Neural network model encryption method and apparatus, neural network model decryption method and apparatus, device, and medium

Abstract

The present application relates to the technical field of deep learning, and in particular to a neural network model encryption method and apparatus, a neural network model decryption method and apparatus, a device, and a medium, for use in providing a solution for improving the ability to resist various attacks without affecting the model calculation accuracy. According to embodiments of the present application, the neural network model encryption method comprises: using service data to train a neural network to be trained, so as to obtain a target neural network meeting the service requirements; in response to a model acquisition request of a target object, classifying a plurality of layers in a target neural network model into at least one group; combining weight matrixes of a plurality of layers in any group to obtain a weight sequence; on the basis of an encryption operation rule, performing at least one nonlinear iterative operation on original position coordinates of each parameter in the weight sequence to obtain an encryption position corresponding to each parameter; and distributing each parameter to a corresponding encryption position to obtain an encrypted target neural network model, and sending the encrypted target neural network to the target object.

Description

Neural network model encryption method, decryption method, device, equipment and medium

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the Intellectual Property Office of the People's Republic of China on July 6, 2023, with application number 202310828013.7 and application name "Neural Network Model Encryption Method, Decryption Method, Device, Equipment and Medium", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of deep learning technology, and in particular to neural network model encryption methods, decryption methods, devices, equipment and media. Background Art

[0004] Neural network models based on deep learning technology are a hot topic in current research. However, in actual applications, neural network models are easily attacked or tampered with, resulting in damage to the rights and interests of initial developers.

[0005] Related technologies typically protect neural network models by adding backdoors or digital watermarks to their structure or parameters. However, these methods are primarily used to verify ownership after the fact or assert rights during use. They are unable to prevent infringers from illegally using the model and lack reliable protection against various model-based attacks. Furthermore, since these methods often require modifications to the training process or model structure of the neural network model, in addition to incurring additional costs, they can also affect the subsequent inference accuracy of the neural network model.

[0006] Summary of the Invention

[0007] The present application provides a neural network model encryption method, decryption method, device, equipment and medium for improving the effectiveness of the neural network model in resisting various attacks without affecting its reasoning accuracy.

[0008] In a first aspect, an embodiment of the present application provides a method for encrypting a neural network model, the method comprising:

[0009] Obtain business data, and use the above business data to train the neural network to obtain a target neural network that meets business needs;

[0010] In response to a model acquisition request of a target object, dividing a plurality of layers in the target neural network model into at least one group;

[0011] For any group, the weight matrices of multiple layers in the group are merged to obtain a weight sequence;

[0012] For each parameter in the weight sequence, based on the encryption operation rules, perform at least one nonlinear iterative operation on the original position coordinates of the parameter to obtain the encrypted position corresponding to each parameter;

[0013] Distribute each parameter in the above weight sequence to the corresponding encrypted position to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0014] In one possible implementation, the weight matrices of multiple layers within the above group are merged to obtain a weight sequence, including:

[0015] For any layer in the above group, based on the preset rules, the weight matrix of any layer is subjected to dimensionality reduction processing to obtain the corresponding processing result;

[0016] The processing results corresponding to each layer in the above group are merged to obtain the above weight sequence.

[0017] In a possible implementation, performing at least one nonlinear iterative operation on the original position coordinates of the parameters based on the encryption operation rule includes:

[0018] Determine a target cube corresponding to the weight matrix, where the target cube is the smallest cube that can accommodate all parameters in the weight matrix;

[0019] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates in the above target cube;

[0020] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameter mapping.

[0021] In one possible implementation, the following operations are performed in each nonlinear iterative operation:

[0022] Taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining the corresponding first operation value based on the nonlinear function corresponding to the above encryption operation rule;

[0023] Using a weighting matrix corresponding to the encryption operation rule, weighting the position coordinates obtained after the last nonlinear iterative operation to obtain a corresponding second operation value; wherein the determinant of the weighting matrix is ​​coprime with the preset parameter;

[0024] A modulo operation is performed on the sum of the first operation value and the second operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0025] In a possible implementation, the preset parameter is the side length of the target cube.

[0026] In a possible implementation, before sending the encrypted target neural network to the target object, the method further includes:

[0027] Obtaining a set of parameters to be encrypted of the target neural network model, wherein the set of parameters to be encrypted includes a plurality of parameters to be encrypted;

[0028] Encrypting each of the parameters to be encrypted based on the encryption factor;

[0029] The encryption factor is determined as follows:

[0030] Based on the target chaotic mapping parameters, the preset initial value is subjected to chaotic mapping at least once to obtain the corresponding encryption factor.

[0031] In a second aspect, an embodiment of the present application provides a neural network model decryption method, the method comprising:

[0032] Responding to a processing request of a target business, obtaining an encrypted target neural network model;

[0033] Determine the weight sequence in the encrypted target network model, and determine the encryption position corresponding to each parameter in each weight sequence;

[0034] For each parameter in the weight sequence, based on the decryption operation rules, perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameter to obtain the original position of each parameter;

[0035] For each weight sequence, distribute the parameters in the weight sequence to the corresponding original position coordinates, and restore the weight sequence to the weight matrix of multiple layers;

[0036] Based on the weight matrix corresponding to each layer, the decrypted target network model is determined, and the decrypted target network model is used to process the above target business.

[0037] In a possible implementation, the encrypted position coordinates corresponding to the parameters are subjected to at least one nonlinear iterative operation based on the decryption operation rules to obtain the original position of each parameter, including:

[0038] Based on the decryption operation rules, perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the above parameters to obtain candidate positions of each parameter;

[0039] Based on the candidate positions of each parameter and the corresponding relationship between the candidate positions and the original positions, the original position of each parameter is determined.

[0040] In one possible implementation, the following operations are performed in each nonlinear iterative operation:

[0041] Taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining a corresponding third operation value based on a nonlinear function corresponding to the above decryption operation rule;

[0042] The third operation value is weighted using a weighting matrix corresponding to the decryption operation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter;

[0043] A modulo operation is performed on the weighted result of the third operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0044] In a possible implementation, the candidate position is the position corresponding to the parameter in the target cube, the target cube is the smallest cube that can accommodate all parameters in the weight matrix, and the preset parameter is the side length of the target cube.

[0045] In a possible implementation, before processing the target service using the decrypted target network model, the method further includes:

[0046] Obtaining preset initial values, target chaotic mapping parameters, and encryption factors;

[0047] Based on the target chaotic mapping parameters, perform chaotic mapping on the preset initial value at least once to obtain the corresponding factor to be verified;

[0048] If the difference between the factor to be verified and the encryption factor is smaller than a preset threshold, the encryption factor is used to decrypt the parameters in the target network model.

