Method and apparatus using tree model

Abstract

A method and apparatus using a tree model. The method comprises: sending to a data party a plurality of encrypted-tree models corresponding to a tree model, wherein the plurality of encrypted-tree models comprise a first encrypted-tree model and a second encrypted-tree model, the first encrypted-tree model comprises a first encrypted tree, the second encrypted-tree model comprises a second encrypted tree, the first encrypted tree is generated by means of adding a perturbation value to the value of each leaf node of a decision tree, and the second encrypted tree is generated on the basis of the first encrypted tree; receiving from the data party a plurality of encrypted model scores outputted by the plurality of encrypted-tree models for feature data of a target object; on the basis of indication information, acquiring from the plurality of encrypted model scores a first encrypted model score corresponding to the first encrypted-tree model; and processing the first encrypted model score on the basis of perturbation information to obtain a prediction result of the tree model.

Description

Method and apparatus using tree model

[0001] This application claims priority to the Chinese Patent Application No. 2024105463198, filed on April 30, 2024, and entitled "Method and apparatus using tree model", the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0002] The embodiments of the present specification belong to the technical field of computer technology, and particularly relate to a method and apparatus using tree model. BACKGROUND

[0003] In the field of machine learning technology, there are many kinds of tree models. Tree model generally refers to a class of algorithms that use tree structure for data partitioning and decision making. These tree models can be used to solve classification, regression and other prediction problems. In one tree model usage scenario, the model holder (such as a transaction platform, a payment platform, etc.) of the tree model has the data of the model, including model parameters, model architecture, etc., and the customer of the model holder has the feature data, which is the data holder. The model holder wants to use its own tree model to make predictions on the customer's data to obtain predicted labels. However, the customer also does not want to disclose its own data. In this case, the model holder needs to provide the model to the customer for model prediction, and therefore, the model holder needs to protect the model when providing it to the customer.

[0004] SUMMARY

[0005] The purpose of the present application is to provide a method for using a tree model to protect the model of the model party.

[0006] The first aspect of the present specification provides a method for using a tree model, executed by a model party, the tree model comprising a decision tree, the method comprising:

[0007] sending a plurality of ciphertext tree models corresponding to the tree model to a data party, the plurality of ciphertext tree models comprising a first ciphertext tree model and a second ciphertext tree model, the first ciphertext tree model comprising a first ciphertext tree, the second ciphertext tree model comprising a second ciphertext tree, the first ciphertext tree being generated by adding a perturbation value to a value of each leaf node of the decision tree, the second ciphertext tree being generated based on the first ciphertext tree, the model party recording indication information and perturbation information corresponding to the perturbation value, the indication information being used to indicate a ciphertext model score corresponding to the first ciphertext tree model in a plurality of ciphertext model scores output by the plurality of ciphertext tree models;

[0008] receiving, from the data party, a plurality of ciphertext model scores output by the plurality of ciphertext tree models for feature data of a target object;

[0009] obtain, based on the indication information, a first ciphertext model score corresponding to the first ciphertext tree model from the plurality of ciphertext model scores;

[0010] process the first ciphertext model score based on the perturbation information to obtain a prediction result of the tree model.

[0011] The second aspect of the present specification provides an apparatus using a tree model, deployed at a model side, the tree model comprising a decision tree, the apparatus comprising:

[0012] a sending unit configured to send, to a data side, a plurality of ciphertext tree models corresponding to a tree model, the plurality of ciphertext tree models comprising a first ciphertext tree model and a second ciphertext tree model, the first ciphertext tree model comprising a first ciphertext tree, the second ciphertext tree model comprising a second ciphertext tree, the first ciphertext tree being generated by adding a perturbation value to a value of each leaf node of the decision tree, the second ciphertext tree being generated based on the first ciphertext tree, the model side recording indication information and perturbation information corresponding to the perturbation value, the indication information being used to indicate a ciphertext model score corresponding to the first ciphertext tree model in a plurality of ciphertext model scores output by the plurality of ciphertext tree models;

[0013] a receiving unit configured to receive, from the data side, a plurality of ciphertext model scores output by the plurality of ciphertext tree models for feature data of a target object;

[0014] an obtaining unit configured to obtain, based on the indication information, a first ciphertext model score corresponding to the first ciphertext tree model from the plurality of ciphertext model scores;

[0015] a processing unit configured to process the first ciphertext model score based on the perturbation information to obtain a prediction result of the tree model.

