U-shaped privacy inference method and system based on channel permutation and scaling

Abstract

The application discloses a U-shaped privacy inference method and system based on channel permutation and scaling. The method comprises the following steps: dividing an inference model into an input sub-model, an intermediate sub-model and an output sub-model; performing channel permutation and scaling processing on the transformable boundary in the intermediate sub-model, performing layer-by-layer equivalent reparameterization processing on the processed intermediate sub-model, and deploying the intermediate sub-model in a computing power node; deploying the input sub-model, the output sub-model, a pre-constructed permutation and scaling module and an inverse transformation module in an application node; the permutation and scaling module is used for performing channel permutation and scaling processing on an uplink tensor and then transmitting the uplink tensor to the computing power node; the inverse transformation module is used for performing inverse transformation on a downlink tensor and then transmitting the downlink tensor to the output sub-model; in an inference stage, inputting a task to be inferred into the application node, outputting an inference result to the application node after inference by the computing power node, and obtaining the inference result. The application considers both the end-cloud collaborative inference efficiency and the intermediate feature privacy protection capability.

Description

Technical Field

[0001] This invention belongs to the field of edge-cloud collaboration and privacy protection, and more specifically, relates to a U-shaped privacy inference method and system based on channel permutation and scaling. Background Technology

[0002] Convolutional neural networks (CNNs) are widely used in tasks such as image classification, object detection, and semantic segmentation. However, as model size and input image resolution continue to increase, deploying and executing CNNs fully on terminal devices becomes increasingly limited by computing power, storage, and energy consumption. Model segmentation and inference divides the network into multiple sub-models, with the terminal performing the initial computation and uploading intermediate features to the cloud for subsequent computation. This approach is a crucial way to alleviate the pressure on terminal resources.

[0003] Existing model segmentation inference typically employs a unidirectional splitting approach: a front-end segment on the edge and a back-end segment on the cloud. The cloud directly holds most of the parameters of the original model and receives intermediate features in the natural channel sequence. Once an attacker gains control of the cloud computing nodes, they can analyze the original network structure and input content by combining model weights, channel positions, and statistical relationships of intermediate features. Using a U-shaped split, deploying the input and output sub-models on the edge and the intermediate sub-models on the cloud, can prevent the cloud from directly obtaining the original input and final output. However, the cloud can still see the intermediate models and features in the natural channel space, indicating insufficient isolation between the model and data.

[0004] Channel permutation can change the order of feature channels and their corresponding weights without altering the functionality of a convolutional neural network. However, simple permutation only changes the channel positions, not the amplitude, norm, or statistical distribution of each channel. Attackers can still exploit kernel norms, intermediate feature amplitudes, and cross-layer channel correlations to establish channel matching relationships. Summary of the Invention

[0005] The main objective of this invention is to provide a U-shaped privacy inference method and system based on channel permutation and scaling, so as to overcome the shortcomings of the prior art.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution: The first aspect of this invention provides a U-shaped privacy inference method based on channel permutation and scaling, comprising: dividing the inference model into an input sub-model, an intermediate sub-model, and an output sub-model; sequentially performing channel permutation and channel scaling on the transformable boundaries in the intermediate sub-model; performing layer-by-layer equivalent reparameterization on the processed intermediate sub-model to offset the channel permutation-scaling transformation added to the input channel and form the channel permutation-scaling transformation required for the output channel; deploying the layer-by-layer equivalent reparameterization processed intermediate sub-model on computing power nodes; and configuring the input sub-model, the output sub-model, and the pre-built... The permutation scaling module and the inverse transformation module are deployed on the application node. The permutation scaling module performs channel permutation scaling on the uplink tensor and then transmits it to the computing power node. The uplink tensor is a feature generated by the input sub-model and used as input to the intermediate sub-model. The inverse transformation module performs inverse transformation on the downlink tensor and then transmits it to the output sub-model. The downlink tensor is a feature generated by the computing power node and used as input to the output sub-model. In the inference stage, the task to be inferred is input to the application node, and after inference by the computing power node, the inference result is output to the application node to obtain the inference result.

[0007] Preferably, the transformable boundaries in the intermediate sub-model are sequentially subjected to channel permutation and channel scaling, specifically including: for each transformable boundary: constructing a permutation matrix based on the number of channels of the transformable boundary, wherein the permutation matrix is ​​an orthogonal matrix; generating a corresponding scaling factor for each channel, wherein the scaling factor is within a preset positive value range; combining the scaling factors to construct a diagonal matrix and using it as the scaling matrix; left-multiplying the permutation matrix by the scaling matrix to obtain the channel transformation matrix; and using the channel transformation matrix to perform channel permutation and scaling processing on the features in the channel space of the transformable boundary.

[0008] Preferably, for multiple transformable boundaries that require residual addition, each transformable boundary uses the same permutation matrix and scaling matrix at the confluence position.

[0009] Preferably, for multiple transformable boundaries that need to be feature-stitched, the permutation matrix and scaling matrix of each transformable boundary are combined according to the channel interval occupied by each transformable boundary in the stitching result. The matrix after combining the permutation matrices is multiplied by the matrix after combining the scaling matrices to obtain the overall transformation matrix.

[0010] Preferably, the equivalent reparameterization process for the two-dimensional convolutions in the processed intermediate sub-model is as follows: ; ; in, This represents the complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel after equivalent reparameterization; This represents the original complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel; This is the original output channel number corresponding to the j-th output channel; This is the original input channel number corresponding to the kth input channel; The scaling factor for the j-th output channel; This is the scaling factor for the k-th input channel; This is the bias of the j-th output channel after equivalent reparameterization; This is the original bias of the j-th output channel, where subscripts i and i-1 represent the i-th and (i-1)-th transformable boundaries, respectively.