[0049] In a third aspect, an embodiment of the present application provides a neural network model encryption device, the device comprising:

[0050] The first acquisition module is used to acquire business data and use the business data to train the neural network to obtain a target neural network that meets business requirements;

[0051] a grouping module, configured to divide the multiple layers in the target neural network model into at least one group in response to a model acquisition request of the target object;

[0052] A merging module is used to merge the weight matrices of multiple layers in any group to obtain a weight sequence;

[0053] A first operation module is configured to perform at least one nonlinear iterative operation on the original position coordinates of each parameter in the weight sequence based on an encryption operation rule to obtain an encrypted position corresponding to each parameter;

[0054] The sending module is used to distribute the parameters in the above-mentioned weight sequence to the corresponding encrypted positions, obtain the encrypted target neural network model, and send the encrypted target neural network to the above-mentioned target object.

[0055] In a fourth aspect, an embodiment of the present application provides a neural network model decryption device, the device comprising:

[0056] A second acquisition module is used to obtain the encrypted target neural network model in response to a processing request of the target business;

[0057] A determination module is used to determine the weight sequence in the encrypted target network model and determine the encryption position corresponding to each parameter in each weight sequence;

[0058] A second operation module is configured to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to each parameter in the weight sequence based on a decryption operation rule to obtain the original position of each parameter;

[0059] A restoration module is used to distribute each parameter in the weight sequence to the corresponding original position coordinates for each weight sequence, and restore the weight sequence to a weight matrix of multiple layers;

[0060] The processing module is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and use the decrypted target network model to process the above target business.

[0061] In a fifth aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements any step of the method described in the first or second aspect when executing the computer program.

[0062] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement any of the steps described in the first or second aspect above.

[0063] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer program, which is stored in a computer-readable storage medium; when the processor of the memory access device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the memory access device performs any step described in the first or second aspect above.

[0064] The technical solutions provided by the embodiments of this application bring at least the following beneficial effects:

[0065] First, the neural network model is trained, and then encrypted after the training is completed. This separates the model training and encryption processes without affecting the calculation accuracy of the model during subsequent use. When encrypting the model, the layers are split and the matrices are merged first, and then the positions of the parameters in the model are nonlinearly iteratively encrypted based on the preset encryption operation rules, which improves the model's ability to resist various attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0067] FIG1 is a flow chart of a neural network model encryption method provided in an embodiment of the present application;

[0068] FIG2 is a flow chart of a neural network model decryption method provided in an embodiment of the present application;

[0069] FIG3 is a flow chart of a possible neural network model encryption process provided in an embodiment of the present application;

[0070] FIG4 is a flow chart of a possible neural network model decryption process provided in an embodiment of the present application;

[0071] FIG5 is a schematic diagram of a neural network model encryption device provided in an embodiment of the present application;

[0072] FIG6 is a schematic diagram of a neural network model decryption device provided in an embodiment of the present application;

[0073] FIG7 is a schematic diagram of an electronic device provided in an embodiment of the present application;

[0074] FIG8 is a schematic diagram of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] In order to make the purpose, technical solutions and advantages of this application clearer, this application will be further described in detail below with reference to the accompanying drawings.

[0076] The application scenarios described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Persons skilled in the art will appreciate that, as new application scenarios emerge, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0077] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0078] Neural network models based on deep learning technology are a hot topic in current research. However, in actual applications, neural network models are easily attacked or tampered with, resulting in damage to the rights and interests of initial developers.

[0079] Related technologies typically protect neural network models by adding backdoors or digital watermarks to their structure or parameters. However, these methods are primarily used to verify ownership after the fact or assert rights during use. They are unable to prevent infringers from illegally using the model and lack reliable protection against various model-based attacks. Furthermore, since these methods often require modifications to the training process or model structure of the neural network model, in addition to incurring additional costs, they can also affect the subsequent inference accuracy of the neural network model.

[0080] Based on the above problems, an embodiment of the present application provides a neural network model encryption and decryption method, which trains the neural network model to be trained based on business data, groups and merges the trained target neural network models to obtain a weight sequence, and then encrypts the position of each parameter in the weight sequence, that is, encrypts the topology of the neural network model, thereby improving the ability to resist various attacks without affecting the calculation accuracy of the model.

[0081] FIG1 is a flow chart of a neural network model encryption method provided in an embodiment of the present application. The encryption process of the neural network model in the embodiment of the present application is described in detail below with reference to FIG1. ​​As shown in FIG1, the neural network model encryption method provided in the embodiment of the present application specifically includes the following steps:

[0082] Step S101: Acquire business data, and use the business data to train the neural network to obtain a target neural network that meets business requirements;

[0083] In some embodiments, the embodiments of the present application train the neural network model to be trained based on business data to obtain a target neural network that meets business requirements, and then encrypt the target neural network model. This process separates the gradient update process of the neural network model (i.e., the model training process) and the model encryption process.

[0084] Step S102, in response to a model acquisition request of a target object, dividing multiple layers in a target neural network model into at least one group;

[0085] In some embodiments, the above-mentioned division of multiple layers in the target neural network model into at least one group includes two situations: treating multiple layers in the target neural network model as one group, and dividing multiple layers in the target neural network model into multiple groups; the embodiment of the present application does not limit the division rules of multiple layers in the above-mentioned target neural network. In actual implementation, it can be set based on specific models and environmental requirements. For example, the neural network deployed on the end side generally has a small number of parameters and can be set to not be segmented.

[0086] In some embodiments, different parameters are used in the encryption process of each of the above groups.

[0087] Step S103: for any group, merging the weight matrices of multiple layers in the group to obtain a weight sequence;

[0088] In some embodiments, the weight matrices of multiple layers within a group are merged to obtain a weight sequence, which specifically includes the following steps:

[0089] For any layer in the group, based on the preset rules, the weight matrix of any layer is reduced in dimension to obtain the corresponding processing result; the corresponding processing results of each layer in the group are merged to obtain the weight sequence.

[0090] In specific implementations, the weight matrix of each layer is processed using the flatten function to obtain a corresponding one-dimensional matrix for each layer. These one-dimensional matrices are then concatenated to form the weight sequence. The flatten function is an array flattening function that flattens a multidimensional array and returns a one-dimensional array. During implementation, the position of each parameter in the weight matrix at the corresponding layer and within the corresponding layer's weight matrix is ​​recorded to facilitate position restoration during subsequent model decryption.

[0091] Step S104: for each parameter in the weight sequence, based on the encryption operation rules, perform at least one nonlinear iterative operation on the original position coordinates of the parameter to obtain the encrypted position corresponding to each parameter;

[0092] In a specific implementation, the number of times the nonlinear iterative operation is performed may be determined based on the specific model and environment, and is not limited in the embodiments of the present application. In some embodiments, the following operations are performed in each nonlinear iterative operation:

[0093] The position coordinates obtained after the previous nonlinear iterative operation are used as input, and a corresponding first operation value is determined based on a nonlinear function corresponding to the encryption operation rule. It should be noted that if only one nonlinear iterative operation is performed, the position coordinates obtained after the previous nonlinear iterative operation are the initial position coordinates of the parameters. In the embodiments of the present application, the above nonlinear function is not limited.

