure. Dashed arrows indicate the specific dependencies between circles.

[0039] The first sub-image is located at and Between them, the corresponding operator segments are converted by ordinary convolution. The main focus is on this. Below, select... Using the index of a specific target output channel as the starting point for tracing, several dashed arrow lines extend upwards, pointing towards... The set of input channel indices traced at a given point constitutes the reverse tracing closure of this segment. , Indicates in The selected output channel index, Indicates position and Between output channel indexes The reverse tracing closure. In ordinary convolution scenarios, the closure is usually dense, which means that the target channel traces to multiple upstream input channels.

[0040] The second subgraph is located at and Between these, the corresponding operator segments consist of channel-independent operators such as batch normalization inference and residual addition. Here, the target channel index below traces only one strong dependency arrow to the same-signed channel index above; the weak dependencies between other channels are represented by faded dashed arrows to indicate the extremely sparse form of the back-tracing closure under channel-independent operators, which degenerates into a set of single elements. The third subgraph is located in... and Between them, the corresponding operator segments are mainly fully connected, and the index of any target output channel below traces upwards to... The indexes of all input channels at the endpoint degenerate into a complete set, exhibiting a typical fully dense form.

[0041] The lower half of the diagram lists the unified definition of backtracking closure in a single line of text. , Indicates the candidate segmentation position The total number of channels at each location; at the bottom of the graph, a horizontal unidirectional arrow indicates the forward direction, and at the bottom, a separate line provides a legend showing the channel index, channels within the closure, and channel dependencies, respectively, represented by hollow circles, solid circles, and dashed arrows.

[0042] Bottleneck scoring is based on small-batch plaintext calibration. The inference initiator prepares a set of calibration samples in advance in a local environment (usually a controlled isolated host or trusted execution environment). ,in Represents the calibration sample set. Indicates the first calibration samples, To determine the total number of samples. The value of needs to be balanced between statistical stability and offline cost—too small a value will result in excessive variance in the bottleneck score and drastic ranking fluctuations; too large a value will increase the total forward propagation time. Generally speaking, for image classification networks... A value between 200 and 1000 is more suitable; for regression and sequence networks. A value of 500 to 2000 is more appropriate; for very small-scale end-point reasoning tasks, A value of around 100 can also be used. Calibration samples can be uniformly sampled from the training and validation sets, or accumulated from recent real inference traffic. The key is that their distribution should be as close as possible to the final distribution of the real inference samples before deployment, ensuring that the bottleneck score accurately reflects the activation patterns of each channel after deployment. If there is a known drift between the training set distribution and the deployment distribution (e.g., migration to a new geographical region or new seasonal traffic), the inference initiator should prioritize using a small batch of samples from the deployment distribution as calibration samples.

[0043] The inference initiator performs a test on each labeled sample. Perform a complete plaintext forward propagation on the neural network computation graph, and at each candidate segmentation position... One copy of the tensor obtained in this forward pass is retained, denoted as . (For convolutional positions) or (For fully connected class positions) Indicates position First Tensor copies corresponding to each labeled sample and These represent the height and width of the feature map at the segmentation location, respectively. All After the labeled samples are processed forward, the inference initiator performs inference on each candidate segmentation position. Each channel index below ,Bundle The tensor elements of each sample in this channel are expanded and summarized into a sequence of element values ​​in the order they are retrieved. , Indicates position Lower channel index The corresponding sequence of element values, This indicates the first [number]th ... Scalar elements; for fully connected positions, the sequence length degenerates to The unfolding order is usually based on (samples). high The sequence is performed in lexicographical order (wide). The sequence is only used to calculate two scalar statistics. The specific order has no effect on the result, as long as it is consistent before and after.

[0044] Calculate the sample range sequentially from the element value sequence. and absolute value mean ,in Indicates position Lower channel index The sample range Indicates position Lower channel index The absolute value of the mean This represents the total number of elements in the sequence of element values. Describe the range of values ​​for this channel within the calibrated sample batch—a small range means that the activation of this channel is relatively stable across different samples, corresponding to a stable signal that has been effectively compressed and retained under the information bottleneck. The overall strength of the channel activation is described by the large absolute mean value, which means that the channel carries a large amount of signal energy and makes a significant contribution to the downstream operators during forward propagation. It is worthwhile to preserve it accurately in the ciphertext domain.

[0045] Next, at the same candidate segmentation position Below, for all Each channel index is... Sort by size from largest to smallest to obtain the channel index. The worst ranking , Indicates channel index In position The position when sorted in descending order of sample range. This indicates that the channel is in The lower range is the largest; similarly, according to Sort by strength from largest to smallest to obtain the strength ranking. , Indicates channel index In position The rank when sorted in descending order by the absolute mean. This indicates that the channel is in The absolute mean is the largest. Channel index. exist The bottleneck score is defined as follows: , Indicates channel index In position Bottleneck score below. The larger the positive value, the more significant the channel's ranking (lower variability) and intensity (higher activation); conversely, the smaller the value, the more pronounced the channel's ranking (lower variability) and intensity (higher activation). The larger the negative absolute value, the more pronounced the "range preceding intensity," typically indicating a noisy or insignificant channel. Directly replacing the original ratio difference with the ranking difference has two advantages: First, the ranking is a dimensionless ordinal number, naturally robust to feature map scale differences between different candidate segmentation positions, eliminating the need for normalization and other extra steps; second, the ranking difference is an integer, requiring no floating-point division and naturally aligning with fixed-point coding frameworks, making it extremely friendly for offline computation by the inference initiator in resource-constrained scenarios. When the range or absolute mean is tied, a stable sorting method (such as merge sort) using ascending channel index as the order key can be used. Optionally, the inference initiator can perform logarithmic transformation or standard deviation normalization on the range or absolute mean before ranking. This can reduce the severity of ranking jumps in networks with huge differences in the order of magnitude between channels (such as some convolutional layers with a large number of normalization coefficients) and make the bottleneck scores smoother. However, the cost is the introduction of an extra floating-point operation, which needs to be weighed in engineering.

[0046] Channel subset partitioning is performed by dividing the channel into three equal parts based on the bottleneck score ranking. At the same candidate split position... Next, put all Each channel index is scored by bottleneck. Reorder from highest to lowest; top The channel index is assigned to the high-scoring channel subset. , Indicates position The high-resolution channel subset below; immediately following Each channel index is allocated to the middle channel subset. , Indicates position The middle channel subset is divided into two parts; the rest are assigned to the lower channel subset. , Indicates position The low-resolution channel subset is used. The consideration for trisectioning instead of other segmentation ratios is as follows: high-resolution channels represent the effective signal concentration area under the information bottleneck, and should be retained in the ciphertext domain to ensure accuracy; low-resolution channels are noise or redundant areas, and transferring them to the share domain for FSS evaluation will not significantly affect output quality but can greatly reduce ciphertext computation overhead; the middle-resolution channels are in a gray area, neither easily forcibly assigned to high-resolution channels nor directly considered redundant. Setting up an independent middle-resolution channel subset as a buffer allows for flexible allocation under subsequent scheduling cost calculations and middle-resolution merging strategies—if the proportion of the middle-resolution channel subset is too large for a candidate segmentation position, it means that the channel differentiation at that position is not obvious and the segmentation benefit is not significant. This position can be naturally excluded from the main segmentation position candidates through the scheduling cost mechanism. If the total number of channels... If the remainder is not divisible by 3, it can be handled according to the following remainder compensation rules: when the remainder is 1, one remaining channel is assigned to the middle-division channel subset; when the remainder is 2, one of the two remaining channels is assigned to the high-division channel subset and one to the low-division channel subset, respectively, to maintain a relatively equal scale on both ends. Optionally, if the network application has extremely high requirements for ciphertext accuracy (such as medical image diagnosis, financial risk control, etc.), an asymmetric partition biased towards high-division channels, such as 4:3:3, can be used; if the requirements for inference latency are extremely strict (such as real-time control on the edge), a partition biased towards low-division channels, such as 2:3:5, can be used to fully release the local computing advantages of the share domain.