[0011] Preferably, for the structure of a batch normalization layer following convolution in the processed intermediate sub-model, the equivalent reparameterization process specifically includes: fusing the parameters of the batch normalization layer to obtain convolution parameters; and performing two-dimensional convolution equivalent reparameterization on the convolution parameters.

[0012] Preferably, the convolution parameters are: ; ; in, To fuse the two-dimensional convolutional weights corresponding to the j-th output channel of the batch normalization layer, The original two-dimensional weights corresponding to the j-th output channel are: To integrate the convolutional biases of batch normalized layers, This is the original convolution bias. , These are the original learnable translation parameters and the original learnable scaling parameters of the batch normalized layer, respectively. , Let be the original operating mean and the original operating variance of the batch normalized layer, respectively. For numerical stability parameters, the subscript j represents the j-th output channel of the batch normalization layer, and the subscript i represents the ith transformable boundary.

[0013] Preferably, when the task to be inferred is an image with a size greater than a size threshold, the method further includes: the application node dividing the task to be inferred into multiple image blocks; and using a pipelined approach to sequentially perform edge-side front-end computation, boundary permutation scaling, uplink transmission, cloud-side continuous transform domain inference, downlink transmission, boundary inverse transform, and edge-side back-end computation on each image block.

[0014] A second aspect of this invention provides a U-shaped privacy inference system based on channel permutation and scaling, comprising: a supernode, a computing power node, and an application node; the supernode is used to divide the inference model into an input sub-model, an intermediate sub-model, and an output sub-model; the supernode is also used to sequentially perform channel permutation and channel scaling on the transformable boundaries in the intermediate sub-model, and to perform layer-by-layer equivalent reparameterization on the processed intermediate sub-model to offset the channel permutation-scaling transformation added to the input channel and to form the channel permutation-scaling transformation required for the output channel, and to deploy the layer-by-layer equivalent reparameterization intermediate sub-model on the computing power node; the supernode is also used to integrate the input sub-model, the output sub-model, and the pre-built permutation and scaling module. The inverse transformation module is deployed on the application node; the permutation scaling module is used to perform channel permutation scaling on the uplink tensor and then transmit it to the computing power node, where the uplink tensor is a feature generated by the input sub-model and used as input to the intermediate sub-model; the inverse transformation module is used to perform inverse transformation on the downlink tensor and then transmit it to the output sub-model, where the downlink tensor is a feature generated by the computing power node and used as input to the output sub-model; during the inference phase, the application node is used to receive the task to be inferred, and after inference by the computing power node, the inference result is output to the application node to obtain the inference result; the U-shaped privacy inference system based on channel permutation and scaling is used to implement the U-shaped privacy inference method based on channel permutation and scaling as described above.

[0015] A third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the U-shaped privacy inference method based on channel permutation and scaling as described above.

[0016] A fourth aspect of the present invention provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to execute the U-shaped privacy inference method based on channel permutation and scaling as described above.

[0017] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention provides a U-shaped privacy inference method and system based on channel permutation and scaling. Through joint transformation of channel permutation and channel-by-channel scaling, the intermediate features on the cloud side undergo simultaneous changes in channel identity and amplitude distribution, reducing the input recovery capability based on channel matching, feature statistical analysis, and gradient optimization. At the same time, combined with the U-shaped edge-cloud deployment method, the separation of model parameters, user data, and transformation relationships is achieved. This method can achieve lower communication overhead and stronger privacy protection capability of intermediate features while maintaining the inference function of convolutional neural networks. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of a U-shaped privacy inference method based on channel permutation and scaling provided in an embodiment of the present invention.

[0020] Figure 2 A block diagram of a U-shaped privacy inference system based on channel permutation and scaling provided in an embodiment of the present invention.

[0021] Figure 3 The original image provided for an embodiment of the present invention.

[0022] Figure 4 This is the result of an attack performed without channel permutation and scaling.

[0023] Figure 5 To introduce the image after channel displacement and scaling.

[0024] Figure 6 The attack results are obtained by introducing channel permutation and scaling and exploiting permutation invariance.

[0025] Figure 7 A block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0026] In view of the shortcomings of the prior art, the inventors of this invention, through long-term research and extensive practice, have proposed the technical solution of this invention. The following will further explain and illustrate this technical solution, its implementation process, and its principles.

[0027] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0028] Furthermore, in the description of this invention, it should be understood that the terms "upper," "lower," "inner," "outer," "horizontal," "vertical," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0029] In the description of this specification, the references to terms such as "an embodiment," "a particular embodiment," or "the embodiment" indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0030] Figure 1 A flowchart illustrating the U-shaped privacy inference method based on channel permutation and scaling provided in this embodiment of the invention. (See also...) Figure 1 , combined Figures 2-6 This method is described in detail and includes operations S100-S400.

[0031] Operation S100 divides the inference model into an input sub-model, an intermediate sub-model, and an output sub-model.

[0032] This partitioning method is called U-shaped partitioning. In this embodiment, both the input sub-model and the output sub-model are deployed on the application nodes on the user side, while the intermediate sub-model is deployed on the computing power nodes on the cloud side.

[0033] Operation S200 sequentially performs channel permutation and channel scaling on the transformable boundaries in the intermediate sub-model. The processed intermediate sub-model is then subjected to layer-by-layer equivalent reparameterization to offset the channel permutation-scaling transformation added to the input channel and form the channel permutation-scaling transformation required for the output channel. The intermediate sub-model after layer-by-layer equivalent reparameterization is then deployed on the computing power node.