[0094] Using a weighting matrix corresponding to the encryption operation rule, weighting the position coordinates obtained after the last nonlinear iterative operation to obtain a corresponding second operation value; wherein the determinant of the weighting matrix is ​​coprime with the preset parameter;

[0095] A modulo operation (ie, a modulo operation) is performed on the sum of the first operation value and the second operation value and a preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0096] In one possible implementation, the encryption operation rule may be an Arnold mapping. The Arnold mapping is a chaotic mapping from a torus to itself, which has multiple properties such as reversibility, area preservation, and topological transferability. In the embodiment of the present application, a nonlinear part is introduced into the original Arnold mapping to increase the difficulty of mathematical solution and the ability to resist various attacks. Specifically, the recursive formula of the nonlinear Arnold mapping may be:

[0097] Wherein, k is an integer. When k is 0, the above is the initial position coordinate of the parameter, when k is not 0, the above is the position coordinate output by the k-th recursion, is the position coordinate of the k+1th output, N is the preset parameter, and the above recursive formula meets the following requirements: 1) Matrix When , gcd(detC, N) = 1, where the gcd() function is used to find the greatest common divisor, gcd(detC, N) = 1 indicates that detC and N are coprime, and detC represents the determinant of matrix C; 2) a, b, c…j, s are all integers, with no numerical restrictions; 3) The nonlinear components G1 and G2 are nonlinear functions, which can be polynomial, exponential, or other nonlinear functions. It can be shown that the nonlinear component prevents the Arnold mapping from using tensor scrambling encryption with traditional linear cryptographic properties, providing a certain degree of resistance to differential attacks. Furthermore, even with the introduction of the nonlinear component, the Arnold mapping transformation remains reversible, one-to-one, and can be subsequently decrypted.

[0098] In other embodiments, the above-mentioned encryption operation rule is based on which at least one nonlinear iterative operation is performed on the original position coordinates of the parameter, specifically including the following steps:

[0099] Determine the target cube corresponding to the weight matrix; the target cube is the smallest cube that can accommodate all the parameters in the weight matrix. Specifically, assuming that the number of parameters included in the weight matrix is ​​Q, the side length size of the target cube can be determined based on the following formula:

[0100] According to the preset mapping rules, the original position coordinates of the parameters are mapped to the corresponding position coordinates in the target cube; specifically, in the embodiment of the present application, there is no restriction on the specific content of the above-mentioned preset mapping rules; for example, the above-mentioned mapping rules can be mapped in sequence to the positions corresponding to the arrangement order of the parameters in the weight matrix in the target cube, for example, the parameter ranked first in the weight matrix is ​​mapped to the first position in the target cube.

[0101] Based on the encryption operation rules, perform at least one nonlinear iterative operation on the position coordinates after parameter mapping; specifically, if the number of parameters that the target cube can accommodate is greater than the number of parameters in the weight matrix, that is, size 3 >Q, then padding is performed on the excess positions of the target cube, filling them with useless values. At the same time, the position of each parameter in the weight matrix and its position within the target cube are recorded for use in subsequent model decryption. The process of the above nonlinear iterative operation can be found in the previous description and will not be repeated here.

[0102] In some embodiments, the preset parameter used in the nonlinear iterative operation is the side length of the target cube.

[0103] Step S105: distribute each parameter in the weight sequence to the corresponding encrypted position to obtain the encrypted target neural network model, and send the encrypted target neural network to the target object.

[0104] The above method first trains the neural network model and then encrypts the neural network model after the training is completed, separating the model training and encryption processes without affecting the calculation accuracy of the model during subsequent use. When encrypting the model, the layers are first split and the matrices are merged, and then the positions of the parameters in the model are nonlinearly iteratively encrypted based on the preset encryption operation rules, thereby improving the model's ability to resist various attacks.

[0105] As an optional implementation, in the process of encrypting the above-mentioned neural network model, the parameters of the target neural network are also encrypted. The parameters can be any type of parameters in the neural network model, such as weight parameters. This process can occur in any process between responding to the model acquisition request of the target object and sending the encrypted target neural network to the target object. In a specific implementation, encrypting the parameters specifically includes the following steps:

[0106] Obtain a set of parameters to be encrypted of a target neural network model; wherein the set of parameters to be encrypted includes multiple parameters to be encrypted; in a specific implementation, the selection of parameters to be encrypted may depend on the specific model and environment. For example, a neural network model deployed on the terminal side generally has a small number of parameters, and all parameters may be determined as parameters to be encrypted; in a model with a large number of parameters, parameters with a higher degree of activation (such as greater than a preset threshold) in the target neural network model may be selected as parameters to be encrypted.

[0107] Each parameter to be encrypted in the parameters to be encrypted is encrypted based on an encryption factor; the encryption factor is determined by performing chaotic mapping on a preset initial value at least once based on a target chaotic mapping parameter to obtain a corresponding encryption factor. It should be noted that the encryption factors used when encrypting each parameter to be encrypted in the parameters to be encrypted can be the same or different. The number of times the chaotic mapping is performed can be determined based on the specific model and environment and is not limited in this embodiment of the application.

[0108] In a specific implementation, the process of encrypting each of the parameters to be encrypted based on the encryption factor includes, but is not limited to, performing operations such as addition, subtraction, multiplication, and division on the parameter to be encrypted and the corresponding encryption factor to obtain the corresponding encryption parameter. In some embodiments, the target chaotic map can be any continuous chaotic map, such as a logistic chaotic map.

[0109] The Logistic Chaos Map is a quadratic polynomial mapping (recursive relation) and a classic example of chaos generated by simple nonlinear equations. Its properties include: 1) nonlinearity; 2) sensitive dependence on initial values; 3) overall stability and local instability; 4) long-term unpredictability. Its recursive formula is as follows: j+1 =r(1-x j ),x0∈[0,1],

[0110]

[0111] In the above formula, x0 is the preset initial value, r is a parameter whose value can be set based on demand, and x j is the result of the j-th recursion, x j+1 is the result of the j+1th recursion.

[0112] The following uses the Logistic chaotic map as an example to illustrate the process of determining the encryption factor:

[0113] First, set the preset initial value x0, the number of iterations q and the parameter r; then, perform k calculations based on the above recursive formula to obtain the encryption factor x k In the specific implementation, operations such as expansion can be added as appropriate.

[0114] At the same time, to facilitate subsequent decryption, the initial value x0, the number of iterations q, and the parameter r are used as decryption keys, and the keys and encryption factors are stored, for example, in a decryption storage medium.

[0115] Compared with the related technology of encrypting parameters through the training process, the parameters obtained after encryption in this method are superimposed obfuscated values. Usually, only with the correct key can normal parameter inference calculation be performed, which is difficult to crack. At the same time, after parameter encryption, the model can almost completely resist attacks related to the data process.