[0047] The scheduling cost is a comprehensive quantification of the engineering cost of each candidate partitioning position as the primary partitioning position. At the candidate partitioning position... Below, scheduling cost Composed of 3 weighted components: ;in, Indicates position The scheduling cost at the location, , , The weighted coefficients are and satisfy the following conditions: ; For the middle channel subset in The percentage of channels below This represents the number of channels in the middle channel subset; for The number of cross-branch channel dependencies of an adjacent operator segment is defined as the next candidate split position. The output channel belonging to 1 branch is The total number of input channels belonging to another branch within the end-to-end reverse tracing closure is... , express Target security representation and The set of channel indices opposite to the branch in question. These channels are the target objects that must actually participate in the sub-operations representing the transformation during the branch reorganization transformation. The larger the number, the more drastic the flip and the higher the cost. for The estimated communication cost arising from the conversion between the CKKS ciphertext field and the FSS share field is estimated based on the number of bytes to be transmitted. , This indicates the estimated number of bytes when the share rebate sub-operation processes one channel. This represents the estimated number of bytes when processing one channel in a downlink ciphertext repackaging operation. Both are determined by the specific CKKS polynomial degree and the slot capacity.

[0048] Typical values ​​for the weighting coefficients are: , , This allocation prioritizes the degree of inversion because in large ResNet-like networks, the number of cross-branch channel dependencies is usually the dominant factor, while the proportion of mid-branch channels and communication cost are secondary adjustment factors. Optionally, in scenarios where the network is predominantly fully connected and cross-branch dependencies are naturally dense, this ratio can be increased. To 0.6, reduced and In scenarios where cloud bandwidth is limited, the speed can be increased. Up to 0.4; in some deployments sensitive to scheduling balance, a multiplicative form can also be used. Alternative weighted sum form, To prevent small constants with a value of 0 (typically taken as...) This is to increase the severity of the penalty for the largest single item.

[0049] The primary splitting position is selected from the candidate splitting position sequence based on the scheduling cost. The criterion is to minimize it directly in one step: , This indicates the selected primary splitting position. If multiple candidate splitting positions achieve the same minimum scheduling cost, the position further back in the forward direction is preferred. This allows the initial segment to maintain single-branch advancement as much as possible, reducing the number of early branch reorganizations and transitions; the position adjacent in the forward direction is also preferred. The next candidate segmentation position automatically becomes the alternative segmentation position. After a bottleneck-scoring-driven bidirectional reorganization occurs, the next reorganization is allowed to proceed with a weaker intensity at an alternative splitting position, serving as a buffer and distributing mechanism. In engineering implementation, The retrieval only requires... Number of candidate segmentation positions after one linear scan Typically, the number of milliseconds is no more than tens, and even if it includes hundreds, it only requires sub-millisecond time, which hardly constitutes a bottleneck in the offline stage.

[0050] refer to Figure 2 The entire diagram is horizontally unfolded in three segments: left, middle, and right, corresponding to the input end, the linear operator calculation end, and the cross-branch unified merging end, respectively, and terminates at the right-hand output area. Two parallel horizontal baselines are arranged vertically in the diagram; the upper baseline represents the CKKS auxiliary branch, and the lower baseline represents the FSS main driving branch. Each baseline has a brief text label on its left side indicating the branch name, facilitating identification of the parallel logic structure.

[0051] The input is located on the left side of the graph. A rectangular node is placed at the entrance of the CKKS auxiliary branch, with two lines of annotations inside the node. The upper line indicates that the content carried is a ciphertext tensor, and the lower line uses mathematical symbols. This indicates the internal composition of a CKKS ciphertext. Represents the ciphertext constant term. This represents a first-order ciphertext item. At the entrance of the main FSS branch, a set of staggered stacked small rectangular nodes are placed. This visual misalignment suggests that each of the n clouds holds a local share of the tensor—an additive secret sharing structure. The first layer of small rectangles is labeled with the content carried by the share tensor and the symbol. , Indicates the first A copy of the input share tensor held by Duoyun.

[0052] The middle section of the diagram represents the linear operator computation end, with one rectangular node each in the CKKS auxiliary branch and the FSS main driving branch. The rectangular nodes in the CKKS auxiliary branch have solid outlines, with three rows of annotations within each node indicating the core computation methods: ciphertext-plaintext homomorphic multiplication and ciphertext rotation accumulation, illustrating the key points of linear computation in the ciphertext domain. The rectangular nodes in the FSS main driving branch have dashed outlines, with three rows of annotations within each node indicating the core computation methods: local multiplication and addition within the share domain, with an annotation indicating no inter-cloud communication, to contrast with the ciphertext domain above. Horizontal arrows pointing from the input end to the computation end indicate the data flow direction.

[0053] The right segment of the diagram represents the cross-branch unified merging point. From each of the two rectangular nodes at the computation end, a horizontal arrow extends to the circular merging node, which is filled with a homomorphic addition symbol. , This represents local addition under the meaning of CKKS ciphertext-ciphertext homomorphic addition or additive secret sharing, corresponding to the superposition of contributions on the same side of the CKKS auxiliary branch and the FSS main driving branch, respectively. Simultaneously, two intersecting curved arrows extend from the two rectangular nodes at the computation end, forming a bidirectional cross link between the two branches, representing the direction of action of the downlink ciphertext repackaging sub-operation and the share injection sub-operation, respectively. A label is placed in the blank space between the midline of the two intersecting arrows, indicating the downlink ciphertext repackaging and share injection, respectively, and placed on the highest layer with a white background and black border to avoid being obscured by the curved arrows. A short label is placed above and below the horizontal arrows, indicating the partial contribution of the ciphertext domain and the partial contribution of the share domain, respectively, to indicate the data semantics carried by the horizontal arrows on the same side.

[0054] The right end of the diagram represents the output. Each confluence node extends a horizontal arrow to the right, leading to a rectangular node. The complete output representation is labeled within each node. The CKKS auxiliary branch is outlined with a solid line, while the FSS main driving branch is outlined with a dashed line, echoing the outline style at the left entrance. This signifies that an output channel index carries the complete value in a single, secure representation during the linear operator output phase. The bottom of the diagram is summarized in a horizontal text box: During the linear operator output phase, cross-branch contributions are unified by the representation transformation sub-operation. The top of the diagram is labeled in a larger font as the diagram illustrating the principle of bi-branch scheduling rules and cross-branch contribution unification.

[0055] The number of clouds is denoted as , It is an integer jointly configured by the deployer according to business needs and security model. The minimum value is 2 (below 2, the security meaning of "at most n-1 cloud collusion is still unbreakable" is lost); the typical value is between 3 and 5, which can effectively distribute single point of failure and single point of collusion in cross-cloud federated inference deployment, and will not cause the round overhead of multi-party protocols such as key protocol and joint decryption to get out of control. The larger the value, the lower the risk of single-point trust, but the total number of communication rounds and accumulated noise increase synchronously with each joint decryption. The smaller the size, the lower the deployment cost, but the lower the security redundancy.

[0056] The CKKS key generation protocol, executed collaboratively by n clouds, employs an n-choose-n joint decryption configuration. The inference initiator first selects a set of CKKS common parameters, typically set as a polynomial ring. middle or , Denotes the degree of a cyclotomic polynomial; ciphertext modulus It is approximately 218 bits long (composed of several concatenated prime numbers of 50 to 60 bits). Indicates the integer modulus on which the ciphertext computation is based; scaling factor Pick , This represents the fixed-point scaling factor in CKKS encoding; the slot capacity is... A complex number (capable of carrying) (each an independent real number of bits). This set of parameters takes into account multiplication depth (supporting 8 to 12 layers of multiplication chains), fixed-point precision (approximately 30 to 35 bits of effective precision), and single-ciphertext carrying capacity (for...). This can accommodate 8192 fixed-point numbers in a single ciphertext, suitable for the precision and depth required for the forward pass of the linear operator in this scheme. Optionally, The slot capacity can be increased to 32768 by adjusting the number of network layers and the channel size of each layer, but the ciphertext size and homomorphic operation latency will increase by 2 times. A trade-off between cloud bandwidth and acceptable latency is required.

[0057] Each of the n clouds independently samples its own CKKS private key share locally. , , Indicates the first The CKKS joint decryption share held by Duoyun is typically sampled from a ternary distribution, meaning each coefficient takes a value from... And generate its own public key share based on common public parameters. , A public random polynomial negotiated by all clouds through a broadcast channel (which can be generated by expanding a public seed in a repeatable manner). This represents small-amplitude Gaussian noise sampled locally from the cloud, with a standard deviation typically taken as 3.2. Indicates the first Duoyun's public key share. Each Duoyun shares its own... Broadcast to all other clouds, and the federated public key is obtained locally on any one cloud. , This is the core component of the joint public key, and... Together they form a joint public key This public key uniquely corresponds to the federated private key. , This represents a theoretically unified private key; but No single cloud among the n clouds holds all the private key shares – the sum of the private key shares of any at most n-1 clouds cannot be recovered. or any with Related decryptable information.