[0034] The S200 operation is performed by a trusted supernode during the offline phase. The system, consisting of supernodes, computing nodes, and application nodes, is as follows: Figure 2As shown, the transformable boundary refers to the tensor interface for transferring features between layers within the intermediate sub-model. Channel permutation is used to shuffle the arrangement order of feature channels, and channel scaling is used to change the amplitude distribution of each channel; the combination of the two forms a joint transformation. However, if these transformation operations are explicitly performed during cloud-side inference, it will not only increase additional computational overhead but may also reduce security due to the exposure of transformation operators. Therefore, this embodiment adopts a layer-by-layer equivalent reparameterization technique to "absorb" the transformation operations into the weight parameters of the intermediate sub-model. Mathematically, for any layer operator in the intermediate sub-model, by adjusting its weight matrix and bias vector, the operator can directly output the corresponding "permutation-scaling" transformed output features when receiving input features that have undergone the "permutation-scaling" transformation, without needing to add any transformation layer outside the operator. In other words, the reparameterized intermediate sub-model is numerically equivalent to the original model, but its operating space has been migrated from the natural channel space to the transformation domain space. This approach achieves two key technical effects: First, the cloud-side inference process has no additional overhead, and the inference speed is consistent with the original model; second, the model parameters and intermediate features held by the cloud side are all in the transform domain. Even if an attacker obtains the cloud-side model weights and intermediate features, they will not be able to reconstruct the original network structure or input content due to the lack of the inverse transform key and the scrambled channel correspondences and amplitude statistics.

[0035] Operate S300 to deploy the input sub-model, output sub-model, pre-built permutation scaling module, and inverse transformation module on the application node. The permutation scaling module is used to perform channel permutation scaling on the uplink tensor and then transmit it to the computing power node. The uplink tensor is generated by the input sub-model and used as the input of the intermediate sub-model. The inverse transformation module is used to perform inverse transformation on the downlink tensor and then transmit it to the output sub-model. The downlink tensor is generated by the computing power node and used as the input of the output sub-model.

[0036] Specifically, the application node, as the holder of user data and the initiator of inference tasks, stores the "beginning and end" parts of the model and the transformation key. The permutation scaling module and the inverse transformation module are reversible operators built based on the transformation relationships generated in operation S200. During the deployment phase, the supernode sends the reparameterized intermediate sub-model to the computing power node, and simultaneously sends the input sub-model, output sub-model, and transformation modules (including the permutation scaling module and the inverse transformation module) to the application node. It should be noted that the computing power node only holds the reparameterized intermediate sub-model and does not hold any transformation key, original model parameters, or inverse transformation capabilities; while the application node holds the transformation key but does not hold the parameters of the intermediate sub-model. This mechanism of separating the storage of parameters and keys ensures that the overall privacy will not be leaked if a single node is compromised.

[0037] Operating S400, inference phase: Input the task to be inferred into the application node, and after inference by the computing power node, output the inference result to the application node to obtain the inference result.

[0038] Specifically, the online inference process forms a closed U-shaped data flow. First, the application node uses the input sub-model to perform pre-processing on the task to be inferred (such as images, speech, etc.), generating an uplink tensor in the natural channel space. Then, the permutation and scaling module performs channel permutation and scaling on this uplink tensor, converting it into transform domain features and uploading it to the computing node. Next, the computing node uses the reparameterized intermediate sub-model to perform inference calculations directly in the transform domain, generating a downlink tensor also in the transform domain and sending it back to the application node. Finally, the application node uses the inverse transform module to restore the downlink tensor to features in the natural channel space and sends it to the output sub-model for post-processing, obtaining the final inference result. Throughout the entire process, the computing node only processes data in the transform domain, never encountering the true features of the natural channel space, and never performing explicit encryption / decryption or transformation operations. This "transform domain native inference" mode ensures the numerical accuracy and equivalence of the end-to-end inference results while reducing the cloud's ability to recover user input using intermediate features.

[0039] like Figure 2 The image shows an application scenario for this method. Figure 2 The system shown includes supernodes, application nodes, and computing power nodes, and divides the inference process into an offline model generation stage and an online U-shaped inference stage. Supernodes are offline trusted nodes that possess the original convolutional neural network, the permutation relationships of each layer's channels, and the channel-wise scaling relationships. They are responsible for parsing the model computation graph, determining the front and rear segmentation points, generating transformation relationships, constructing the reparameterized cloud-side intermediate sub-model, and distributing corresponding components to the application nodes and computing power nodes. After deployment, supernodes do not participate in regular online inference. Application nodes are deployed on the user side or business side, holding the model input sub-model, output sub-model, permutation scaling module, and inverse transformation module. They are responsible for receiving the original image, performing front-end and back-end computations on the edge, and obtaining the final classification, detection, or segmentation results. Computing power nodes are deployed on the cloud side, only holding the intermediate sub-model that has undergone layer-wise equivalent reparameterization. They receive intermediate features in the permutation scaling domain and complete intermediate computations within this transformation domain, but do not possess the original model, original input, final output, or channel transformation relationships.

[0040] In a preferred embodiment, the transformable boundaries in the intermediate sub-model are sequentially subjected to channel permutation and channel scaling, specifically including: for each transformable boundary: constructing a permutation matrix based on the number of channels of the transformable boundary, the permutation matrix being an orthogonal matrix; generating corresponding scaling factors for each channel, the scaling factors being within a preset positive value range; combining the scaling factors to construct a diagonal matrix and using it as the scaling matrix; left-multiplying the permutation matrix by the scaling matrix to obtain the channel transformation matrix; and using the channel transformation matrix to perform channel permutation and scaling processing on the features in the channel space of the transformable boundary.