[0016] The third aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer program causes the computer to execute the method of the first aspect.

[0017] The fourth aspect of the present specification provides a computing device comprising a memory and a processor, the memory storing executable code, and the processor executing the executable code to implement the method of the first aspect.

[0018] The fifth aspect of the present specification provides a computer program product comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method of the first aspect.

[0019] In the scheme provided by the embodiments of the present specification, the value of the leaf node in the decision tree of the tree model is disturbed to obtain a first ciphertext tree, a first ciphertext tree model is generated based on the first ciphertext tree to protect the leaf node of the tree model, and a second ciphertext tree model including a second ciphertext tree is added to protect the intermediate node in the tree model. The data party performs prediction based on the plurality of ciphertext tree models, and does not know any data of the tree model. The data party sends the plurality of ciphertext scores output by the plurality of ciphertext tree models to the model party, and the model party can obtain the real prediction result of the tree model based on the plurality of ciphertext scores. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present specification, the drawings required in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0021] FIG. 1 is a schematic diagram of a scenario using a tree model in the embodiments of the present specification;

[0022] FIG. 2 is a flowchart of a method of using a tree model in the embodiments of the present specification;

[0023] FIG. 3 is a schematic diagram of the structure of a tree model owned by a model party in the embodiments of the present specification;

[0024] FIG. 4 is a schematic diagram of the structure of a plurality of ciphertext tree models in the embodiments of the present specification;

[0025] FIG. 5 is a device architecture diagram of a method of using a tree model in the embodiments of the present specification. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be described clearly and completely in conjunction with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only some of the embodiments of the present specification, not all. Based on the embodiments in the present specification, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present specification.

[0027] The embodiments of the present specification relate to the use of tree models, and in particular to the use of regression-type tree models. The tree model in the embodiments of the present specification can also be a categorical tree model, which includes an activation layer, and the leaf node layer still outputs a score of the object to be predicted. By processing the score based on the activation layer, the category of the object to be predicted is obtained.

[0028] The tree model includes any of the following types of tree models: Decision Trees, usually refers to a single tree model; Random Forests, the tree model includes multiple decision trees, wherein each tree in the random forest is usually independently trained based on different subsets of data samples, and the prediction results of all trees can be integrated by bagging in the random forest, for example, the prediction scores of all trees are averaged to obtain the prediction result of the model; Boosting Trees, such as Gradient Boosting Trees, XGBoost, etc., which include multiple trees added in sequence, each tree corrects the prediction errors of the previously added trees, and gradually improves the performance of the model, wherein the prediction results of multiple trees in the boosting tree are integrated by boosting, for example, the prediction scores of multiple trees are added to obtain the prediction result of the model.

[0029] In the above tree model, a tree can include intermediate nodes and leaf nodes. An intermediate node represents a decision point, where a conditional judgment is made based on a certain split condition, for example, the split condition corresponding to a certain intermediate node is "whether the registration time is less than 10?", wherein the "registration time" can be referred to as the split feature of the intermediate node, and "10" can be referred to as the split value of the intermediate node. Each intermediate node is connected to two or more child nodes, each of which corresponds to a sub-interval of the split feature of the intermediate node.

[0030] Leaf node: The leaf node is the terminal node in the tree model. In a regression tree, the value of the leaf node is a continuous numerical value.

[0031] To train the tree model, a predetermined number of training samples can be obtained first, which include feature data and label data. Then, based on the training samples, the intermediate nodes of the tree model are gradually generated to segment the training samples. Among them, at the intermediate node, the preset parameter values obtained by using each preset split feature to segment the training samples can be obtained, the parameters include information gain, gini impurity, information gain ratio, mean square error, etc., and the split feature and split value corresponding to the intermediate node can be determined based on the above parameter values corresponding to each split feature. In the training of the tree model, the above segmentation process is continuously performed until a specific stopping criterion is met, for example, the tree reaches a predetermined maximum depth, the number of samples in the node is less than a certain threshold, or further segmentation cannot significantly improve the prediction accuracy, etc.