[0058] The specific joint decryption process is carried out within a single collective agreement to facilitate understanding why the joint public key and joint decryption share must be constructed in this way. Given a CKKS ciphertext... , This indicates the CKKS ciphertext to be decrypted. and These are the constant term and the linear term of the ciphertext, respectively; each cloud locally calculates its own partial decryption. , Indicates the first Partial decryption results of Duoyun, The light noise sampled locally on the cloud (used to smooth the noise distribution during the joint decryption process; the standard deviation is typically taken as...) );Bundle Submitted to the coordinator (the inference initiator during the output aggregation phase, and the receiving cloud during internal link conversion), the coordinator calculates... Decoding the result yields the plaintext. Decryption can only be completed when all CKKS decryption shares from n clouds are combined—if any one cloud is missing... of ,but Residual One item, that item is The high-entropy linear function cannot be removed, thus completely shielding the plaintext from a single observer. This aligns perfectly with the security model of "semi-honesty and at most n-1 cloud collusion".

[0059] FSS function shares are determined by the inference initiator within a unified fixed-point coding domain. The computation graph is generated sequentially for each nonlinear activation operator. Modulus Integer addition group, This represents the modulus of the unified fixed-point coding field. This is a commonly used value (corresponding to a specific point in 32-bit), retaining approximately 16 decimal bits and approximately 16 integer bits, which can cover the precision requirements of element-wise piecewise functions such as ReLU, approximate Sigmoid, approximate Tanh, and approximate GELU within common forward activation intervals. Optionally, for applications with a narrower output range during inference and requiring higher decimal precision, Can be adjusted to To increase precision, the cost is that the number of bytes in the FSS function body increases in tandem with the evaluation latency.

[0060] Let's take a single-valued ReLU as an example. The inference initiator first rewrites ReLU as a piecewise linear function. , This represents an indicator function that takes the value 1 when the condition is true and 0 when it is false. Then, the "sign" determination for this function is performed using cryptographic construction based on distributed comparison functions or distributed point functions. Share of Function , Indicates distribution to the first The FSS function share of Duoyun. Each share... It is a compact cryptographic key string, typically around 256 bytes in size, with the specific length depending on the fixed bit width. With safety parameters Joint decision, This represents a cryptographic security parameter, typically set to 128. During online inference, each cloud allocates its share of the input. Share with local FSS functions Together, they are fed into the pre-compiled FSS evaluation primitive, and the resulting output shares are... satisfy , Indicates the first Duoyun's input-additive share, Indicates the first The output share held by Duoyun is additive; that is, the output shares of all clouds are merged in an additive secret-sharing manner to restore the plaintext output. For approximate Sigmoid, approximate Tanh, and approximate GELU, the inference initiator first performs offline fitting using piecewise linear or low-order polynomials (such as 4-segment piecewise linear or 6th-order Chebyshev approximation), and then generates the FSS function share for the fitted piecewise function—the fitting error should be controlled within the threshold that the network can tolerate for the final output accuracy, typically the maximum absolute error not exceeding .

[0061] The three key constraints that need to be explicitly emphasized are as follows. First, the input and output of the FSS function share are both fixed-point tensors of additive secret sharing form, i.e. and All belong to Second, the input and output maintain the same fixed-point scale to ensure seamless integration with the fixed-point encoding of upstream and downstream operators, avoiding a fixed-point rescaling every time FSS evaluation is entered or exited—otherwise, either additional rounds of interaction are needed to complete scale alignment, or there will be a loss of accuracy. Third, the FSS function share is generated by the inference initiator rather than by cloud collaboration—this concentrates the cryptographic computational burden on the offline side, allowing the n clouds on the online side to perform only lightweight FSS evaluation, resulting in more stable and predictable online latency.

[0062] The initiator of the inference distributes the FSS function shares one by one according to the cloud's identifier (pre-agreed numbering from 0 to n-1) — the Duoyun only accepts and retains the one copy that matches its own serial number. The remaining shares have no access rights. The distribution link should use an established end-to-end TLS 1.3 encrypted channel with the cloud to prevent passive eavesdroppers on the link from reassembling the complete FSS key. Optionally, after distribution, the cloud may send back a CKKS homomorphic commitment value based on the federated public key or a short hash-based MessageAuthenticationCode digest as a receipt and for the inference initiator to verify that the cloud has correctly stored the data.

[0063] The initiator of the inference process compiles all the offline artifacts mentioned above into a single inference scheduling table. , This represents the inference scheduling table. It is a structured data object that can be serialized into common formats such as JSON or Protobuf. Its main fields include: candidate splitting position sequence. The index and its reference to the operator node in the original computation graph, This represents the total number of candidate segmentation positions; each candidate segmentation position... The following channel subset partitioning, with , , Each channel index is stored as a set; the channel dependency mapping between adjacent candidate split positions is... Stored in the form of a sparse dictionary (keys are output channel indices, values ​​are sets of input channel indices); main split position Alternative splitting positions The mark, Indicates adjacent in the forward direction The next candidate splitting position; the target security representation of each output channel index at the terminating splitting position (the value is either the CKKS auxiliary branch or the FSS main driving branch, used for reverse rearrangement and splicing in the output aggregation stage of step 3); the specific configuration of the merging strategy at each candidate splitting position (such as defaulting to all merging into the CKKS ciphertext field, defaulting to all merging into the FSS share field, or merging by alternating odd and even channel indexes, or merging by secondary ranking refined by bottleneck score, etc.).

[0064] The initiator of the reasoning The entire broadcast is sent to n clouds; when the n clouds go online, they are verified according to their respective local version numbers, and then... A local read-only copy is loaded for layer-by-layer scheduling and querying during the subsequent online cross-cloud collaborative inference phase. Once deployed, it remains immutable throughout the entire lifecycle of a single inference service—this is to prevent any cloud provider from modifying the local system. The copy bypasses the main split location through bidirectional reorganization, leaving more channels stuck in the CKKS auxiliary branch in an attempt to illegally expand the visible information. Optionally, the inference initiator can... The key field calculation is based on the CKKS homomorphic commitment value of the joint public key or a simple SHA-256 digest as integrity evidence. Consistency is mutually verified by each cloud before each inference scheduling query to enhance defense against local tampering-type out-of-bounds behavior under the semi-honest model. When any of the network structure, calibration sample set, or security parameter set is updated, the inference initiator regenerates the data according to the complete process described above. The new version will be released, and the old version will be simultaneously invalidated on n cloud platforms to ensure that online inference always runs based on the latest offline decision results.

[0065] Step 2 begins with the encryption and broadcasting of the tensor of the sample to be inferred. After receiving an original sample to be inferred (which can be an image, sequence, or feature vector), the initiator first maps its original floating-point representation to a fixed-point encoding according to a unified fixed-point encoding rule. superior, Modulus Integer addition group, The modulus represents the unified fixed-point coding field; the specific coding method is as follows: , Represents the encoded fixed-point integer. Represents a raw floating-point number. Indicates the number of decimal places in a fixed point, typically taking... , This indicates a rounding operation. After converting the entire sample tensor element by element using this encoding, the inference initiator calls the CKKS encoding and encryption primitives to encapsulate the fixed-point tensor into one or more CKKS ciphertexts according to the slot packing rules. Slot packing adopts a channel-first, block-based strategy—if the total number of channels at a candidate split position exceeds the slot capacity... If the total number of channels is much smaller than the given number, then the channel is divided into several segments, and each segment is independently encoded with a CKKS ciphertext; conversely, if the total number of channels is much smaller than the given number, then the channel is divided into several segments, and each segment is independently encoded with a CKKS ciphertext. Then, the spatial dimensions (height and width) are flattened and filled into the remaining slots to fully utilize the carrying capacity of the single encrypted message. Denotes the degree of the cyclotomic polynomial. This represents the number of complex slots that can be carried in one CKKS ciphertext.