[0041] Specifically, this embodiment concretizes the abstract channel transformation operation into a rigorous mathematical construction to ensure the reversibility and numerical stability of the transformation. The permutation matrix P is a C×C square matrix generated based on the number of channels C of the current transformable boundary. It satisfies the orthogonality property, that is, each row and each column has only one element of 1, and the rest of the elements are 0, and satisfies the following... ( (The identity matrix is ​​used). This orthogonality ensures that the scrambling of channel positions is completely reversible. The inverse transformation only requires a transpose operation to restore the original channel order, without any additional storage or computational overhead.

[0042] Let the number of channels of the i-th transformable boundary in the convolutional neural network be... Channel numbers are 1 to Supernode pair channel index sequence Random permutations are generated using a random shuffling algorithm. For example, channels 1, 2, 3, 4 can be randomly rearranged into 3, 1, 4, 2. Then, based on random permutations... Constructing the permutation matrix If the transformed c-th channel comes from the original c-th channel... Each channel then makes The cth row, the The first column is 1, and the rest are 0. This results in a permutation matrix. Each row and each column has only one element that is 1. Because ,therefore .

[0043] Then, a positive scaling factor is generated for each channel. And construct a diagonal scaling matrix , This represents the diagonal matrix construction operator. The scaling factor here is restricted to a preset positive range, for example... Or other ranges set according to floating-point precision. Limiting the scaling factor to a positive value has the following advantages: On the one hand, positive scaling can maintain equivalent propagation with positive homogeneous operators widely used in convolutional neural networks, such as Reduced Linear Unit (ReLU), Leaky ReLU, and Max Pooling, avoiding abnormal activation function output due to sign flipping; on the other hand, the limitation of the preset range prevents numerical overflow caused by an excessively large scaling factor or underflow caused by an excessively small scaling factor, ensuring the numerical stability of inference in the transform domain.

[0044] The channel transformation matrix of the i-th transformable boundary for Its inverse matrix is For the characteristics of natural passage space The transformed features are In practical applications, this means that when transforming input features, the physical arrangement of channels is first changed using a permutation matrix, disrupting the fixed correspondence between channel position and semantic content; then, the amplitude of each channel is differentially scaled using a scaling matrix, disturbing the statistical distribution and norm information of the features. The permutation matrix ensures the invertibility of the channel mapping, and the scaling matrix changes the amplitude and norm of each channel. Together, they weaken the stable correspondence between cloud-side weights, feature amplitudes, and channel identities, decoupling the intermediate features observed by cloud-side computing nodes from the natural space in terms of channel identity and numerical distribution, significantly improving the resistance to reconstruction attacks.

[0045] As one implementation method, for multiple transformable boundaries that require residual addition, each transformable boundary uses the same permutation matrix and scaling matrix at the confluence position.

[0046] The residual addition operation requires that the two or more feature tensors involved in the operation have a strict semantic correspondence in the channel dimension. If different branches (transformable boundaries) use different permutation or scaling relationships, direct addition will lead to semantic confusion and destroy the original reasoning function of the model. Therefore, this embodiment stipulates that each branch uses the same combined channel transformation at the confluence position. Even using the same and To ensure consistency between the corresponding channels, the addition is performed.

[0047] As another implementation method, for multiple transformable boundaries that need to be spliced, the permutation matrix and scaling matrix of each transformable boundary are combined according to the channel interval occupied by each transformable boundary in the splicing result. The matrix after combining the permutation matrix is ​​multiplied by the matrix after combining the scaling matrix to obtain the overall transformation matrix.

[0048] Feature concatenation differs from element-wise addition; it joins multiple feature tensors end-to-end along the channel dimension. Specifically, for feature concatenation, each branch retains its own permutation matrix. and scaling matrix The permutation matrices are combined to form a diagonal matrix based on the channel intervals occupied by each branch in the splicing result. Let there be K branches in total, then the matrix formed by combining the permutation matrices... Matrix after scaling matrix combination They are respectively: ; ; For example, when the two branches have 2 and 3 channels respectively, , It only applies to the first two channels after splicing. , The overall transformation matrix after splicing only applies to the last three channels. This allows for the formation of an overall channel transformation while preserving the independent permutation and scaling relationships of each branch.

[0049] As one implementation method, for activation operators that do not satisfy the positive homogeneity property, in order to ensure that the original model structure and calculation process are not changed, channel scaling is not performed on the transformable boundary corresponding to the activation operator, that is, the scaling matrix is ​​made equal to the identity matrix, and only the channel permutation is retained.

[0050] As one implementation method, for multi-scale output, each scale is treated as an independent feature branch. Let the number of channels at the k-th scale be... Then generate respectively permutation matrix and scaling matrix And let the channel transformation matrix Each scale is calculated independently, maintaining its own transformation relationship; if subsequent fusion is performed by addition, the branches involved in the addition use the same combined channel transformation; if fusion is performed by splicing, the branches are combined in the above-mentioned block diagonal manner.

[0051] Let the original weights and biases of the i-th layer of the 2D convolution be respectively and If the number of input channels in this layer is The number of output channels is The kernel size is ,but The shape is , The shape is The combined channel transform of the input and output boundaries of this layer are respectively... and .

[0052] In a preferred embodiment, the equivalent reparameterization process for the two-dimensional convolutions in the processed intermediate sub-model is as follows: ; ; in, This represents the complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel after equivalent reparameterization; This represents the original complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel; This is the original output channel number corresponding to the j-th output channel; This is the original input channel number corresponding to the kth input channel; The scaling factor for the j-th output channel; This is the scaling factor for the k-th input channel; This is the bias of the j-th output channel after equivalent reparameterization; This is the original bias of the j-th output channel, where subscripts i and i-1 represent the i-th and (i-1)-th transformable boundaries, respectively.