[0032] After stopping the segmentation, the above multiple training samples fall into each leaf node, and then the value of each leaf node can be obtained based on the label values of the training samples in each leaf node.

[0033] In model prediction using a tree model, feature data of an object to be predicted is obtained, and the feature is input into the tree model, so that the object to be predicted is dropped into a leaf node in the tree model based on the feature data, and a prediction value of the object to be predicted is obtained based on a value of the leaf node.

[0034] In the related art, a model holder (hereinafter referred to as a model party) can provide a split feature corresponding to each intermediate node of a tree model to a data holder (hereinafter referred to as a data party), and the data party can perform model prediction based on the split feature corresponding to each intermediate node of the tree model.

[0035] In the related art, the split feature of each intermediate node of the tree model cannot be hidden from the data party, and therefore the model data cannot be comprehensively protected.

[0036] The embodiments of the present specification provide a method of using a tree model, by perturbing values of leaf nodes in a decision tree of the tree model to obtain a first ciphertext tree, generating a first ciphertext tree model based on the first ciphertext tree to protect the leaf nodes of the tree model, and adding a second ciphertext tree model including a second ciphertext tree to protect the intermediate nodes in the tree model, wherein the second ciphertext tree is generated based on the first ciphertext tree. In the embodiments of the present specification, "ciphertext" does not mean that ciphertext is obtained by performing encryption processing, but refers to a hiding effect on real data. For example, by perturbing the values of the leaf nodes in the tree model to obtain the first ciphertext tree, and additionally generating a decision tree for confusing the first ciphertext tree as the second ciphertext tree, the first ciphertext tree and the second ciphertext tree are still plaintext decision trees.

[0037] In the embodiments of the present specification, the first ciphertext tree represents a ciphertext tree obtained by perturbing the leaf nodes of a real tree, and the second ciphertext tree represents a ciphertext tree added based on the values of the first ciphertext tree, which can be referred to as a perturbed tree for perturbing the intermediate nodes included in the tree model. The first ciphertext tree model represents a ciphertext tree model including one or more first ciphertext trees, i.e., the first ciphertext tree model corresponds to the real tree. The second ciphertext tree model represents a ciphertext tree model including one or more second ciphertext trees.

[0038] The data party performs prediction based on the first ciphertext tree model and the second ciphertext tree model, and does not obtain any data of the tree model. The data party sends a plurality of ciphertext scores of a plurality of ciphertext tree models to the model party, the model party determines a ciphertext score of the first ciphertext tree model based on pre-recorded indication information, processes the ciphertext score based on pre-recorded perturbation information, and obtains a real prediction result of the tree model. Thus, while obtaining a high-precision prediction result, the data of the tree model is protected.

[0039] FIG. 1 is a schematic diagram of a scenario using a tree model in an embodiment of the present specification. As shown in FIG. 1, in the scenario, a model party and a data party are included. The model party trains to obtain a tree model, which is, for example, encapsulated in the form of a PMML file, and the tree model includes, for example, one or more decision trees (one decision tree is shown in FIG. 1 as an example). In the decision tree, the intermediate nodes are represented by white circular nodes, and the leaf nodes are represented by white diamond nodes, wherein each intermediate node corresponds to a split condition, and each leaf node includes a node value. The model party can obtain a first ciphertext tree by perturbing the values of the leaf nodes in the tree model, generate a first ciphertext tree model based on the first ciphertext tree, as shown in "first ciphertext tree model" on the right side of FIG. 1, the intermediate nodes in the first ciphertext tree are represented by white circular nodes to indicate that the intermediate nodes in the first ciphertext tree have the same properties as the intermediate nodes in the decision tree in the tree model, and the leaf nodes in the first ciphertext tree are represented by gray diamonds to indicate that the leaf nodes in the first ciphertext tree have different values from the decision tree in the tree model. The model party can also generate a second ciphertext tree based on the first ciphertext tree, and generate a second ciphertext tree model based on the second ciphertext tree. The model party can record the relevant perturbation information, which can include the perturbation values used to perturb the leaf nodes, and also record the indication information indicating the output score of the first ciphertext tree model, and send multiple ciphertext tree models including the first ciphertext tree model and the second ciphertext tree model to the data party.