[0066] The public key used for encryption is the federated public key. —— It originates from the CKKS key generation protocol that is collaboratively executed by n clouds during the offline phase. Represents the public random polynomial of the participants. This represents the combined public key component obtained by summing the public key shares of n clouds. The encapsulated CKKS ciphertext is denoted as... , This represents the CKKS ciphertext corresponding to the tensor of the sample to be inferred. and These are the constant term and the linear term of the ciphertext, respectively. The inference initiator transmits the same copy through an end-to-end TLS 1.3 encrypted channel. Broadcast to n clouds. Each cloud receives the exact same ciphertext—because CKKS generates deterministic link transmission objects with a single encryption, broadcasting the same ciphertext doesn't leak any additional information, but it ensures that the n clouds maintain synchronization in subsequent homomorphic linear computations, preventing any cloud from splitting due to receiving inconsistent ciphertext. Each cloud... Directly registered as the initial ciphertext tensor of the CKKS auxiliary branch, denoted as , This represents the ciphertext tensor held by the CKKS auxiliary branch at the start of forward propagation. The FSS main driving branch is empty at the start of forward propagation—no channel is yet in the share domain. This is because the tensor of the sample to be inferred has entered the ciphertext domain as a whole, which is consistent with the initial state of this scheme, where the CKKS auxiliary branch carries the linear operator first.

[0067] The decision to broadcast the same ciphertext to all n clouds, rather than having each cloud separately retrieve or encrypt it from the inference initiator, is based on three considerations. First, ciphertext synchronization is a prerequisite for consistent homomorphic linear operations across all parties. Any cloud holding a deviated ciphertext will cause a complete offset in the final aggregation result, and this offset is irreversible under n-to-n joint decryption. Second, broadcasting allows the inference initiator to perform encryption only once and transmit only one copy of the ciphertext (although the actual broadcast passes through n TLS links, the encryption computation itself is only performed once), resulting in lower engineering overhead. Third, the broadcast link topology naturally facilitates deployment across availability zones and data centers. In some extremely bandwidth-constrained scenarios, the inference initiator could also first upload the ciphertext to an object storage bucket shared by all n clouds, and then have each cloud retrieve it individually; however, in a semi-honest model, this approach is merely a performance optimization and does not affect security.

[0068] Based on the reasoning and scheduling table, n clouds Proceeding layer by layer in the forward direction, This represents the inference schedule table compiled during the offline phase. The execution order proceeds layer by layer, unfolding according to the topological order of the original computation graph—each cloud traverses the same set of data locally in the same order. Therefore, the n clouds do not need to interact regarding the execution order to maintain consistency. During the forward propagation process, two parallel logical branches are maintained: the CKKS auxiliary branch is denoted as... , This indicates the CKKS auxiliary branch, which carries one copy of the CKKS ciphertext tensor on each cloud; the FSS main driving branch is denoted as... , This represents the main driving branch of FSS, carrying one local additive share tensor on each cloud. At any given time, each channel index is carried by only one of the two branches—this constraint of "single-one secure representation at the channel level" is the fundamental premise for the subsequent closed-loop unified rules for cross-branch contributions.

[0069] For a linear operator (convolution, fully connected, batch normalization inference stage, residual addition), let it be located at the th... Layer, denoted by the total number of input channels. The total number of output channels is , This indicates the layer number of the current linear operator in the forward direction. Each cloud is processed independently as follows: Indexing for each output channel. , This represents the index of one output channel of the current linear operator; first, it is mapped according to channel dependency. Retrieve the set of input channel indices that the output channel depends on. Indicates the first Layered linear operators for output channels The input channel dependency set; then according to the current branch. Divided into and These two disjoint subsets, This represents the set of input channel indices currently located in the CKKS auxiliary branch. This represents the set of input channel indices currently located in the main FSS driving branch. Called output channel The corresponding ciphertext field input subset, Called output channel The corresponding share domain input subset.

[0070] Input subset in the ciphertext field Above, each of the n clouds calls CKKS homomorphic linear computation to generate a partial contribution on the ciphertext domain of the primitive. Specifically, first, the nth cloud... Layered linear operators for output channels weight (For convolution, a 3D convolution kernel; for fully connected layers, a single row of weight vectors; for residual addition, a constant 1; for batch normalization inference, scaling and translation coefficient pairs.) Encoded into one or more CKKS plaintext objects using the same slot layout as the CKKS ciphertext, denoted as... , The CKKS plaintext packaged object represents the weight; then... The above uses ciphertext-plaintext homomorphic multiplication. A new CKKS ciphertext is generated by accumulating several ciphertext rotations (used to merge related elements distributed in different slots within the same ciphertext into aligned positions), denoted as . , express In the The ciphertext tensor held at the layer entrance, This represents CKKS ciphertext-plaintext homomorphic multiplication. Indicates output channel Partial contributions to the ciphertext domain. The advantage of ciphertext-plaintext homomorphic multiplication compared to ciphertext-to-ciphertext homomorphic multiplication is that it does not consume the multiplication depth budget. n clouds can be stacked multiple times for homomorphic linear computation without relinearization, which is crucial for multi-layer convolutional networks deployed in the cloud—if ciphertext-to-ciphertext homomorphic multiplication were used instead, the multiplication depth might be exhausted after every 2 to 3 linear operators, forcing the insertion of additional homomorphic bootstrapping operations, resulting in a sharp increase in ciphertext throughput and single-layer latency. Ciphertext rotation accumulation in convolutional scenarios is unfolded in a SIMD style, that is, a kernel size of... The convolution solution is Subciphertext-Plaintext Multiplication and The cumulative sequence of ciphertext rotations; in the residual addition scenario, it degenerates into a single ciphertext-ciphertext homomorphic addition; in the batch normalization inference stage, only a single ciphertext-plaintext multiplication plus a single ciphertext-plaintext addition is performed, because at this time the scaling and translation coefficients have been merged into the static parameters.

[0071] Input subset in the share domain Above, n clouds perform local multiplication and addition with plaintext weights on their own local shares, generating a partial contribution in the share domain. Specifically, the first... The shareholding tensor of Duoyun is denoted as , express In the The first floor entrance A local share of tensor copies for each cloud; each cloud is computed independently. , Indicates the first Output channel generated locally by Duoyun Partial contribution in the share domain, Indicates the first Layered linear operators from input channels To output channel plaintext weight scalar, Indicates the input share tensor. The channel is in The local share of each of the n clouds. All local shares of the n clouds are synthesized using an additive secret sharing method. The synthesized result is the plaintext truth value of the partial contribution in the share domain—and this truth value cannot be independently recovered from any subset of the n clouds, strictly satisfying the security constraint that collusion among at most n-1 clouds is unbreakable under the semi-honest model. Local linear computation in the share domain involves almost no inter-cloud communication, and requires no ciphertext rotation or multiplication depth budgeting. Latency is determined by local memory bandwidth. A single convolution multiplication-addition of a million-element share tensor can be completed in milliseconds on a typical server-grade CPU—this is the real computational benefit gained from delegating low-scoring channel subsets and insignificant channels in the sense of bottleneck scores to the FSS share domain.

[0072] Based on the reasoning scheduling table Output Channel Index At the next candidate segmentation position The subset belonging to the target security representation determines its target security representation. , Indicates output channel The target security representation is determined by either the CKKS ciphertext field or the FSS share field. The specific rule for determining the target security representation is: if... ,but , Indicates position The high-resolution channel subset below, because the high-resolution channel carries the most effective signal, should ideally be preserved in the ciphertext domain with the highest precision; if... ,but , Indicates position The lower-resolution channel subset, which mainly carries noisy or redundant signals, is transferred to the share domain to release the ciphertext computation overhead; if ,but Determined by the pre-defined merging strategy in the inference scheduling table, it may be either a CKKS ciphertext field or an FSS share field. Indicates position The middle channel subset below.

[0073] In determining Then, n clouds perform representation transformation suboperations on the partial contributions of another security representation to complete the unification of cross-branch contributions. When hour, This set of local shares needs to be converted into a CKKS encrypted message through a share rebate operation. , Indicates output channel The partial contribution in the share domain is transformed into ciphertext in the CKKS ciphertext domain through the share back-in operation; then it is superimposed in the ciphertext domain using homomorphic addition. , This represents CKKS ciphertext-ciphertext homomorphic addition. Indicates output channel In the The complete output representation obtained by summarizing the outputs at each layer output stage. hour, This ciphertext needs to be converted into n local shares through a downlink ciphertext repackaging operation. , This indicates that the partial contribution on the ciphertext field is converted to the share field after the downlink ciphertext repackaging operation. The local share held by Duoyun; then superimposed in the share domain using an additive secret sharing method. , Indicates output channel In the The local share obtained during the layer output stage. After overlay, the output channel... In the The layer output stage carries the complete value in a single-1 secure representation—if Then in Stored in ,like Then in Stored in There is no split state where "a channel has both ciphertext field contribution and share field contribution" before entering the next level operator.