[0116] The above method proposes a modular neural network model encryption method based on multiple chaotic maps, encrypting the neural network model from two levels: the computational topology and the parameter values. This method separates the model data calculation, the gradient update process, and the encryption process. It can not only protect and verify the model's intellectual property rights, but also prevent attackers from illegally using the model and protect the parameters from being leaked. It is extremely difficult to crack without affecting the inference accuracy, nor does it incur additional training costs or the need to redesign the network. In terms of reliability, this method can effectively resist various types of attacks on neural networks. The difficulty and computational complexity of attacking and cracking this method are extremely high, but it does not affect the inference accuracy, which shows a significant advantage over related technologies.

[0117] FIG2 is a flow chart of a neural network model decryption method provided in an embodiment of the present application. The decryption process of the neural network model in the embodiment of the present application is described in detail below with reference to FIG2. As shown in FIG2, the neural network model decryption method provided in the embodiment of the present application specifically includes the following steps:

[0118] Step S201, in response to a processing request of a target business, obtaining an encrypted target neural network model;

[0119] In some embodiments, decryption operation rules and decryption-related parameters are obtained simultaneously, such as the parameters in the weight matrix recorded when merging the weight matrices of multiple layers into a weight sequence in the above steps S101-S105 in the corresponding layer, and the position of each parameter in the weight matrix of the corresponding layer.

[0120] Step S202, determining the weight sequence in the encrypted target network model, and determining the encryption position corresponding to each parameter in each weight sequence;

[0121] Step S203: for each parameter in the weight sequence, based on the decryption operation rules, perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameter to obtain the original position of each parameter;

[0122] In a specific implementation, the number of times the nonlinear iterative operation is performed is the same as the number of times the nonlinear iterative operation is performed when the target neural network model is encrypted, and the above decryption operation rule is the inverse process of the encryption operation process when the target neural network model is encrypted.

[0123] In some embodiments, the following operations are performed in each nonlinear iteration operation:

[0124] The position coordinates obtained after the last nonlinear iterative operation are used as input, and the corresponding third operation value is determined based on the nonlinear function corresponding to the decryption operation rule; it should be noted that if only one nonlinear iterative operation is performed, the position coordinates obtained after the last nonlinear iterative operation are the coordinates of the encrypted position of the parameter.

[0125] The third operation value is weighted using a weighting matrix corresponding to the decryption operation rule, wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter;

[0126] A modulo operation is performed on the weighted result of the third operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0127] In a possible implementation, if the encryption operation rule is an Arnold mapping, the decryption operation rule may be an inverse operation of the Arnold mapping. Specifically, the corresponding recursive formula may be:

[0128] Wherein, k is an integer. When k=0, the above is the original position of each parameter. When k is not 0, the above is the position coordinate output by the k-th Arnold mapping recursion, is the position coordinate of the k+1th Arnold mapping output, when k+1 is the number of times the nonlinear iterative operation is performed when the target neural network model is encrypted, is the encrypted position coordinate corresponding to each parameter. For details, refer to the recursive formula of the nonlinear Arnold mapping in step S104 above. N is a preset parameter. The recursive formula meets the following requirements: 1) Matrix When , gcd(detC, N) = 1, where the gcd() function is used to find the greatest common divisor. gcd(detC, N) = 1 indicates that det C and N are mutually prime, and det C represents the determinant of matrix C. 2) a, b, c…j, s are all integers. 3) The nonlinear components G1 and G2 are nonlinear functions. The values ​​of these parameters are the same as those used for Arnold mapping during encryption.

[0129] In some embodiments, the above-mentioned decryption operation rules are based on performing at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameters to obtain the original position of each parameter, specifically including:

[0130] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the parameters to obtain the candidate positions of each parameter; in some embodiments, the candidate position of each parameter is the position corresponding to the parameter in the target cube, and the target cube is the smallest cube that can accommodate all the parameters in the weight matrix. The process of the nonlinear iterative operation can be referred to the above description, and its preset parameter is the side length of the target cube.

[0131] Based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined. In some embodiments, the candidate positions of each parameter and the correspondence between the candidate positions and the original positions are the positions of each parameter in the weight matrix recorded in step S104 and the positions within the target cube; based on this correspondence, the initial positions of each parameter can be determined and the parameter positions can be restored.

[0132] Step S204: for each weight sequence, distribute each parameter in the weight sequence to the corresponding original position coordinates, and restore the weight sequence to a weight matrix of multiple layers;

[0133] In some embodiments, when the weight matrices of multiple layers are merged into a weight sequence in the above step S103, information such as the parameters in the weight matrix in the corresponding layer and the position in the weight matrix of the corresponding layer is recorded. Based on this information, the weight sequence can be restored to the weight matrices of multiple layers.

[0134] Step S205 : determining a decrypted target network model based on the weight matrix corresponding to each layer, and processing the target service using the decrypted target network model.

[0135] In some embodiments, if the parameters in the target neural network model are encrypted during encryption, the parameters need to be decrypted based on the following steps:

[0136] Obtaining a preset initial value, a target chaotic mapping parameter, and an encryption factor; the preset initial value, the target chaotic mapping parameter, and the encryption factor are stored during the parameter encryption process.

[0137] Based on the target chaotic mapping parameters, a chaotic mapping is performed on the preset initial values ​​at least once to obtain the corresponding factor to be verified. If the difference between the factor to be verified and the encryption factor is less than a preset threshold, the encryption factor is used to decrypt the parameters in the target network model. The above preset threshold can be set based on the specific model and environmental requirements, and is not limited in this embodiment of the application.

[0138] It should be noted that the decryption order when decrypting the target neural network model corresponds to the encryption order of the model. For example, if in the model encryption process, the model parameters are first encrypted and then the model parameter positions are encrypted (i.e., steps S102-S104), then during decryption, the model parameter positions are first decrypted and then the model parameters are decrypted.

[0139] FIG3 is a flow chart of a possible neural network encryption process provided in an embodiment of the present application. The following describes the above-mentioned neural network encryption process in conjunction with FIG3 using a possible implementation method. It should be noted that in this process, it is assumed that the parameters are first encrypted using Logistic mapping, and then the parameter positions in the model are encrypted using Arnold mapping, and this process omits the process of training the model based on business data. As shown in FIG3, the specific implementation process is as follows:

[0140] Step S301, obtaining a target neural network model;

[0141] Step S302, obtaining a set of parameters M to be encrypted of the target neural network model;

[0142] Step S303, performing Logistic mapping on each parameter in the parameter set M to be encrypted;

[0143] In some embodiments, m groups of parameter values ​​are set, each group of parameters includes: a preset initial value x0, the number of iterations q and a parameter r. It should be noted that the number of groups m of parameters set can be set based on model requirements, with a minimum value of 1 and a maximum value of the number M of parameters in the parameter set to be encrypted, that is, m∈M.

[0144] It should be noted that the above preset initial value x0 and parameter r meet the following conditions:

[0145] At the same time, the values ​​of each group of parameters and the parameters to be encrypted are combined and stored, for example, as the decryption Key1: in, represents m x0,q m represents m q, r m Represents m r's.