[0040] The data party uses the multiple ciphertext tree models to make predictions for a to-be-predicted object, and can obtain multiple ciphertext scores output by the multiple ciphertext tree models. The data party returns the multiple ciphertext scores to the model party, and the model party can obtain the prediction result of the tree model for the to-be-predicted object based on the multiple ciphertext scores based on the indication information and the perturbation information.

[0041] FIG. 2 is a flowchart of a method of using a tree model in an embodiment of the present specification.

[0042] As shown in FIG. 2, first, in step S201, the model party adds a perturbation value to the value of each leaf node of the tree model to obtain a first ciphertext tree, generates a second ciphertext tree based on the first ciphertext tree, generates a first ciphertext tree model based on the first ciphertext tree, generates a second ciphertext tree model based on the second ciphertext tree, and records the perturbation information and the indication information indicating the output score of the first ciphertext tree model.

[0043] In an implementation, the tree model of the model party can include n decision trees (n>1), for example, as shown in FIG. 3, the tree model includes 5 decision trees Tr1-Tr5.

[0044] FIG. 3 is a structural diagram of a tree model owned by a model side in an embodiment of the present specification. The tree model shown in FIG. 3 is a tree model for classification, which can include three layers of code modules, i.e., a prediction layer, a calculation layer, and an activation layer. The prediction layer can include n decision trees for prediction (trees Tr1-Tr5 are shown in FIG. 3 as an example), and specifically, the prediction layer includes the node structure of each decision tree, the split feature and split value corresponding to each intermediate node, and the node value of each leaf node, etc. The tree model can be a random forest or a gradient boosting tree, etc., which is not limited.

[0045] Taking the gradient boosting tree as an example, the tree model is used to predict the credit rating of a merchant on a transaction platform, for example. The split features of the intermediate nodes in the tree Tr1 include transaction amount, platform registration time, platform transaction times, user rating, and user number, etc., for example. The scores of the leaf nodes of the tree Tr1 are used to indicate partial credit values. The split features of the intermediate nodes in the tree Tr2 include delivery time and refund time, etc., for example. The scores of the leaf nodes of the tree Tr2 are used to indicate partial credit values. Similarly, the scores of the leaf nodes of the trees Tr3-Tr5 are also used to indicate partial credit values.

[0046] When the above tree model is used to make a model prediction for a specific merchant, the feature data of the merchant is obtained, which can include the values of the following features of the merchant: transaction amount, platform registration time, platform transaction times, user rating, user number, delivery time, refund time, etc. The feature data of the merchant can be input into the trees Tr1-Tr5 in the prediction layer, respectively. Specifically, taking the tree Tr1 as an example, for each intermediate node in the tree Tr1, the feature data of the merchant corresponding to the split feature of the intermediate node is compared with the split condition of the intermediate node to determine the child node into which the merchant should be divided, thereby determining the prediction path of the merchant in the tree Tr1 and the leaf node into which the merchant falls, and thereby obtaining the score score1 output by the tree Tr1 for the merchant based on the value of the leaf node into which the merchant falls. Similarly, by inputting the feature data of the merchant into the trees Tr2-Tr5, the scores score2-score5 output by the trees Tr2-Tr5 for the merchant can be obtained. Generally, the tree model has the form of a PMML file, and the output of the model in the form of the PMML file is in the form of a floating-point number, so that the scores output by the tree model have 16 significant digits.

[0047] The calculation layer in the tree model is used to aggregate the scores of the multiple trees output by the prediction layer. It can be understood that the calculation layer is not needed when the prediction layer includes a single tree. The calculation layer receives the scores output by the decision trees from the prediction layer and performs corresponding calculations according to the structure type of the tree model. For example, when the tree model is a random forest model, the calculation layer calculates the mean of score1-score5 as the output score Score of the tree model. When the tree model is a gradient ascent type model, the calculation layer calculates the sum of score1-score5 as the output score Score of the calculation layer.