[0074] The reason for insisting on "mandatory closure of cross-branch contributions at the output stage of each linear operator" is that if the branch reorganization transformation is delayed until the candidate split position before being uniformly performed, the local linear computation of the share domain in each intermediate layer needs to include the input channels whose targets belong to another branch in the local multiplication and addition. Subsequently, the accumulated local results must be transformed again, which will cause the local values ​​of a single cloud to continuously expand, the risk of fixed-point overflow to increase exponentially, and the tensor volume of each representation transformation to become larger and larger. On the contrary, closing the closure immediately at the output stage of each layer can ensure that the input size of each representation transformation sub-operation is only related to the number of output channels of that layer, the delay does not accumulate, the fixed point does not drift, and it is more controllable in engineering. This also ensures that the semantics of the back-tracking closure are naturally guaranteed at each layer - the input channel contribution tracked by the output channel whose target belongs to the flipped branch is closed at that layer, rather than being passed down to the downstream for compensation.

[0075] For a nonlinear activation operator, first confirm that all its input channel indices have completed cross-branch contribution accumulation in the output stage of the previous linear operator—that is, each input channel carries a complete value in a single-safe representation, which is a necessary prerequisite for the correct execution of FSS evaluation. Then, n clouds are used to evaluate the current location. The entire ciphertext tensor is converted into a share tensor by performing a downlink ciphertext repackaging operation, and then merged into the channel dimension. Given a share tensor, the input tensor of the entire nonlinear activation operator is such that... The above is fully available in the form of additive secret sharing. The overall downlink approach, rather than channel-by-channel downlink on demand, has two considerations: First, the element-by-element piecewise nonlinear activation operator acts independently on each input element by definition; if a portion of the input is still present... And the other part is This requires processing two sets of representations simultaneously within a single piecewise function. However, CKKS offers very weak support for piecewise comparison and piecewise output. The FSS function share, on the other hand, is inherently designed for additive secret sharing. Processing is the only robust option in engineering. Secondly, the amortized cost of downlink encrypted packet repackaging operations has a sublinear relationship with the number of downlink channels to be processed. select The constant round overhead of the joint decryption protocol can be diluted when downlinking in large batches. Downlinking the entire ciphertext tensor once is often more efficient than downlinking in blocks over several channels.

[0076] After the merging is complete, the n clouds perform FSS evaluation on the concatenated share tensor using the FSS function shares distributed by the inference initiator during the offline phase, obtaining the share tensor on the output side of the nonlinear activation operator. Specifically, let the nonlinear activation operator be the... The input share tensor of Duoyun is The share of local FSS functions is Each cloud independently calls the FSS evaluation primitive. , The nonlinear activation operator is represented in the th... The input share tensor of Duoyun, This represents a precompiled FSS evaluation primitive. The nonlinear activation operator is represented in the th... The output share tensor of n clouds; the output shares of n clouds are synthesized using an additive secret sharing method to recover the plaintext output after the nonlinear activation operator is applied to the plaintext input, but this plaintext output cannot be independently recovered on any subset of n clouds. The FSS evaluation process is almost entirely localized, with no additional communication rounds between clouds, and the latency of local tensor traversal is almost proportional to the tensor size. This is because the nonlinear activation operator is entirely managed by the cloud. Another benefit gained is that the multiplication depth of the nonlinear activation operator under the CKKS polynomial approximation often reaches 4 to 8, which requires a large amount of multiplication depth budget and introduces additional homomorphic bootstrapping. In contrast, FSS evaluation does not consume multiplication depth, so the ciphertext bearer of the forward link is always in a shallow layer.

[0077] Each forward pass advances to a candidate segmentation position. At that time, n clouds are scheduled according to the inference table. The subset partitioning at that position, and and The channel dependency mapping between them performs branch reorganization transformation. The specific steps are as follows: First, identify the position. High-resolution channel subset The middle-division merge strategy specifies the middle-division channel subset (denoted as CKKS ciphertext field) as the middle-division channel subset. , Indicates position The lower middle channel sub-set is assigned to the portion of the CKKS ciphertext field, and these two channel portions are taken at position. End-to-end reverse tracing closure The set of all input channels obtained through reverse tracing is denoted as the ciphertext-bearing target closure. , Indicates position The encrypted message carries the target closure. Indicates position and Between output channel indexes The reverse tracing closure. For Middle channel index falls into The share slices are converted into CKKS encrypted slices using the share back-injection sub-operation and then concatenated according to the channel index order. The ciphertext tensor; conversely, the identifier derived from position. Lower low-resolution channel subset The middle channel subset specified by the middle merging strategy as the FSS share domain (denoted as , Indicates position The share-bearing target closure defined in the lower middle channel subset (the portion belonging to the FSS share domain) , Indicates position The share-bearing target closure, for Middle channel index falls into The encrypted slices are converted into share tensor slices by the following encrypted repackaging sub-operation and concatenated in channel index order. The share tensor.

[0078] This method of identifying closures by tracing back should be used in... The key advantage of the approach of "the terminal already possessing the input channel security representation form" is that it allows... and When operators advance, all input channels required for forward propagation are already on the correct branches. The ciphertext and share input subsets of any linear operator in the middle are naturally aligned with the target secure representation of its downstream output channel, without the need for additional branch flipping in the middle. This is especially important for deep convolutional networks and residual networks. If the bidirectional reorganization at a certain downstream main split position is not projected upstream once through the backtracking closure, but instead allowed to "react to each move" in the middle layers, the same input channel will be repeatedly transformed two or even three times in different operators, and the number of ciphertext-share transformations will get out of control. By performing a concentrated projection along the backtracking closure, the number of transformations between each candidate split position can be strictly bounded to the number of channels corresponding to the subset partition at that position, thereby compressing the transformation cost to near the theoretical lower bound.

[0079] At the main segmentation position At this stage, branch reorganization and transformation are centrally executed in a two-way reorganization manner driven by bottleneck scoring. This represents the primary splitting position selected by minimizing scheduling costs. Specifically, the primary splitting position... The bidirectional recombination at the location follows the "high-resolution channel subset" and the middle-division channel subset specified by the middle-division merging strategy as the CKKS ciphertext field. Depend on The remaining channels are carried by The unified form of "carrying", that is, in The two branches' identities are then placed downstream. The subset membership is completely flipped once. This indicates the next candidate split position immediately following the primary split position in the forward direction, i.e., the alternative split position. At the remaining candidate split positions, the branch reorganization transition is performed according to a subset of each position using the same protocol. The severity of branch flips is usually mild—this is a result of the inherent constraints of the scheduling cost mechanism, which only allows large-scale flips at the primary split position.

[0080] Centralized flipping at the main splitting position, rather than distributing it evenly across candidate splitting positions, brings three benefits. First, the physical meaning of bottleneck score ranking reaches its strongest signal at the main splitting position—after feature extraction from several layers of nonlinear activation operators, the bottleneck score ranking has the highest stability. The bearer identity assignment based on the ranking is closest to the actual information flow of the network, and the bearer allocation after flipping can maintain its optimal performance in the longest downstream segment. Second, centralized flipping allows the overhead of the n-to-n joint decryption rounds of the share injection sub-operation and the downlink ciphertext repackaging sub-operation to be batch-distributed—each n-to-n joint decryption involves at least two rounds of interaction between n clouds. Merging the fragmented transformations of multiple candidate splitting positions into one operation at the main splitting position can significantly reduce the cumulative number of interaction rounds, with particularly significant benefits in cross-availability zone or cross-regional deployments. Third, the adjacent positions of the main segmentation position are the alternative segmentation positions. After the main segmentation position is significantly flipped, the alternative segmentation positions play the role of patching and fine-tuning. They can make a light correction to the small bearing deviation caused by quantization error or reverse tracking closure approximation at the main segmentation position, and realize the hierarchical reorganization of "coarse adjustment + fine adjustment".

[0081] It is important to emphasize that although the bidirectional reorganization at the main split position is a "reorganization," it is still subject to the aforementioned constraint of "forced closure in the output stage of each linear operator." The reorganization itself is not an independent step suspended outside the linear operator, but rather a complete centralized transformation inserted in the gap between the nonlinear activation operator corresponding to the main split position and the linear operator. In other words, when the reorganization occurs, the tensors held by the n clouds are already in a stable state after completing cross-branch accumulation. Any input channel is carried by a single-1 secure representation. The centralized share back-injection sub-operation and the downlink ciphertext repackaging sub-operation only affect the channel slices that fall into their respective target closures and do not break the closure.