[0053] In the above equivalent reparameterization processing method, the weight adjustment term Middle: denominator This is used to counteract the scaling transformation applied to the input features before they enter the convolutional layer, ensuring that the convolution operation is actually performed at the original numerical scale, thus guaranteeing the semantic correctness of feature extraction; molecule This is used to pre-apply the scaling transformation required for the next layer to the output of the convolutional layer, so that the output features naturally meet the transform domain input requirements of subsequent layers. Through this "cancel-and-form" mechanism, the scaling operation is completely absorbed into the convolutional weights. Cloud computing nodes only need to perform standard convolution operations when performing inference, without inserting any explicit scaling or permutation operators between layers, thus achieving zero additional inference overhead while protecting privacy. For the bias term... The adjustment, since the bias is only related to the output channel and does not participate in the multiplication of input features, only needs to be performed according to the permutation index of the output channel. Rearrange and multiply by the output-side scaling factor. That's it. After the above processing, when the computing node inputs... At that time, it can be obtained directly. Therefore, there is no need to restore the original channel order and channel amplitude between adjacent layers on the cloud side, nor is it necessary to add additional network operators.

[0054] It should be understood that although this embodiment uses standard two-dimensional convolution as an example for explanation, the above-mentioned reparameterization idea of ​​"canceling input transformation and forming output transformation" is also applicable to other convolution variants such as depthwise convolution, grouped convolution, or transposed convolution. It is only necessary to adapt the index mapping relationship accordingly based on the channel connection characteristics of each variant.

[0055] In a preferred embodiment, for the structure of a batch normalization layer following convolution in the processed intermediate sub-model, the equivalent reparameterization process specifically includes: fusing the parameters of the batch normalization layer to obtain convolution parameters; and performing two-dimensional convolution equivalent reparameterization on the convolution parameters. The method of performing two-dimensional convolution equivalent reparameterization on the convolution parameters is the same as the method of equivalent reparameterization described above, and will not be repeated here.

[0056] For a convolutional layer followed by a batch normalization (BN) layer, when generating the cloud-side model offline, the batch normalization layer is first fused into the preceding convolutional layer. In a preferred embodiment, the convolutional parameters obtained by fusing the parameters of the batch normalization layer are: ; ; in, To fuse the two-dimensional convolutional weights corresponding to the j-th output channel of the batch normalization layer, The original two-dimensional weights corresponding to the j-th output channel are: To integrate the convolutional biases of batch normalized layers, This is the original convolution bias. , These are the original learnable translation parameters and the original learnable scaling parameters of the batch normalized layer, respectively. , Let be the original operating mean and the original operating variance of the batch normalized layer, respectively. For numerical stability parameters, the subscript j represents the j-th output channel of the batch normalization layer, and the subscript i represents the ith transformable boundary.

[0057] In the formula , , , These are all inherent parameters learned or statistically obtained by the batch normalization layer during the training phase, and are completely independent of the channel-wise scaling factor generated in this invention for privacy protection. This independence design avoids coupling between the privacy protection mechanism and the model's original normalization mechanism, preventing numerical instability caused by parameter confusion, and allowing the batch normalization layer fusion step to reuse existing deep learning framework optimizers without retraining the model or adjusting the batch normalization layer statistics for privacy inference scenarios. After completing the above fusion, and Then, these parameters are substituted into the aforementioned two-dimensional convolution reparameterization formula as new original weights and biases to obtain the equivalent convolution parameters that are finally deployed on computing nodes, possessing both privacy protection capabilities and BN normalization functions. Through this step-by-step decoupling processing strategy, this application effectively solves the compatibility problem of privacy transformation and normalization layers coexisting in complex network structures, ensuring the usability and functional equivalence of U-shaped privacy inference in practical industrial-grade models.

[0058] For depthwise convolution, each input channel is connected to only one corresponding output channel; therefore, the input and output use the same channel permutation. If the transformed j-th channel corresponds to the original j-th channel... If there are multiple channels, the corresponding convolution kernel is adjusted to... The denominator cancels out the scaling already applied to the input side, while the numerator forms the scaling required for the output side.

[0059] For grouped convolutions, the number of groups is defined as G. Since there are no convolutional connections between different groups, permutations and scaling are restricted to within each group and the channel relationships cannot be changed across groups. , The permutation matrix corresponding to each group. and scaling matrix The convolution weights within each group are then rearranged and scaled using the same method as in ordinary convolution to form a permutation matrix for convolution within that group. and scaling matrix .

[0060] For transposed convolution, the processing principle is the same as that for ordinary convolution, except that because the positions of the input and output channel axes in the weight tensor are different, it is necessary to process them according to their actual channel axes: .

[0061] For residual addition, the branches involved in the addition use the same permutation scaling matrix at the merging point to ensure consistency between corresponding channels before direct addition. For feature concatenation, each branch retains its own permutation and scaling matrices and combines them into a concatenated overall transformation in a block-diagonal format. For structures such as Spatial Pyramid Pooling with Holes (ASPP), Feature Pyramid Network (FPN), Path Aggregation Network (PAN), and multi-scale detection heads, each scale maintains its own permutation and scaling matrices; when addition occurs, the same combined channel transformation is used, and when concatenation occurs, the aforementioned block-diagonal combination is used. Through this method, the computing node can always complete intermediate inference within the permutation-scaling domain.

[0062] The transformation module on the input side of the application node (the input sub-model and permutation-scaling module) is described as follows. The front segmentation boundary F and the rear segmentation boundary B are used to divide the complete inference model into an input sub-model, an intermediate sub-model and an output sub-model: the input sub-model is the 0th to Fth layers, the intermediate sub-model is the (F+1)th to Bth layers, and the output sub-model is the (B+1)th layer to the last layer of the model. Therefore, in a network numbered by layer, F < B needs to be satisfied to ensure that the intermediate sub-model on the cloud side is non-empty. For a computation graph with branches, F and B represent two segmentation boundaries, the former precedes the latter in the topological order.