[0048] Subsequently, the activation layer in the tree model can determine the credit level of the merchant based on the output score of the calculation layer, for example, including trusted and untrusted, or determine the probability of the preset multiple credit levels of the merchant. The activation layer uses, for example, a Sigmoid function for calculation based on the score output by the calculation layer to determine the credit level of the merchant. It can be understood that when the tree model is a regression model, the activation layer can not be included, and the tree model takes the output score of the calculation layer as the output of the tree model.

[0049] For the above tree model including n decision trees, in order to convert the tree model into a ciphertext tree model, first, the model can perturb the values of the leaf nodes of each tree in the prediction layer of the tree model to hide the leaf nodes of the tree model from the data party. For example, if the tree model includes n trees, n random numbers corresponding to the n trees can be generated, and the values of the leaf nodes of each tree are increased by the corresponding random number to obtain n first ciphertext trees. Assuming that the maximum value range of the leaf nodes included in the tree model is [min(score), max(score)] (i.e. the range between the minimum value and the maximum value of the leaf nodes included in the tree model), where score is the set of values of all leaf nodes of the tree model, the n random numbers can be selected within the numerical range [min(score), max(score)].

[0050] For example, for the prediction layer shown in FIG. 3, the model can generate random numbers v1-v5 with respect to trees Tr1-Tr5, respectively, increase the value of each leaf node of tree Tr1 by v1, increase the value of each leaf node of tree Tr2 by v2, and so on to process trees Tr3-Tr5. Wherein v1-v5 are randomly selected between the minimum and maximum values of the leaf node values included in trees Tr1-Tr5. After this perturbation processing, trees Tr1-Tr5 are equivalent to being encrypted into first ciphertext trees. It can be understood that the first ciphertext tree is still a decision tree in plaintext, the split features and split values of the intermediate nodes are in plaintext and are the same as those of the intermediate nodes in the corresponding decision tree, and the values of the leaf nodes are different from those of the leaf nodes of the corresponding decision tree, but are still numerical values in plaintext.

[0051] In addition, the model party also calculates the sum of the n random numbers sum1, for example, for the tree model shown in FIG. 3, calculates sum1 = v1 + v2 + … v5, and records the sum of the random numbers sum1 for subsequent recovery processing of the ciphertext score.

[0052] The model party can regard the above-mentioned n first ciphertext trees as a group of trees, and generate a first ciphertext tree model based on the group of first ciphertext trees. Then generate one or more groups of second ciphertext trees based on the n first ciphertext trees, and generate one or more second ciphertext models based on the one or more groups of second ciphertext trees.

[0053] Among them, the split feature of the intermediate node in the newly added second ciphertext tree can be randomly selected based on the frequency of occurrence of the split feature included in the tree model. For example, the real split feature a1 in the tree model appears 7 times, the real split feature a2 appears 2 times, and the real split feature a3 appears 1 time. When constructing a second ciphertext tree, for an intermediate node, its split feature has a probability of 0.7 for a1, a probability of 0.2 for a2, and a probability of 0.1 for a3. It can be understood that the second ciphertext tree can also include split features that do not appear in the tree model. After determining the split feature of the intermediate node in the second ciphertext tree, if the split feature is included in the tree model, the split value of the split feature of the intermediate node can be randomly selected within the range of the maximum value of the split feature in the tree model (i.e. the range before the minimum value and the maximum value of the split feature). If the split feature does not appear in the tree model, the split value of the split feature can be randomly selected in the range (0, 1).

[0054] The depth of the second ciphertext tree can be randomly selected based on the depth of the decision tree included in the tree model and its frequency of occurrence.

[0055] The value of the leaf node in the second ciphertext tree can be randomly selected within the range of the maximum value of the leaf node of the above-mentioned n first ciphertext trees [min(score'), max(score')], where score' is the set of values of the leaf nodes of the above-mentioned first ciphertext trees. The split feature, split value and value of the leaf node of the intermediate node in each of the above-mentioned second ciphertext trees are also in plaintext. That is, the first ciphertext tree model and the second ciphertext tree model are both plaintext tree models.