[0082] refer to Figure 3 The entire diagram unfolds horizontally into three spatial segments: from left to right, the load-bearing state segment before the main segmentation point, the bidirectional reorganization segment at the main segmentation point, and the steady-state continuation segment after the alternative segmentation point. Two parallel horizontal baselines are arranged vertically in the diagram. The upper baseline represents the CKKS auxiliary branch, and the lower baseline represents the FSS main drive branch. Each baseline has a brief text label on its left side indicating the branch name.

[0083] The main dividing point is depicted by a thick vertical dashed line running through the entire image, with the top of the line marked with a white background and a black border. , The primary partitioning position is indicated by minimizing scheduling cost; alternative partitioning positions are depicted by another vertical dotted line, with the top also marked with a white background and a black border. , This indicates the next candidate segmentation position immediately adjacent to the main segmentation position along the forward direction, i.e., the alternative segmentation position. Two vertical lines divide the map into three spatial segments.

[0084] The carrying state segment before the main split point is located on the far left of the diagram. Within this segment, 12 channel indices are distributed across two baselines, presented as either solid circles or hollow circles depending on their current branch position. Solid circles represent ciphertext carrying, and hollow circles represent share carrying. Each channel index appears on only one of the two baselines. Each circle is labeled with a number to identify the channel index; the channel index number for ciphertext carrying is labeled above the circle, and the channel index number for share carrying is labeled below the circle, with a white background to avoid intersection with the horizontal arrows. The steady-state continuation segment after the alternative split point is located on the far right of the diagram. The channel arrangement rules are the same as in the middle segment, but the circles and index numbers are slightly smaller to reflect the lightweight continuity of the steady-state phase.

[0085] The bidirectional reorganization segment at the main split position is located in the middle. Starting from each channel circle in the left-hand carrying state segment, an arrow extends towards the corresponding channel circle in the middle segment: if the channel index is located on the CKKS auxiliary branch both before and after the main split position, the arrow extends horizontally along the upper baseline; if the channel index is located on the FSS main driving branch both before and after the main split position, the arrow extends horizontally along the lower baseline; if the channel index is on the FSS main driving branch before the main split position and on the CKKS auxiliary branch after the main split position, the arrow crosses diagonally upwards from the lower baseline to the upper baseline, representing a share re-entry sub-operation; if the channel index is on the CKKS auxiliary branch before the main split position and on the FSS main driving branch after the main split position, the arrow crosses diagonally downwards from the upper baseline to the lower baseline, representing a downlink ciphertext repackaging sub-operation. Maintenance arrows are thinner, while crossing arrows are thicker to highlight maintenance and flipping operations respectively. Place one label in the blank area next to the cross-type arrow cluster. The label is placed on the top layer with a white background and black border. The label content is "Share Back Injection" and "Downstream Cipher Text Repackaging", respectively.

[0086] Below the diagram is a horizontal text paragraph with a white background and black border summarizing: Bottleneck scoring drives bidirectional restructuring. In the lower right corner, a brief legend in two lines explains that solid and hollow circles correspond to encrypted data carrying and share carrying, respectively. At the top of the diagram, a larger font indicates the diagram's title: "Bottleneck scoring drives bidirectional restructuring principle diagram at the main segmentation position." The entire diagram, through the comparison of three spatial segments and the dense distribution of cross-shaped arrows at the main segmentation position, vividly illustrates a hierarchical restructuring approach where the carrying role at the main segmentation position is significantly reversed, while other positions only undergo minor adjustments.

[0087] In terms of optional implementation methods, the middle-division merging strategy can be flexibly configured in the following ways. The first is the odd-even separation strategy. Take the middle channel with an even channel index. Selecting the middle channel with an odd channel index—this strategy is simple to implement and can form a consistent sampling pattern for periodic network structures (such as even-numbered layers in some backbone networks). The slot packing stride is naturally aligned, reducing the cost of ciphertext rotation accumulation. The second approach is a secondary ranking strategy refined by bottleneck score, dividing the channel subset in the middle. Internally, the components are further sorted by bottleneck score, with the top half belonging to... The second half belongs to —This approach is more favorable for networks with a continuous gradient in bottleneck score distribution, resulting in smoother transition boundaries. The third approach is based on minimizing the number of cross-branch channel dependencies. It enumerates various binary choices within the middle channel subset and selects the number of cross-branch channel dependencies. The smallest binary search is used as the final merging scheme—this strategy trades one offline optimization for long-term online benefits, and is most advantageous for high-latency deployments across availability zones. The fourth strategy is an extreme approach of uniformly merging to the CKKS ciphertext field or uniformly merging to the FSS share field—the former is suitable for applications with extremely high output precision, and the latter is suitable for applications with extremely high online latency. The specific strategy chosen is written into the inference scheduling table by the inference initiator during the offline phase. The code is distributed together and cannot be modified online once distributed, in order to ensure the consistency of execution across multiple clouds.

[0088] After entering step 3, the forward propagation reaches the termination split position, which is the inference output layer. , This represents the inference output layer at the end of the forward computation graph. At this point, each cloud holds... Terminal ciphertext tensor is denoted as , express The ciphertext tensor held at the termination of the split; Duoyun's holdings The terminal share tensor is denoted as , Indicates the first The local share tensor held by Duoyun at the termination of the split. The set of output channel indexes carried in the middle is , The set of output channel indexes carried in the middle is , and , This represents the total number of channels in the inference output layer. (Division) and The basis comes from The target security representation of the index of each output channel under the termination split position is assigned.

[0089] n clouds each hold their own Copy and And it is sent to the inference initiator via an end-to-end TLS 1.3 encrypted channel. Theoretically, n clouds hold The copies are exactly the same (because the whole line) All operations performed by the n clouds on the link are deterministic homomorphic operations and synchronous ciphertext rotations. The inference initiator receives data from any one of the clouds. This is sufficient for decryption; however, it still requires all n clouds to send their own copies so that the initiator of the inference can detect anomalous copies under the semi-honest model during sampling comparison. For example, if one cloud does not strictly follow the instructions... Offset copies generated by performing homomorphic operations. Then it is the first Each of the n unique local shares of Duoyun is distinct from the others. The initiator of the reasoning needs to collect all n shares before proceeding with the subsequent synthesis.

[0090] After receiving the data, the inference initiator, acting as the coordinator, invokes n clouds to collaboratively execute an n-choose-n joint decryption protocol, ensuring that the plaintext result of this joint decryption is received only by the inference initiator. The specific process is as follows: The inference initiator first sends the data submitted by any one of the clouds... In Partial broadcast to n clouds, and These represent the ciphertext tensors at the termination of the segmentation position, respectively. The constant term and the linear term; each cloud locally computes its own partial decryption. , Indicates the first Duoyun's partial decryption results for the ciphertext tensor at the termination segmentation position. Indicates the first Duoyun's CKKS joint decryption share, This indicates the slight noise from the cloud's local additional sampling. This represents the integer modulus upon which the CKKS ciphertext computation is based; n clouds Submitted to the inference initiator, who then performs the calculation locally. The result is then decoded according to the CKKS decoding rules to obtain the CKKS plaintext tensor. , Indicates by The CKKS plaintext tensor obtained by decrypting the terminal ciphertext tensor. Only carry The plaintext result of this joint decryption is received only by the inference initiator—specifically, the n clouds only send a portion of the decryption to the inference initiator, instead of broadcasting it among the n clouds. The inference initiator has exclusive control over the synthesis, and no other cloud can see it. This ensures that even with at most n-1 clouds conspiring together, the final plaintext output cannot be detected under the semi-honest model.

[0091] The share tensors sent by n clouds are summed locally according to additive aggregation rules, and the inference initiator obtains the FSS plaintext tensor. Specifically, , Indicates by The FSS plaintext tensor obtained by synthesizing end-share tensors. Only carry The channel in the middle. The additive aggregation rule is a simple summation at the scalar level and on... Modulo operation, implemented as a local addition at the tensor level plus an element-wise modulo operation, has a computational complexity linearly related to the tensor size, and can be completed within milliseconds even with tens of millions of elements. This aggregation step requires no additional interaction with the n clouds; the inference initiator receives all the data... You can then complete it independently.