[0146] Then, based on the following formula, perform q iterations to obtain the encryption factor x q : x j+1 =r(1-x j )

[0147] At the same time, Key1 and x j (m) are saved in the decryption storage medium to avoid calculation errors during subsequent decryption.

[0148] Step S304, obtaining the encrypted parameters;

[0149] In some embodiments, if the parameter w select , the corresponding encryption factor is x j , then w select +x j As encrypted parameters, save them to the model.

[0150] Step S305, dividing the target neural network model and merging the weight matrices;

[0151] In some embodiments, all layers in the target neural network model are divided into L groups, and each group is encrypted using the same or different parameters. The embodiments of the present application do not limit the specific division method.

[0152] In some embodiments, l groups of parameter values ​​are set, each group of parameters includes: matrix C, number of iterations K, and functions G1, G2. It should be noted that the number of groups l of set parameters can be set based on model requirements, with the minimum value being 1 and the maximum value being the number of groups L, l∈L.

[0153] Step S306, performing position mapping on each parameter;

[0154] That is, construct a cube: perform serial operations of flattening and concatenating the weight matrices of multiple layers included in each group to obtain a weight sequence, and then obtain the target cube corresponding to the weight sequence.

[0155] Assuming that the final weight sequence has N parameters, the side length of this cube is:

[0156] According to the preset mapping rules, the original position coordinates of the parameters (i.e. the position coordinates in the weight matrix) are mapped to the corresponding position coordinates in the target cube; if size 3 >N, perform empty element padding operation on the redundant positions of the target cube, and record the position coordinates of each parameter (including empty elements); at the same time, record the position of each parameter in the weight matrix in the weight matrix and the position in the target cube for use in subsequent model decryption.

[0157] Step S307, performing Arnold mapping (non-linear) on each parameter;

[0158] Based on the following formula, the position coordinates after each parameter mapping (i.e., the corresponding position coordinates in the target cube) are recursively calculated K times to obtain the encrypted position coordinates:

[0159] When k is 0, the above is the position coordinate after parameter mapping. When k is not 0, the above is the position coordinate output by the k-th recursion, is the position coordinate of the k+1th output, N is the preset parameter, and the above recursive formula meets the following requirements: 1) Matrix When gcd(det C, N) = 1, where the gcd() function is used to find the greatest common divisor, gcd(det C, N) = 1 means that det C and N are relatively prime, and det C represents the determinant of the matrix C; 2) a, b, c…j, s are all integers, and their values ​​are not restricted; 3) The nonlinear parts G1 and G2 are nonlinear functions, for example, they can be set to polynomial functions, exponential functions, and other nonlinear function forms, for example, G t (x)=ax a +bx b +…+x 1 +1,t=1,2.

[0160] At the same time, record the corresponding Key2: L is the set of divided groups. Among them, K l Indicates l K, C l represents l C, Indicates 1 G1, Indicates 1 G2.

[0161] Step S308, obtaining the encrypted target neural network model;

[0162] In some embodiments, the position coordinates of each parameter obtained after recursion are recorded, and the storage location of each parameter in the computing topology is moved to the coordinate location after recursion to complete the computing topology encryption.

[0163] FIG4 is a flow chart of a possible neural network decryption process provided by an embodiment of the present application. The following describes the above-mentioned neural network decryption process in conjunction with FIG4 using a possible implementation method. It should be noted that this process is a decryption process corresponding to the encryption process of FIG3 , that is, during decryption, the parameter position is first decrypted, and then the parameter is decrypted. As shown in FIG4 , the specific implementation process is as follows:

[0164] Step S401, obtaining the encrypted target neural network model;

[0165] At the same time, the keys Key1, Key2, encryption factors, and the position of each parameter in the weight matrix and the position in the target cube are obtained.

[0166] Step S402, performing an Arnold mapping inverse transformation on each parameter in the target neural network model;

[0167] Specifically, based on Key2: The candidate positions of the calculation parameters (i.e., the position coordinates within the target cube) are derived according to the following recursive formula:

[0168] The values ​​and meanings of each parameter are detailed in step S307.

[0169] Step S403 : determining the original position of each parameter based on the pre-stored candidate positions of each parameter and the correspondence between the candidate positions and the original positions.

[0170] The original position of each parameter is determined based on the pre-stored candidate positions of each parameter and the correspondence between the candidate positions and the original positions, that is, the position of each parameter in the weight matrix and the position in the target cube.

[0171] Step S404: Logistic mapping verification is performed based on Key1, and each parameter corresponding to the parameter set M to be encrypted is decrypted;

[0172] Based on Key1: Then, based on the following formula, perform q iterations to obtain the factor to be verified: x j+1 =r(1-x j )

[0173] like ε is an arbitrarily small real number, the verification result is correct; based on the obtained encryption factor x q Decrypt the corresponding parameters. Use the pre-stored x q In order to avoid calculation errors and avoid affecting the accuracy of the model.

[0174] Step S405, processing the target business based on the decrypted target neural network model;

[0175] In some embodiments, the process is F out =(w encrypt F in -x q F in ), where F in is the input target business data, F out is the output target business data, w encrypt is the encryption parameter in the target neural network, w encrypt =w select +x q , w select are the initial parameters before encryption in the target neural network.

[0176] The effectiveness of the above methods is analyzed as follows:

[0177] 1. The logistic map has the following properties: 1) nonlinearity; 2) sensitive dependence on initial values; 3) overall stability but local instability; 4) long-term unpredictability. Therefore, for continuous weighted data, long-term prediction is almost impossible without protecting the initial values ​​and recursive parameters.

[0178] 2. Nonlinear Arnold mapping: The brute force solution is extremely complex. To brute force this mapping, you need to obtain Key2: It is extremely difficult to guess the above parameters without any reference data.

[0179] Assume that the transformation matrix C used satisfies the following conditions: The parameters a, b, and c can only take binary values. The nonlinear part takes a polynomial function with the highest order being N1 and N2, and the coefficients are all 1. Under the premise that there is no sampling selection process in the grouping process, the complexity of the brute force solution satisfies O(K L )*O(2 4L)*O(N1)*O(N2), where O() is the growth rate of the function in Big O notation, also known as the order of the function, that is, the letter O represents Order. Assuming that K is a maximum of 10, N1=5, N2=5, and the target neural network model is VGG-16 (13 layers), L=13, the value of the complexity expression is 1.1259×10 30 , that is, the cracking complexity is extremely high.

[0180] The following describes the forward transformation and inverse transformation process of the nonlinear Arnold mapping in the above method using a specific example:

[0181] Assuming that the target cube is a cube with a side length of 2, the corresponding weight sequence includes 8 parameters, and the forward transformation matrix is:

[0182] The inverse transformation matrix is:

[0183] in, The nonlinear part is set to G1(x)=4x 4 +2x 2 +1,G2(x)=5x 5 +3x 3 +1, the coefficients are set to j=2, s=1.