[0056] Alternatively, the modeler can divide the n first ensembles into g groups. In one implementation, if n is divisible by g, each group can include n / g first ensembles; if n is not divisible by g, assuming the quotient of n / g is k, then among the g groups, some groups include k first ensembles and some groups include k+1 first ensembles. For example, for the tree model as shown in FIG. 3, the modeler can divide the 5 first ensembles corresponding to the trees Tr1-Tr5 into two groups, one group includes 2 first ensembles and the other group includes 3 first ensembles.

[0057] After that, the modeler can generate g first ensemble models based on the g groups of first ensembles. Then the modeler can generate m groups of second ensembles based on the n first ensembles, and generate m second ensemble models based on the m groups of second ensembles, in a similar manner as described above. The number of second ensembles in the m groups of second ensembles can be determined based on the number of first ensembles in the g groups, for example, can include k or k+1 second ensembles.

[0058] FIG. 4 is a structural diagram of multiple ensemble models in an embodiment of the present specification. As shown in FIG. 4, for the tree model as shown in FIG. 3, the modeler can generate a first ensemble model EM1, a second ensemble model EM2, a first ensemble model EM3, and a second ensemble model EM4. Each ensemble model includes a prediction layer and a calculation layer, the prediction layer includes multiple ensembles, and the calculation layer is similar to the calculation layer shown in FIG. 3, and is used to aggregate the ensemble scores output by the multiple ensembles to obtain an ensemble model score. The order of the first ensemble model EM1, the second ensemble model EM2, the first ensemble model EM3, and the second ensemble model EM4 is determined randomly after the multiple first ensemble models and the multiple second ensemble models are generated as described above.

[0059] Specifically, the first ensemble model EM1 includes a first ensemble Etr11 corresponding to the decision tree Tr1 and a first ensemble Etr12 corresponding to the decision tree Tr2, and the third ensemble model EM3 includes a first ensemble Etr33 corresponding to the decision tree Tr3, a first ensemble Etr34 corresponding to the decision tree Tr4, and a first ensemble Etr35 corresponding to the decision tree Tr5.

[0060] The second ensemble model EM2 includes a newly added second ensemble Etr21, a second ensemble Etr22, and a second ensemble Etr23, and the fourth ensemble model EM4 includes a newly added second ensemble Etr41 and a second ensemble Etr42.

[0061] It can be understood that, although the tree shapes (i.e. the depth of the tree, the number of intermediate nodes, the number of leaf nodes, the connection structure between nodes, etc.) of each first ciphertext tree in FIG. 4 are the same, and the tree shapes of each second ciphertext tree are the same, it can be understood that this is only exemplary, and in practice, each first ciphertext tree can have a different tree shape, and each second ciphertext tree can have a different tree shape.

[0062] After generating the plurality of ciphertext tree models as shown in FIG. 4, the modeler can record indication information indicating the output score of the first ciphertext tree model in the plurality of ciphertext tree models. In an embodiment, the modeler can record the identification of the first ciphertext tree model in the plurality of ciphertext tree models, such as "EM1, EM3". In another embodiment, the modeler can record a vector corresponding to a specific arrangement order of the numbers in the ciphertext tree model identification, for example (1, 0, 1, 0), which corresponds to the order from small to large of the numbers in the ciphertext tree model identification, 1 is used to indicate that the corresponding ciphertext tree model is the first ciphertext tree model, and 0 is used to indicate that the corresponding ciphertext tree model is the second ciphertext tree model.

[0063] In another embodiment, as shown in FIG. 1, the modeler can include a decision tree in the tree model, and add different perturbation values to each leaf node of the tree model, or add the same perturbation value, to obtain a first ciphertext tree, and record the information of the perturbation value, for example, in the case of adding different perturbation values to different leaf nodes, the perturbation value can be recorded corresponding to the identification of each leaf node. Then, as shown on the right side of FIG. 1, the modeler can generate a first ciphertext tree model based on the first ciphertext tree.