[0092] In obtaining and Afterwards, the initiator of the inference process followed the inference scheduling table. The target security representation at the termination segmentation position is assigned to two plaintext tensors and then performed a reverse rearrangement and concatenation operation along the channel dimension. The specific steps are: first, according to... The record's channel index attribution table reads each channel index. Target security representation; if Then from Extract the plaintext slice corresponding to that channel; if Then from Extract the plaintext slice corresponding to the channel; then concatenate them in ascending order of channel index to obtain... , Represents a complete fixed-point output tensor consistent with the inference output layer specification 1; finally, the inverse operation is performed according to the unified fixed-point encoding rule. (For integers exceeding half the modulus, subtract first) Multiply again (To correctly restore the sign bit) to the fixed-point element Restore to floating-point elements , thus obtaining the complete output tensor. express One fixed-point integer element in the array. This indicates the corresponding floating-point number reconstruction result. This indicates the number of decimal places in the unified fixed-point code used in step 2.

[0093] The reason for rearranging and concatenating the channels in ascending order instead of concatenating them sequentially is... and This is because the bottleneck score ranking results in the offline phase drove the channel allocation, making... and The channels are staggered along the original channel index axis—for example, for a 64-channel output layer, channels 0, 3, 5, 7, ... might be staggered along the original channel index axis. Channels 1, 2, 4, 6, ... are in If a sequential concatenation is performed directly, the resulting tensor channel order will be misaligned with the original computation graph's channel order, making subsequent classification, regression, or downstream business logic unable to interpret correctly. Therefore, it is essential to accurately backfill according to the channel index attribution table, which is precisely the inference scheduling table. The fundamental reason why the "Target Security Indicator of Each Output Channel Index under the Termination Segmentation Position" field is explicitly recorded in the offline phase of step 1.

[0094] The complete output tensor is recovered independently by the inference initiator; no cloud holds it. Or its equivalent. Even if at most n-1 clouds conspire, they can only aggregate n-1 units. The missing additive share corresponds to a plaintext truth value superimposed with one random quantity held by the missing cloud, which is statistically equivalent to uniform random noise; similarly, these n-1 clouds can only contribute n-1 shares. The missing 1 part corresponds to Item is The high-entropy linear function cannot be eliminated by the colluding parties. This represents the CKKS joint decryption share of the cloud outside the collusion party. Therefore, under the security model of semi-honesty and at most n-1 cloud collusion, the complete output tensor always remains confidential to those outside the collusion parties, and only the initiator infers the information when summarizing the n shares. With n copies Only then was it restored. This entire process strictly consolidates the right to recover the plaintext of the "intermediate tensor" and the "final output tensor" to the inference initiator, completing a privacy protection loop for cross-cloud federated inference.

[0095] In optional implementations, for multimodal, multi-task, or multi-branch output networks, the inference output layer... It may consist of multiple parallel outputs (e.g., the classification head and regression head of an object detection network are parallel, or the mean head and variance head of a generative model are parallel). In this case, step 3 can independently execute the n-to-n joint decryption protocol and FSS plaintext tensor synthesis for each output, recovering the complete output tensor of each output; if a certain output only carries... If the above is true, then the FSS plaintext tensor synthesis step is not required at this end; similarly, if a certain output end only carries... If the above is true, then the end does not need to perform an n-to-n joint decryption protocol. For generative or autoregressive inference (e.g., sequence generation, diffusion model sampling), step 3 can be reused at the end of each time step or each sampling step. After recovering the output of step 1, the inference initiator encapsulates the output of step 1 again according to the unified fixed-point encoding and CKKS encryption rules into the initial ciphertext tensor of the next step and broadcasts it to n clouds, that is, restarts a round of the loop of steps 2 and 3; in this loop, the inference scheduling table It can be reused in each round, with only the initial ciphertext tensor being updated iteratively with each time step.

[0096] refer to Figure 4 The horizontal axis represents the candidate segmentation position number, labeled sequentially from left to right. to , Indicates the first in the forward direction One candidate segmentation position, The horizontal axis has no specific physical dimension but is strictly consistent with the forward direction. The vertical axis represents scalar values, which are dimensionless after normalization, and the scale is independent of the given value. Slightly higher To reserve ample label space. Both the horizontal and vertical axes have scale lines, and the vertical auxiliary grid is presented as dotted lines.

[0097] The figure shows four curves extending along the direction of the candidate segmentation position numbers. Each curve is formed by concatenating discrete data points. The first curve represents the proportion of the mid-channel. The normalized sequence, Indicates the candidate segmentation position The ratio of the number of channels in the middle sub-group to the total number of channels at that location is represented by a series of hollow circular markers connected by short dashed lines. The second curve represents the number of cross-branch channel dependencies. The normalized sequence, Indicates position The total number of cross-branch channel dependencies obtained from the lower edge backward tracing closure statistics is represented by curves connected in series with square gray markers, and the markers are connected by dotted lines. The third curve represents the expected communication cost. The normalized sequence, Indicates position The expected number of bytes communicated due to the conversion between the CKKS ciphertext field and the FSS share field is represented by curves connected by hollow triangles, with the triangles linked by dotted lines. The fourth curve represents the scheduling cost. The first three curves are calculated using the formula. Weighted synthesis, The weighted coefficients are and satisfy the following conditions: The curves are connected by solid circular markers of the largest size, with solid lines connecting the markers, and placed on the top layer to highlight their core status as a comprehensive criterion.

[0098] The scheduling cost curve shows an overall trend of first decreasing and then rising along the direction of the candidate split position number, with the lowest point occurring at a candidate split position in the middle of the sequence. In the figure, a vertical dotted line runs through this lowest point, and a white-background, black-bordered label marks this position as the primary split position on the lower left side of the curve. The annotation box points to the lowest point via a short leader line with an arrow. The next candidate split point immediately adjacent to the main split point along the forward direction is marked with another annotation box with a white background and a black border as the alternative split point. The label box is placed in the blank area on the right below the curve, and a short leader with an arrow points to the corresponding data point, which echoes the hierarchical mechanism in which the alternative split positions take on patch-style fine-tuning after the main split position.

[0099] The upper left blank area of ​​the figure contains a legend section. The legend uses a compact two-column layout, providing the mark shape, connecting line type, and symbol explanation for the four curves, listed sequentially. The proportion of the middle channel Cross-branch channel dependencies Expected communication costs and The scheduling cost (weighted sum) consists of 4 terms. A formula description box with a white background and a black border is placed in the lower right blank area of ​​the graph, listing the formulas in two lines within the box. Its typical values ​​of weighting coefficients The horizontal axis title represents the candidate splitting position number, and the vertical axis title represents the cost, with a note explaining that it is normalized and dimensionless. The entire graph, presented side-by-side with four curves sharing the same horizontal axis and arrows indicating the primary and candidate splitting positions, comprehensively illustrates the overall pattern of the evolution of scheduling cost along the candidate splitting position sequence and the core idea of ​​selecting the primary splitting position driven by the criterion of minimizing scheduling cost.

[0100] This invention is not limited to the specific embodiments described above. The invention extends to any new feature or combination disclosed in this specification, as well as any new method or process step or combination disclosed herein.

Claims

1. A privacy protection method for cross-cloud federated inference based on homomorphic encryption and tensor partitioning, characterized in that... This method is applicable to neural network computation graphs containing linear operators and element-wise piecewise nonlinear activation operators, and includes the following steps: Step 1: The inference initiator sets a sequence of candidate split positions in the neural network computation graph and records the channel dependency mapping between adjacent candidate split positions; it calculates a bottleneck score for the channel index under each candidate split position to divide the channel subset, and selects the main split position based on the scheduling cost; there are n clouds, and the n clouds collaboratively execute the CKKS key generation protocol and receive the FSS function share distributed by the inference initiator; the candidate split position sequence, channel subset, and channel dependency mapping are summarized to form an inference scheduling table; Step 2: The inference initiator broadcasts the tensor of the sample to be inferred in CKKS ciphertext to n clouds as the initial ciphertext tensor of the CKKS auxiliary branch; the n clouds advance forward according to the inference schedule table, the CKKS auxiliary branch carries linear operators, the FSS main driving branch carries the FSS evaluation of nonlinear activation operators, and the cross-branch contribution between the two branches is unified by the representation transformation sub-operation; at each candidate split position, branch reorganization transformation is performed along the channel dependency mapping, and at the main split position, bidirectional reorganization is performed driven by the bottleneck score; Step 3, at the inference output layer, n clouds send the ciphertext tensor at the end of the CKKS auxiliary branch and the share tensor at the end of the FSS main driving branch to the inference initiator; the inference initiator decrypts the CKKS plaintext tensor using the n-to-n joint decryption protocol and synthesizes the FSS plaintext tensor, then reverses and splices it according to the inference schedule table to obtain the complete output tensor, which is independently recovered by the inference initiator.