[0063] The application node uses the input sub-model to calculate and obtain the output of the Fth layer and other tensors generated by the input sub-model that will serve as inputs to the intermediate sub-model. For a sequential network, the upstream tensor is usually the output of the Fth layer; for a network including residuals, skip connections, feature concatenation or multi-scale branches, the upstream tensor is the set of all tensors generated by the front segment on the end side and used by the intermediate sub-model on the cloud side. The application node performs a corresponding permutation-scaling transformation on each upstream tensor , and sends the transformed one or more intermediate features to the computing power node. Skip connection features generated by the front segment on the end side but only used by the rear segment on the end side are retained locally at the application node and are not uploaded to the computing power node.

[0064] The recovery module on the output side of the application node (the output sub-model and inverse transformation module) is described as follows. After the computing power node completes the calculation from the (F+1)th layer to the Bth layer, it sends the features generated on the cloud side that need to be continuously used by the output sub-model to the application node as downstream tensors. For a sequential network, the downstream tensor is usually the output of the Bth layer; for a network including skip connections, feature concatenation or multi-scale structures, it may also include other intermediate features generated on the cloud side and used by the output sub-model. Skip connection features generated by the input sub-model and subsequently used by the output sub-model are always stored locally at the application node and do not belong to downstream tensors. Therefore, the actual input of the output sub-model is composed of the downstream tensors from the cloud side and the locally cached features on the end side.

[0065] After receiving the downstream features in the permutation-scaling domain, the application node uses the inverse transformation relationship issued by the super node to restore their natural channel order and amplitude; for multiple downstream tensors, they are restored according to their respective inverse transformation relationships, and then input into the output sub-model together with the locally cached skip connection features to obtain the final inference result. Since both permutation and scaling are invertible transformations, and the parameters of the intermediate sub-model on the cloud side are equivalently re-parameterized according to the same relationship, the U-shaped inference result is consistent with the inference result of the original complete model without introducing quantization, pruning or numerical truncation.

[0066] In a preferred embodiment, when the inference task is an image with a size larger than a size threshold, the method further includes: the application node dividing the inference task into multiple image blocks; and using a pipelined approach to sequentially perform edge-side front-end computation, boundary permutation scaling, uplink transmission, cloud-side continuous transform domain inference, downlink transmission, boundary inverse transform, and edge-side back-end computation on each image block.

[0067] For ultra-large images such as remote sensing images, medical images, and industrial inspection images, application nodes divide the original image into multiple image blocks according to preset image block sizes and overlap widths. Each image block sequentially enters the edge-side front-end computation, boundary permutation and scaling, uplink transmission, cloud-side continuous transform domain inference, downlink transmission, boundary inverse transform, and edge-side back-end computation. The system sets up image block queues, uplink queues, and downlink queues, enabling the edge-side front-end, cloud-side intermediate inference, and edge-side back-end processes of different image blocks to be executed in parallel and overlapped. When the current image block is being computed on the computing node, the application node can simultaneously process the front-end of the next image block; when the current image block enters the edge-side back-end, the computing node can continue processing other image blocks in the intermediate queue, thereby improving the overall image inference throughput.

[0068] For semantic segmentation tasks, the application node backfills the results of each image patch according to the original image coordinates, and performs averaging or weighted fusion on overlapping regions. For object detection tasks, after mapping the detection boxes within the patch to the original image coordinates, duplicate detection boxes are removed based on confidence and overlap. For classification tasks, the prediction results of each image patch are averaged, weighted, or aggregated by voting. All of the above post-processing processes can be implemented using methods already available in the field, and this invention does not limit the specific post-processing algorithm. Throughout the entire process, the computing node only accesses the intermediate features of the image patches in the permutation-scaling domain.

[0069] In this pipeline architecture, the data flow always flows between nodes in the form of "transform domain features". The computing nodes are neither aware of the spatial coordinates of the image patch in the original image, nor can they know which original image the currently processed feature belongs to. This decoupling of spatiotemporal information further enhances the ability to resist traffic analysis and side-channel attacks, and achieves the organic unity of high-performance computing and strong privacy protection.

[0070] This paper will explain in detail using a remote sensing image privacy inference scenario as an example. In this scenario, the task to be inferred is, for example, a high-resolution satellite remote sensing image, involving sensitive land feature segmentation tasks such as farmland classification, river extraction, or building identification. Figure 3 As shown. This invention conducts attack experiments at Layer 3 on the unprotected model, the channel permutation-only model, and the combined channel permutation and scaling protection model of DeepLab v3+. For example... Figure 4 As shown, it illustrates the result reconstructed from intermediate features on the cloud side by an attacker when the channel permutation and scaling protection mechanism of this invention is not employed. It is clear that... Figure 4 In the reconstructed image, the course of the river, the boundaries of the fields, and the outlines of the buildings are all clearly discernible. This indicates that even though a U-shaped segmentation was used to avoid direct uploading of the original image, the intermediate features in the natural channel space still retain sufficient semantic information to reconstruct the original input, posing a serious risk of privacy leakage. (See also...) Figure 5 and Figure 6 The paper illustrates the attack results after applying this method. When the joint protection mechanism based on channel permutation and scaling provided by this invention is used, the attacker reconstructs the intermediate features of the cloud side using the same gradient optimization algorithm. The resulting texture is completely disordered random noise, without any recognizable ground feature outlines or spatial structures. Experimental results show that without the protection mechanism, the attacker can recover a relatively obvious input structure using the gradient optimization method; however, after adding channel permutation and scaling, the channel correspondence and amplitude statistics of the intermediate features are destroyed, and the reconstruction results are significantly degraded.