[0064] After that, the modeler can add one or more second ciphertext trees similarly as described above, and generate a second ciphertext tree model based on the one or more second ciphertext trees. In this case, compared with the ciphertext tree model shown in FIG. 4, the ciphertext tree model in this embodiment does not need to include a calculation layer. The modeler can accordingly record indication information indicating the output score of the first ciphertext tree model in the plurality of ciphertext tree models.

[0065] It can be understood that the modeler can prepare the ciphertext tree model corresponding to the tree model in advance through the above process for use by the plurality of data parties, so this step S201 is not a necessary step when performing model prediction.

[0066] In step S203, the modeler sends the plurality of ciphertext tree models to the data parties.

[0067] Referring to the above description, in an embodiment, the plurality of ciphertext tree models sent by the modeler can include any of the following cases:

[0068] one first ciphertext tree model and one second ciphertext tree model;

[0069] a first encryption model and a plurality of second encryption models; and

[0070] a plurality of first encryption models and a plurality of second encryption models.

[0071] The first encryption model can include one or more first encryption trees, and the second encryption model can include one or more second encryption trees.

[0072] The identifiers of the first encryption model and the second encryption model in the plurality of encryption models have the same format, such as EM1, EM2, etc., and the identifiers of the first encryption model and the second encryption model are randomly determined.

[0073] In addition, the model party randomly determines the sending order or arrangement order of the plurality of encryption models when sending the plurality of encryption models to the data party.

[0074] In step S205, the data party performs prediction based on the plurality of encryption models to obtain a plurality of encryption model scores.

[0075] In an embodiment, as shown in FIG. 4, after receiving the encryption models, the data party inputs the feature data of the merchant into each encryption tree in the prediction layer of each encryption model, respectively, to obtain the encryption tree scores output by each encryption tree. Specifically, in the first encryption model EM1, the first encryption tree Etr11 outputs an encryption tree score Escore11 with respect to the feature data, and the first encryption tree Etr12 outputs an encryption tree score Escore12 with respect to the feature data. The calculation layer in the first encryption model EM1 aggregates the encryption tree scores Escore11 and Escore12 to obtain an encryption model score Escore1. Similarly, in the second encryption model EM2, each second encryption tree outputs an encryption tree score Escore21-Escore23, respectively. The calculation layer in the second encryption model EM1 aggregates the encryption tree scores to obtain an encryption model score Escore2. In the first encryption model EM3, each first encryption tree outputs an encryption tree score Escore33-Escore35, respectively. The calculation layer in the first encryption model EM3 aggregates the encryption tree scores to obtain an encryption model score Escore3. In the second encryption model EM4, each second encryption tree outputs an encryption tree score Escore41-Escore42, respectively. The calculation layer in the second encryption model EM4 aggregates the encryption tree scores to obtain an encryption model score Escore4.

[0076] In step S207, the data party sends the plurality of encryption model scores to the model party.

[0077] In an embodiment, the data party can arrange the scores of the plurality of ciphertext models in the order of the numbers of the plurality of ciphertext models, and send the plurality of scores arranged in the order to the model party. For example, the data party can send Escore1, Escore2, Escore3 and Escore4 arranged in the order to the model party.

[0078] In an embodiment, the data party can send the identities of the plurality of ciphertext models and the corresponding scores of the plurality of ciphertext models to the model party. For example, the data party can send EM1:Escore1, EM2:Escore2, EM3:Escore3 and EM4:Escore4 to the model party.

[0079] In step S209, the model party obtains the score of the first ciphertext tree model from the plurality of scores of the ciphertext models based on the indication information, and obtains the predicted score of the tree model by processing the score of the ciphertext model based on the perturbation information.