2. The method according to claim 1, characterized in that... The linear operators include convolution, fully connected, batch normalized inference stage, and residual addition. The element-wise piecewise nonlinear activation operator is one of ReLU, approximate Sigmoid, approximate Tanh, and approximate GELU. The method is executed under a semi-honest and at most n-1 cloud collusion security model.

3. The method according to claim 1, characterized in that... In step 1, the candidate segmentation position sequence is composed of candidate segmentation positions located on the output side of each nonlinear activation operator in the neural network computation graph and the termination segmentation position located in the inference output layer of the neural network computation graph, arranged in an ordered forward direction. The channel dependency mapping defines the operator segment between two adjacent candidate segmentation positions, including the set of input channel indices that each output channel index of each linear operator in the operator segment depends on, and the output channel to input channel backtracking closure from the end position of the operator segment to the beginning position of the operator segment. The inference scheduling table also includes the target security representation attribution of each output channel index under the termination segmentation position. The target security representation attribution indicates that this output channel index is carried by the CKKS auxiliary branch or the FSS main driving branch.

4. The method according to claim 1, characterized in that... In step 1, the bottleneck score is calculated as follows: In the local environment, the inference initiator sequentially retrieves calibration samples from the pre-set calibration sample set during the deployment phase and inputs them into the neural network computation graph in plaintext form to perform one complete forward propagation. At each candidate split position, a copy of the tensor obtained from this forward propagation is retained. For each channel index under each candidate split position, the tensor elements of all calibration samples at the spatial or feature positions corresponding to this channel index are summarized in the order of retrieval to form an element value sequence. The sample range and absolute mean of the element value sequence are calculated. The sample range of all channel indices under the same candidate split position are ranked from largest to smallest to obtain the range ranking, and the absolute mean is ranked from largest to smallest to obtain the intensity ranking. The difference between the range ranking and the intensity ranking of the same channel index is used as the bottleneck score of this channel index under this candidate split position.

5. The method according to claim 4, characterized in that... In step 1, the channel subset is divided according to the bottleneck score as follows: the channel indexes under the same candidate split position are reordered from high to low according to the bottleneck score and divided into three equal parts according to the ranking. The channel indexes of the top 1 / 3 are assigned to the high-scoring channel subset, the channel indexes of the middle 1 / 3 are assigned to the middle-scoring channel subset, and the channel indexes of the bottom 1 / 3 are assigned to the low-scoring channel subset.

6. The method according to claim 5, characterized in that... In step 1, for each candidate splitting position, the scheduling cost is equal to the weighted sum of the proportion of the number of channels in the middle channel subset under this candidate splitting position, the number of cross-branch channel dependencies of the adjacent operator segments of this candidate splitting position, and the expected communication cost generated by the conversion between the CKKS ciphertext field and the FSS share field; the candidate splitting position with the minimum scheduling cost is selected as the main splitting position, and the next candidate splitting position immediately adjacent to the main splitting position along the forward direction is selected as the alternative splitting position.

7. The method according to claim 1, characterized in that... In step 1, the CKKS key generation protocol adopts an n-to-n joint decryption configuration. Each of the n clouds holds one CKKS joint decryption share. Decryption can only be completed when all CKKS joint decryption shares of the n clouds are merged. The FSS function share is generated by the inference initiator for each nonlinear activation operator in the neural network computation graph within a unified fixed-point coding domain. The input and output of the FSS function share are both fixed-point tensors in the form of additive secret sharing, and the input and output maintain the same fixed-point scale. The inference initiator distributes the FSS function share to each of the n clouds according to the cloud's identifier.

8. The method according to claim 5, characterized in that... In step 2, the cross-branch contribution is uniformly completed by the representation transformation sub-operation as follows: Based on the channel dependency mapping, for each output channel index of each linear operator, the set of input channel indices that this output channel index depends on is divided into a ciphertext domain input subset and a share domain input subset according to the current branch. For the ciphertext domain input subset, a partial contribution of this output channel in the ciphertext domain is generated using the CKKS homomorphic linear computation method; for the share domain input subset, a partial contribution of this output channel in the share domain is generated using the share domain local linear computation method. Based on the inference scheduling table, this output channel index... The target security representation is determined by the channel subset at the next candidate split position. When the target is assigned to a high-scoring channel subset, the CKKS ciphertext field is used; when the target is assigned to a low-scoring channel subset, the FSS share field is used; and when the target is assigned to a medium-scoring channel subset, the CKKS ciphertext field or FSS share field specified by the medium-splitting merging strategy preset in the inference scheduling table is used. The partial contribution in another security representation is transformed to the target security representation through the representation transformation sub-operation, and then added to the partial contribution in the target security representation. In this linear operator output stage, the complete output representation of this output channel index under a single security representation is formed.

9. The method according to claim 8, characterized in that... In step 2, the FSS evaluation method for the nonlinear activation operator is as follows: At each nonlinear activation operator, it is first confirmed that all input channel indices of this nonlinear activation operator have completed cross-branch contribution accumulation in the output stage of the previous linear operator; then, the ciphertext tensor currently located in the CKKS auxiliary branch is converted into a share tensor by performing a downlink ciphertext repackaging operation and merged into the existing share tensor of the FSS main driving branch according to the channel dimension; n clouds perform FSS evaluation on the merged share tensor with FSS function share to obtain the share tensor on the output side of this nonlinear activation operator; the branch reorganization transformation and bidirectional reorganization methods in step 2 are as follows: along the reverse tracing closure, the high-scoring channel subset and the middle-scoring channel subset of the CKKS ciphertext domain specified by the middle-scoring merging strategy are identified. The set of input channels that the output channels corresponding to the middle-scoring channel subset of the CKKS ciphertext domain depend on at the current candidate split position are denoted as the ciphertext-bearing target closure. The current ciphertext tensor located in the FSS main driving branch is reorganized into a share tensor by performing a downlink ciphertext repackaging operation and merging the ciphertext tensor into a share tensor according to the channel dimension. Share slices whose channel indices fall into the ciphertext-bearing target closure in the share tensor are converted into CKKS ciphertext slices using the share back-injection sub-operation and then concatenated to the CKKS auxiliary branch ciphertext tensor in channel index order. Similarly, the share-bearing target closure defined by the low-scoring channel subset and the mid-scoring channel subset specified as the FSS share domain by the mid-scoring merging strategy is identified. For the ciphertext slices currently located in the CKKS auxiliary branch ciphertext tensor whose channel indices fall into the share-bearing target closure, the following ciphertext repackaging sub-operation is used to convert them into share tensor slices and concatenate them to the FSS main driving branch share tensor in channel index order. At the main split position, the bottleneck score-driven bidirectional reorganization is performed in a centralized manner, that is, the high-scoring channel subset and the mid-scoring channel subset specified as the CKKS ciphertext domain by the mid-scoring merging strategy are carried by the CKKS auxiliary branch, and the remaining channels are carried by the FSS main driving branch. At other candidate split positions, the channel subset division under this candidate split position is performed in the same way.

10. The method according to claim 1, characterized in that... Step 2 indicates that the conversion sub-operations include a downlink ciphertext repackaging sub-operation that converts ciphertext into shares and a share injection sub-operation that converts shares back into ciphertext. The share injection sub-operation is executed as follows: each of the n clouds encrypts its own share slices to be injected into CKKS single-cloud ciphertext slices using the public CKKS encryption key parameters of the participating parties. The CKKS single-cloud ciphertext slices of the n clouds are then accumulated between the clouds using CKKS homomorphic addition to obtain a CKKS aggregated ciphertext slice. The downlink ciphertext repackaging sub-operation is executed as follows: one of the n clouds is pre-designated as the receiving cloud, and each cloud other than the receiving cloud independently generates a copy of the plaintext after decoding the downlink ciphertext slice. Random mask tensors with identical shapes are encapsulated into CKKS mask ciphertext and then sequentially subtracted from the downlink ciphertext slice using CKKS homomorphic subtraction until the CKKS mask ciphertexts of n-1 clouds outside the receiving cloud are subtracted to obtain the subtracted intermediate ciphertext slice. The n clouds then collaboratively perform one n-choose-n joint decryption on the subtracted intermediate ciphertext slice. The plaintext result of this joint decryption is received only by the receiving cloud and used as the downlink share slice held by the receiving cloud. Each cloud outside the receiving cloud uses its local random mask tensor as its own downlink share slice. The downlink share slices held by the n clouds are synthesized into a downlink share tensor slice using an additive secret sharing method.

Images