[0184] The candidate coordinates corresponding to the 8 parameters in the weight sequence are: (0,0,0), (0,1,0), (1,0,0), (1,1,0), (0,0,1), (0,1,1), (1,0,1), (1,1,1);

[0185] After 10 recursive calculations using the forward transformation matrix, the coordinates are: (1,1,1), (1,1,0), (0,1,1), (0,1,0), (1,0,1), (1,0,0), (0,0,1), (0,0,0);

[0186] After iterating 10 times using the inverse transformation matrix, the coordinates are: (0,0,0), (0,1,0), (1,0,0), (1,1,0), (0,0,1), (0,1,1), (1,0,1), (1,1,1).

[0187] Where (u, v, w) represents the position coordinates corresponding to the u+1th layer, v+1th row, and w+1th column in the target cube.

[0188] FIG5 is a schematic diagram of a neural network model encryption device provided in an embodiment of the present application. Referring to FIG5 , an embodiment of the present application provides a neural network model encryption device, which includes:

[0189] The first acquisition module 501 is used to acquire business data and use the business data to train the neural network to obtain a target neural network that meets business requirements;

[0190] A grouping module 502 is configured to divide the multiple layers in the target neural network model into at least one group in response to a model acquisition request of the target object;

[0191] A merging module 503 is configured to merge the weight matrices of multiple layers within any group to obtain a weight sequence;

[0192] A first operation module 504 is configured to perform at least one nonlinear iterative operation on the original position coordinates of each parameter in the weight sequence based on an encryption operation rule to obtain an encrypted position corresponding to each parameter;

[0193] The sending module 505 is used to distribute the parameters in the above-mentioned weight sequence to the corresponding encrypted positions, obtain the encrypted target neural network model, and send the encrypted target neural network to the above-mentioned target object.

[0194] In some possible implementations, the merging module 503 is configured to merge the weight matrices of multiple layers within the group to obtain a weight sequence, including:

[0195] For any layer in the above group, based on the preset rules, the weight matrix of any layer is subjected to dimensionality reduction processing to obtain the corresponding processing result;

[0196] The processing results corresponding to each layer in the above group are merged to obtain the above weight sequence.

[0197] In some possible implementations, the first operation module 504 is configured to perform at least one nonlinear iterative operation on the original position coordinates of the parameters based on an encryption operation rule, including:

[0198] Determine a target cube corresponding to the weight matrix, where the target cube is the smallest cube that can accommodate all parameters in the weight matrix;

[0199] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates in the above target cube;

[0200] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameter mapping.

[0201] In some possible implementations, the first operation module 504 performs the following operations in each nonlinear iterative operation:

[0202] Taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining the corresponding first operation value based on the nonlinear function corresponding to the above encryption operation rule;

[0203] Using a weighting matrix corresponding to the encryption operation rule, weighting the position coordinates obtained after the last nonlinear iterative operation to obtain a corresponding second operation value; wherein the determinant of the weighting matrix is ​​coprime with the preset parameter;

[0204] A modulo operation is performed on the sum of the first operation value and the second operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0205] In some possible implementations, the preset parameter is the side length of the target cube.

[0206] In some possible implementations, the sending module 505 is further configured to:

[0207] Obtaining a set of parameters to be encrypted of the target neural network model, wherein the set of parameters to be encrypted includes a plurality of parameters to be encrypted;

[0208] Encrypting each of the parameters to be encrypted based on the encryption factor;

[0209] The encryption factor is determined as follows:

[0210] Based on the target chaotic mapping parameters, the preset initial value is subjected to chaotic mapping at least once to obtain the corresponding encryption factor.

[0211] FIG6 is a schematic diagram of a neural network model decryption device provided in an embodiment of the present application. Referring to FIG6 , an embodiment of the present application provides a neural network model decryption device, which includes:

[0212] The second acquisition module 601 is used to obtain the encrypted target neural network model in response to a processing request of the target business;

[0213] Determination module 602, for determining the weight sequence in the encrypted target network model and determining the encryption position corresponding to each parameter in each weight sequence;

[0214] The second operation module 603 is configured to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to each parameter in the weight sequence based on a decryption operation rule to obtain the original position of each parameter;

[0215] Restoration module 604, for distributing each parameter in each weight sequence to the corresponding original position coordinates, and restoring the weight sequence to a weight matrix of multiple layers;

[0216] The processing module 605 is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and use the decrypted target network model to process the above target service.

[0217] In some possible implementations, the second operation module 603 is configured to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameters based on a decryption operation rule to obtain the original position of each parameter, including:

[0218] Based on the decryption operation rules, perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the above parameters to obtain candidate positions of each parameter;

[0219] Based on the candidate positions of each parameter and the corresponding relationship between the candidate positions and the original positions, the original position of each parameter is determined.

[0220] In some possible implementations, the second operation module 603 performs the following operations in each nonlinear iterative operation:

[0221] Taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining a corresponding third operation value based on a nonlinear function corresponding to the above decryption operation rule;

[0222] The third operation value is weighted using a weighting matrix corresponding to the decryption operation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter;

[0223] A modulo operation is performed on the weighted result of the third operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0224] In some possible implementations, the candidate positions are positions corresponding to the parameters in the target cube, the target cube is the smallest cube that can accommodate all parameters in the weight matrix, and the preset parameters are the side lengths of the target cube.

[0225] In some possible implementations, before the processing module 605 processes the target service using the decrypted target network model, it is further configured to:

[0226] Obtaining preset initial values, target chaotic mapping parameters, and encryption factors;

[0227] Based on the target chaotic mapping parameters, perform chaotic mapping on the preset initial value at least once to obtain the corresponding factor to be verified;

[0228] If the difference between the factor to be verified and the encryption factor is smaller than a preset threshold, the encryption factor is used to decrypt the parameters in the target network model.

[0229] Based on the same application concept, a test data construction device is also provided in the embodiment of the present application. Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0230] Those skilled in the art will appreciate that various aspects of the present application can be implemented as systems, methods, or program products. Therefore, various aspects of the present application can be specifically implemented in the following forms: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or an implementation that combines hardware and software aspects, which may be collectively referred to herein as a "circuit," "module," or "system."

[0231] In some possible implementations, a device according to the present application may include at least one processor and at least one memory. The memory stores program code that, when executed by the processor, causes the processor to perform the steps of the test data construction method according to various exemplary implementations of the present application described above in this specification.

[0232] The device 700 according to this embodiment of the present application is described below with reference to Figure 7. The device 700 shown in Figure 7 is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0233] As shown in FIG7 , device 700 is a general-purpose device for performing encryption of a neural network model. Components of device 700 may include, but are not limited to, at least one processor 701, at least one memory 702, and a bus 703 connecting different system components (including memory 702 and processor 701). The memory stores program code that, when executed by the processor, causes the processor to perform the following steps:

[0234] Obtain business data, and use the above business data to train the neural network to obtain a target neural network that meets business needs;

[0235] In response to a model acquisition request of a target object, dividing a plurality of layers in the target neural network model into at least one group;

[0236] For any group, the weight matrices of multiple layers in the group are merged to obtain a weight sequence;

[0237] For each parameter in the weight sequence, based on the encryption operation rules, perform at least one nonlinear iterative operation on the original position coordinates of the parameter to obtain the encrypted position corresponding to each parameter;

[0238] Distribute each parameter in the above weight sequence to the corresponding encrypted position to obtain the encrypted target neural network model, and send the encrypted target neural network to the above target object.