[0071] Furthermore, for typical convolutional neural networks such as DeepLabV3+, ResNet50, YOLOv8, YOLO11, and U-Net, the U-shaped segmentation scheme with better overall performance was selected for testing. The proportion of edge parameters, the proportion of edge computation, communication overhead, and transmission latency were statistically analyzed. The test results are as follows.

[0072] On DeepLabV3+: Layers 3-9 are used as intermediate sub-models between U-shaped partitions and deployed on computing nodes; edge-side parameters account for 5.79%; edge-side computation accounts for 30.25%; total communication (compared to the original image) is 3.00 times, inference accuracy is 99.9221%, and pipeline speedup is 1.661. On ResNet50: Layers 3-6 are used as intermediate sub-models between U-shaped partitions and deployed on computing nodes; edge-side parameters account for 13.67%; edge-side computation accounts for 44.38%; total communication (compared to the original image) is 2.67 times, inference accuracy is 100%, and pipeline speedup is 1.061. On YOLOv8: Layers 3-21 are used as intermediate sub-models between U-shaped partitions deployed on computing nodes; edge-side parameters account for 29.42%; edge-side computation accounts for 52.08%; total communication (compared to the original image) is 0.92 times, inference accuracy is 100%, and pipeline speedup is 2.48. On YOLOv11: Layers 3-22 are used as intermediate sub-models between U-shaped partitions deployed on computing nodes; edge-side parameters account for 19.58%; edge-side computation accounts for 46.46%; total communication (compared to the original image) is 0.92 times, inference accuracy is 100%, and pipeline speedup is 2.46. On U-Net: Layers 5 to 17 are used as intermediate sub-models between U-shaped partitions and deployed on computing nodes; edge parameters account for 10.55%; edge computation accounts for 45.2%; total communication (compared to the original image) is 8.00 times, inference accuracy is 100%, and pipeline speedup is 1.425.

[0073] Experimental results show that this invention can select appropriate U-shaped partitioning positions based on the characteristics of different network structures. For ResNet50 and DeepLabV3+, a large number of computational tasks are migrated to the cloud; for YOLO series networks, high inference efficiency is achieved while maintaining low communication overhead; for networks with skip connections such as U-Net, fine-grained computation graph partitioning can reduce high-resolution feature transmission overhead.

[0074] Based on the same inventive concept, and corresponding to any of the above embodiments, this invention also provides a U-shaped privacy inference system based on channel permutation and scaling, comprising: a supernode, a computing power node, and an application node, such as... Figure 2 As shown.

[0075] Supernodes are used to divide the inference model into input sub-models, intermediate sub-models, and output sub-models. Supernodes also perform channel permutation and scaling on the transformable boundaries in the intermediate sub-models, and then perform layer-by-layer equivalent reparameterization on the processed intermediate sub-models to offset the channel permutation-scaling transformation added to the input channels and form the channel permutation-scaling transformation required for the output channels. The layer-by-layer equivalent reparameterization intermediate sub-models are then deployed on the computing power nodes. Supernodes also deploy the input sub-model, output sub-model, pre-built permutation-scaling module, and inverse transformation module on the application nodes. The permutation-scaling module performs channel permutation-scaling on the uplink tensor before transmitting it to the computing power nodes; the uplink tensor is a feature generated by the input sub-model and used as input to the intermediate sub-model. The inverse transformation module performs inverse transformation on the downlink tensor before transmitting it to the output sub-model; the downlink tensor is a feature generated by the computing power nodes and used as input to the output sub-model. During the inference phase, the application nodes receive the inference task, perform inference on the computing power nodes, and then output the inference result to the application nodes, thus obtaining the inference result.

[0076] The U-shaped privacy inference system based on channel permutation and scaling is used to implement the U-shaped privacy inference method based on channel permutation and scaling as described in any of the above embodiments.

[0077] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the U-shaped privacy inference method based on channel permutation and scaling as described in any of the above embodiments.

[0078] Figure 7 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 710, a memory 720, an input / output interface 730, a communication interface 740, and a bus 750. The processor 710, memory 720, input / output interface 730, and communication interface 740 are interconnected internally via the bus 750.

[0079] The processor 710 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0080] The memory 720 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 720 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 720 and is called and executed by the processor 710.

[0081] The input / output interface 730 is used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0082] The communication interface 740 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.).

[0083] Bus 750 includes a pathway for transmitting information between various components of the device, such as processor 710, memory 720, input / output interface 730, and communication interface 740.

[0084] It should be noted that although the above-described device only shows the processor 710, memory 720, input / output interface 730, communication interface 740, and bus 750, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0085] The electronic devices described in the above embodiments are used to implement the U-shaped privacy inference method based on channel permutation and scaling as described in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0086] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, the present invention also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the U-shaped privacy inference method based on channel permutation and scaling as described in any of the above embodiments.

[0087] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic tape, disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0088] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the U-shaped privacy inference method based on channel permutation and scaling as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0089] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of the invention (including the claims) is limited to these examples; within the framework of the invention, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of the invention as described above, which are not provided in the details for the sake of brevity.

[0090] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of the invention, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of the invention, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of the invention will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of the invention, it will be apparent to those skilled in the art that the embodiments of the invention may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0091] Although the invention has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0092] It should be understood that the above embodiments are merely illustrative of the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent changes or modifications made in accordance with the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A U-shaped privacy inference method based on channel permutation and scaling, characterized in that, include: The inference model is divided into an input sub-model, an intermediate sub-model, and an output sub-model. The transformable boundaries in the intermediate sub-model are sequentially subjected to channel permutation and channel scaling. The processed intermediate sub-model is then subjected to layer-by-layer equivalent reparameterization to offset the channel permutation-scaling transformation added to the input channel and to form the channel permutation-scaling transformation required for the output channel. The intermediate sub-model after layer-by-layer equivalent reparameterization is then deployed on the computing power node. The input sub-model, the output sub-model, the pre-built permutation scaling module, and the inverse transformation module are deployed on the application node. The permutation scaling module is used to perform channel permutation scaling on the uplink tensor and then transmit it to the computing power node. The uplink tensor is a feature generated by the input sub-model and used as the input of the intermediate sub-model. The inverse transformation module is used to perform inverse transformation on the downlink tensor and then transmit it to the output sub-model. The downlink tensor is a feature generated by the computing power node and used as the input of the output sub-model. Inference phase: The task to be inferred is input into the application node, and after inference by the computing power node, the inference result is output to the application node to obtain the inference result.

2. The U-shaped privacy inference method based on channel permutation and scaling according to claim 1, characterized in that, The transformable boundaries in the intermediate sub-model are sequentially subjected to channel permutation and channel scaling, specifically including: For each transformable boundary: construct a permutation matrix based on the number of channels of the transformable boundary, the permutation matrix being an orthogonal matrix; generate a corresponding scaling factor for each channel, the scaling factor being within a preset positive value range; combine the scaling factors to construct a diagonal matrix and use it as the scaling matrix; multiply the permutation matrix on the left by the scaling matrix to obtain the channel transformation matrix; use the channel transformation matrix to perform channel permutation scaling on the features in the channel space of the transformable boundary.

3. The U-shaped privacy inference method based on channel permutation and scaling according to claim 2, characterized in that, For multiple transformable boundaries that require residual addition, the same permutation matrix and scaling matrix are used at the confluence of the transformable boundaries; And / or, for multiple transformable boundaries that need to be feature-stitched, according to the channel interval occupied by each transformable boundary in the stitching result, the permutation matrix and scaling matrix of each transformable boundary are combined respectively, and the matrix after combining the permutation matrix is ​​multiplied by the matrix after combining the scaling matrix to obtain the overall transformation matrix.

4. The U-shaped privacy inference method based on channel permutation and scaling according to claim 1, characterized in that, For the 2D convolutions in the processed intermediate sub-model, the equivalent reparameterization process is as follows: ； ； in, This represents the complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel after equivalent reparameterization; This represents the original complete two-dimensional convolution kernel between the k-th input channel and the j-th output channel; This is the original output channel number corresponding to the j-th output channel; This is the original input channel number corresponding to the kth input channel; The scaling factor for the j-th output channel; This is the scaling factor for the k-th input channel; This is the bias of the j-th output channel after equivalent reparameterization; This is the original bias of the j-th output channel, where subscripts i and i-1 represent the i-th and (i-1)-th transformable boundaries, respectively.

5. The U-shaped privacy inference method based on channel permutation and scaling according to claim 1 or 4, characterized in that, For the structure of the batch normalization layer following the convolution in the processed intermediate sub-model, the equivalent reparameterization process specifically includes: The parameters of the batch normalized layer are fused to obtain the convolution parameters; The convolution parameters are subjected to two-dimensional convolution equivalent reparameterization.

6. The U-shaped privacy inference method based on channel permutation and scaling according to claim 5, characterized in that, The convolution parameters are: ； ； in, To fuse the two-dimensional convolutional weights corresponding to the j-th output channel of the batch normalization layer, The original two-dimensional weights corresponding to the j-th output channel are: To integrate the convolutional biases of batch normalized layers, This is the original convolution bias. , These are the original learnable translation parameters and the original learnable scaling parameters of the batch normalized layer, respectively. , Let be the original operating mean and the original operating variance of the batch normalized layer, respectively. For numerical stability parameters, the subscript j represents the j-th output channel of the batch normalization layer, and the subscript i represents the ith transformable boundary.

7. The U-shaped privacy inference method based on channel permutation and scaling according to claim 1, characterized in that, When the task to be inferred is an image with a size larger than a size threshold, the method further includes: The application node divides the task to be reasoned into multiple image blocks; A pipeline approach is used to sequentially perform front-end computation, boundary permutation and scaling, uplink transmission, cloud-side continuous transform domain inference, downlink transmission, boundary inverse transform, and back-end computation on each image block.

8. A U-shaped privacy inference system based on channel permutation and scaling, characterized in that, include: Supernodes, computing nodes, and application nodes; The supernode is used to divide the inference model into an input sub-model, an intermediate sub-model, and an output sub-model. The supernode is also used to sequentially perform channel permutation and channel scaling on the transformable boundaries in the intermediate sub-model, and to perform layer-by-layer equivalent reparameterization on the processed intermediate sub-model to offset the channel permutation-scaling transformation added to the input channel and to form the channel permutation-scaling transformation required for the output channel, and to deploy the intermediate sub-model after layer-by-layer equivalent reparameterization on the computing power node. The supernode is also used to deploy the input sub-model, the output sub-model, the pre-built permutation scaling module, and the inverse transformation module on the application node; the permutation scaling module is used to perform channel permutation scaling on the uplink tensor and then transmit it to the computing power node, the uplink tensor being a feature generated by the input sub-model and used as input to the intermediate sub-model; the inverse transformation module is used to perform inverse transformation on the downlink tensor and then transmit it to the output sub-model, the downlink tensor being a feature generated by the computing power node and used as input to the output sub-model; During the inference phase, the application node receives the task to be inferred, and after inference by the computing power node, outputs the inference result to the application node to obtain the inference result. The U-shaped privacy inference system based on channel permutation and scaling is used to implement the U-shaped privacy inference method based on channel permutation and scaling as described in any one of claims 1-7.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the U-shaped privacy inference method based on channel permutation and scaling as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to execute the U-shaped privacy inference method based on channel permutation and scaling as described in any one of claims 1-7.

Images