[0239] Bus 703 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0240] The memory 702 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 7021 and / or a cache memory 7022 , and may further include a read-only memory (ROM) 7023 .

[0241] The memory 702 may also include a program / utility 7025 having a set (at least one) of program modules 7024, such program modules 7024 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0242] Device 700 can also communicate with one or more external devices 704 (e.g., keyboards, pointing devices, etc.), can also communicate with one or more devices that enable a user to interact with device 700, and / or can communicate with any device that enables the device 700 to communicate with one or more other devices (e.g., routers, modems, etc.). Such communication can be carried out through input / output (I / O) interface 705. Furthermore, device 700 can also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through network adapter 706. As shown, network adapter 706 communicates with other modules for device 700 through bus 703. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with device 700, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0243] In a possible implementation, the processor is specifically configured to:

[0244] For any layer in the above group, based on the preset rules, the weight matrix of any layer is subjected to dimensionality reduction processing to obtain the corresponding processing result;

[0245] The processing results corresponding to each layer in the above group are merged to obtain the above weight sequence.

[0246] In a possible implementation, the processor is specifically configured to:

[0247] Determine a target cube corresponding to the weight matrix, where the target cube is the smallest cube that can accommodate all parameters in the weight matrix;

[0248] According to the preset mapping rules, the original position coordinates of the above parameters are mapped to the corresponding position coordinates in the above target cube;

[0249] Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the above parameter mapping.

[0250] In a possible implementation, the processor performs the following operations in each nonlinear iterative operation:

[0251] Taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining the corresponding first operation value based on the nonlinear function corresponding to the above encryption operation rule;

[0252] Using a weighting matrix corresponding to the encryption operation rule, weighting the position coordinates obtained after the last nonlinear iterative operation to obtain a corresponding second operation value; wherein the determinant of the weighting matrix is ​​coprime with the preset parameter;

[0253] A modulo operation is performed on the sum of the first operation value and the second operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0254] In a possible implementation, the preset parameter is the side length of the target cube.

[0255] In one possible implementation, before the processor is used to send the encrypted target neural network to the target object, it is further used to:

[0256] Obtaining a set of parameters to be encrypted of the target neural network model, wherein the set of parameters to be encrypted includes a plurality of parameters to be encrypted;

[0257] Encrypting each of the parameters to be encrypted based on the encryption factor;

[0258] The encryption factor is determined in the following manner: based on the target chaotic mapping parameter, a preset initial value is subjected to at least one chaotic mapping to obtain a corresponding encryption factor.

[0259] The present application also provides another device 800 for performing decryption of a neural network model. As shown in FIG8 , the device 800 is presented in the form of a general-purpose device. The components of the device 800 may include, but are not limited to: the at least one processor 801 described above, the at least one memory 802 described above, and a bus 803 connecting different system components (including the memory 802 and the processor 801). The memory stores program code. When the program code is executed by the processor, the processor performs the following steps:

[0260] In response to a processing request of a target business, an encrypted target neural network model is obtained; a weight sequence in the encrypted target network model is determined, and the encrypted position corresponding to each parameter in each weight sequence is determined; for each parameter in the above weight sequence, based on a decryption operation rule, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameter to obtain the original position of each parameter; for each weight sequence, each parameter in the above weight sequence is distributed to the corresponding original position coordinates, and the above weight sequence is restored to a weight matrix of multiple layers; based on the weight matrix corresponding to each layer, a decrypted target network model is determined, and the above target business is processed using the decrypted target network model.

[0261] Bus 803 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0262] The memory 802 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 8021 and / or a cache memory 8022 , and may further include a read-only memory (ROM) 8023 .

[0263] The memory 802 may also include a program / utility 8025 having a set (at least one) of program modules 8024, such program modules 8024 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0264] Device 800 can also communicate with one or more external devices 804 (e.g., keyboards, pointing devices, etc.), can also communicate with one or more devices that enable a user to interact with device 800, and / or can communicate with any device that enables the device 800 to communicate with one or more other devices (e.g., routers, modems, etc.). Such communication can be performed via input / output (I / O) interface 805. Furthermore, device 800 can also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapter 806. As shown, network adapter 806 communicates with other modules of device 800 via bus 803. It should be understood that, although not shown in the figure, other hardware and / or software modules can be used in conjunction with device 800, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0265] In some possible implementations, the processor is specifically configured to:

[0266] Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the above parameters to obtain the candidate positions of each parameter; based on the candidate positions of each parameter and the correspondence between the candidate positions and the original positions, the original positions of each parameter are determined.

[0267] In some possible implementations, the processor performs the following operations in each nonlinear iterative operation: taking the position coordinates obtained after the previous nonlinear iterative operation as input, and determining a corresponding third operation value based on a nonlinear function corresponding to the decryption operation rule;

[0268] The third operation value is weighted using a weighting matrix corresponding to the decryption operation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with the preset parameter;

[0269] A modulo operation is performed on the weighted result of the third operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

[0270] In some possible implementations, the candidate positions are positions corresponding to the parameters in the target cube, the target cube is the smallest cube that can accommodate all parameters in the weight matrix, and the preset parameters are the side lengths of the target cube.

[0271] In some possible implementations, the processor is used to obtain a preset initial value, a target chaotic mapping parameter, and an encryption factor before processing the target service using the decrypted target network model; based on the target chaotic mapping parameter, perform chaotic mapping on the preset initial value at least once to obtain a corresponding factor to be verified; if the difference between the factor to be verified and the encryption factor is less than a preset threshold, the encryption factor is used to decrypt the parameters in the target network model.

[0272] In some possible implementations, various aspects of the neural network model encryption method and the neural network model decryption method provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of the neural network model encryption method and the neural network model decryption method according to various exemplary embodiments of the present application described above in this specification.

[0273] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0274] The program product for monitoring of the embodiment of the present application can be a portable compact disc read-only memory (CD-ROM) and include program code, and can be run on a device. However, the program product of the present application is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0275] A readable signal medium may include a data signal transmitted in baseband or as part of a carrier wave, which carries readable program code. Such a transmitted data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0276] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0277] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user device, partially on the user device, as a separate software package, partially on the user device and partially on a remote device, or entirely on the remote device or server. In cases involving a remote device, the remote device can be connected to the user device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external device (for example, using an Internet service provider to connect through the Internet).

[0278] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, depending on the embodiment of the application, the features and functions of two or more units described above can be embodied in a single unit. Conversely, the features and functions of a single unit described above can be further divided and embodied by multiple units.

[0279] Furthermore, although the operations of the method of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0280] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0281] The present application is described with reference to the flow charts and block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flow charts and block diagrams, as well as the combination of the process and box in the flow charts and block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the function specified in one or more flow charts and one or more boxes in the block diagram.

[0282] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and one or more boxes in the block diagram.

[0283] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and one or more boxes in the block diagram.

[0284] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0285] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A neural network model encryption method, wherein: The method comprises: Acquire business data, and use the business data to train the neural network to be trained to obtain a target neural network that meets business requirements; In response to a model acquisition request of a target object, dividing a plurality of layers in the target neural network model into at least one group; For any group, merging weight matrices of multiple layers in the group to obtain a weight sequence; For each parameter in the weight sequence, based on the encryption operation rule, at least one nonlinear iterative operation is performed on the original position coordinates of the parameter to obtain an encrypted position corresponding to each parameter; Distribute each parameter in the weight sequence to a corresponding encrypted position to obtain an encrypted target neural network model, and send the encrypted target neural network to the target object.

2. The method according to claim 1, wherein: The weight matrices of multiple layers in the group are merged to obtain a weight sequence, including: For any layer in the group, based on a preset rule, a dimensionality reduction process is performed on the weight matrix of any layer to obtain a corresponding processing result; The processing results corresponding to each layer in the group are combined to obtain the weight sequence.

3. The method according to claim 1, wherein: The method of performing at least one nonlinear iterative operation on the original position coordinates of the parameter based on the encryption operation rule includes: Determine a target cube corresponding to the weight matrix, wherein the target cube is a minimum cube that can accommodate all parameters in the weight matrix; According to a preset mapping rule, the original position coordinates of the parameter are mapped to corresponding position coordinates in the target cube; Based on the encryption operation rules, at least one nonlinear iterative operation is performed on the position coordinates after the parameter mapping.

4. The method according to claim 3, wherein: The following operations are performed in each nonlinear iteration: Taking the position coordinates obtained after the last nonlinear iterative operation as input, and determining the corresponding first operation value based on the nonlinear function corresponding to the encryption operation rule; Using a weighting matrix corresponding to the encryption operation rule, weighting the position coordinates obtained after the last nonlinear iterative operation to obtain a corresponding second operation value; wherein the determinant of the weighting matrix is ​​coprime with the preset parameter; A modulo operation is performed on the sum of the first operation value and the second operation value and the preset parameter to obtain the position coordinates corresponding to the current nonlinear iterative operation.

5. The method according to claim 4, wherein: The preset parameter is the side length of the target cube.

6. The method according to any one of claims 1 to 5, wherein: Before sending the encrypted target neural network to the target object, the method further includes: Acquire a set of parameters to be encrypted of the target neural network model, wherein the set of parameters to be encrypted includes a plurality of parameters to be encrypted; Encrypting each of the parameters to be encrypted based on the encryption factor; The encryption factor is determined based on the following method: Based on the target chaotic mapping parameter, the preset initial value is subjected to chaotic mapping at least once to obtain the corresponding encryption factor.

7. A neural network model decryption method, wherein: The method comprises: In response to a processing request of a target business, obtaining an encrypted target neural network model; Determine the weight sequence in the encrypted target network model, and determine the encryption position corresponding to each parameter in each weight sequence; For each parameter in the weight sequence, based on the decryption operation rule, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the parameter to obtain the original position of each parameter; For each weight sequence, each parameter in the weight sequence is distributed to the corresponding original position coordinates, and the weight sequence is restored to a weight matrix of multiple layers; Based on the weight matrix corresponding to each layer, determine the decrypted target network model, and use the decrypted The target network model processes the target service.

8. The method according to claim 7, wherein: The method of performing at least one nonlinear iterative operation on the encrypted position coordinates corresponding to the parameters based on the decryption operation rules to obtain the original positions of the parameters includes: Based on the decryption operation rules, at least one nonlinear iterative operation is performed on the encrypted position coordinates corresponding to the parameters to obtain candidate positions of each parameter; Based on the candidate positions of each parameter and the corresponding relationship between the candidate positions and the original positions, the original positions of each parameter are determined.

9. The method according to claim 8, wherein: The following operations are performed in each nonlinear iteration: Taking the position coordinates obtained after the last nonlinear iterative operation as input, and determining a corresponding third operation value based on a nonlinear function corresponding to the decryption operation rule; The third operation value is weighted using a weighting matrix corresponding to the decryption operation rule; wherein the determinant of the inverse matrix of the weighting matrix is ​​coprime with a preset parameter; A modulo operation is performed on a weighted result of the third operation value and the preset parameter to obtain a position coordinate corresponding to the current nonlinear iterative operation.

10. The method according to claim 9, wherein: The candidate position is the position corresponding to the parameter in the target cube, the target cube is the smallest cube that can accommodate all the parameters in the weight matrix, and the preset parameter is the side length of the target cube.

11. The method according to any one of claims 7 to 10, wherein: Before processing the target service using the decrypted target network model, the method further includes: Obtaining preset initial values, target chaotic mapping parameters and encryption factors; Based on the target chaotic mapping parameter, performing chaotic mapping on the preset initial value at least once to obtain a corresponding factor to be verified; If the difference between the factor to be verified and the encryption factor is less than a preset threshold, the encryption factor is used to decrypt the parameters in the target network model.

12. A neural network model encryption device, wherein: The device includes: A first acquisition module is used to acquire business data, and use the business data to train the neural network to be trained to obtain a target neural network that meets business requirements; A grouping module, configured to divide a plurality of layers in the target neural network model into at least one group in response to a model acquisition request of a target object; A merging module, used for merging the weight matrices of multiple layers in any group to obtain a weight sequence; A first operation module is used for performing at least one nonlinear iterative operation on the original position coordinates of each parameter in the weight sequence based on the encryption operation rule to obtain an encrypted position corresponding to each parameter; The sending module is used to distribute the parameters in the weight sequence to the corresponding encrypted positions, obtain the encrypted target neural network model, and send the encrypted target neural network to the target object.

13. A neural network model decryption device, wherein: The device includes: A second acquisition module, used to obtain the encrypted target neural network model in response to a processing request of the target business; A determination module is used to determine the weight sequence in the encrypted target network model and determine the encryption position corresponding to each parameter in each weight sequence; A second operation module is used to perform at least one nonlinear iterative operation on the encrypted position coordinates corresponding to each parameter in the weight sequence based on a decryption operation rule to obtain the original position of each parameter; A restoration module, for distributing each parameter in the weight sequence to the corresponding original position coordinates for each weight sequence, and restoring the weight sequence to a weight matrix of multiple layers; The processing module is used to determine the decrypted target network model based on the weight matrix corresponding to each layer, and use the decrypted target network model to process the target business.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 11 are implemented.

15. A computer-readable storage medium having computer program instructions stored thereon, wherein: When the computer program instructions are executed by a processor, the steps of the method according to any one of claims 1 to 11 are implemented.

Images