[0080] In an embodiment, the data party arranges the scores of the plurality of ciphertext tree models (Escore1, Escore2, Escore3 and Escore4) in the order of the numbers of the plurality of ciphertext tree models, and the indication information recorded by the model party is a vector (1, 0, 1, 0) corresponding to the order of the numbers of the plurality of ciphertext models. The model party can perform an inner product of the vector composed of the scores of the ciphertext models and the vector of the perturbation information, so as to obtain the score of the first ciphertext tree model from the plurality of scores of the ciphertext models, and add the scores to obtain Escore1+Escore3. The model party subtracts the perturbation information, for example, sum1 described above, from Escore1+Escore3, so as to obtain the predicted score Score of the tree model.

[0081] In another embodiment, the plurality of scores of the ciphertext models includes a score of a first ciphertext tree model, and the model party obtains the score of the first ciphertext tree model from the plurality of scores of the ciphertext models according to the indication information, and adds the corresponding perturbation value to the score of the ciphertext model, so as to obtain the predicted score of the tree model.

[0082] In the case where the tree model includes an activation layer as shown in FIG. 2, the model party can run the sigmoid function so as to obtain a binary classification prediction result according to the value of y.

[0083] In the scheme of using the tree model in the embodiments of the present specification, the tree model is converted into a plurality of ciphertext tree models and sent to the data party for model prediction, so as to comprehensively protect the intermediate nodes and leaf nodes of the tree model and protect the model security.

[0084] Further, in the case of converting the tree model into the plurality of first ciphertext tree models and the plurality of second ciphertext tree models, the model party cannot learn the score of each tree in the tree model, and user privacy is protected.

[0085] In addition, in the embodiments of the present specification, the ciphertext tree model is kept in the standard PMML format, so that the data party can directly use the ciphertext tree model for model prediction without other modifications. In addition, in the embodiments of the present specification, only the plurality of ciphertext tree models (i.e., the plurality of PMML files) are used for prediction, which ensures sufficient accuracy of the prediction result.

[0086] FIG. 5 is a device using a tree model according to an embodiment of the present specification, which is deployed in a model party, and the tree model includes a decision tree, and the device includes:

[0087] The sending unit 51 is configured to send, to a data party, a plurality of ciphertext tree models corresponding to a tree model, the plurality of ciphertext tree models including a first ciphertext tree model and a second ciphertext tree model, the first ciphertext tree model including a first ciphertext tree, the second ciphertext tree model including a second ciphertext tree, the first ciphertext tree being generated by adding a perturbation value to a value of each leaf node of the decision tree, the second ciphertext tree being generated based on the first ciphertext tree, the model party recording indication information and perturbation information corresponding to the perturbation value, the indication information being used to indicate a ciphertext model score corresponding to the first ciphertext tree model in a plurality of ciphertext model scores output by the plurality of ciphertext tree models;

[0088] The receiving unit 52 is configured to receive, from the data party, a plurality of ciphertext model scores output by the plurality of ciphertext tree models for feature data of a target object;

[0089] The obtaining unit 53 is configured to obtain, based on the indication information, a first ciphertext model score corresponding to the first ciphertext tree model from the plurality of ciphertext model scores;

[0090] The processing unit 54 is configured to process the first ciphertext model score based on the perturbation information to obtain a prediction result of the tree model.

[0091] The embodiments of the present specification also provide a computer-readable storage medium having a computer program stored thereon, when the computer program is executed in a computer, the computer program causes the computer to execute the method shown in FIG. 2.

[0092] The embodiments of the present specification also provide a computing device including a memory and a processor, the memory having executable code stored therein, and the processor implements the method shown in FIG. 2 when executing the executable code.

[0093] The embodiments of the present specification are used to provide a computer program product comprising computer programs / instructions which, when executed by a processor, implement the steps of the method as shown in FIG. 2.

[0094] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0095] The controller can be implemented in any suitable way, for example, the controller can take the form of, for example, a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code form, the controller can perfectly well be implemented to perform the same functions in the form of logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of logical programming of the method steps. Such a controller can thus be considered a hardware component, and the means comprised therein for performing the various functions can also be considered structures within the hardware component. Alternatively, or even, the means for performing the various functions can be considered both software modules implementing the method and structures within the hardware component.

[0096] The systems, apparatuses, modules or units illustrated by the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, computers implementing the functions of the above embodiments can be personal computers, laptop computers, vehicle-mounted human-computer interaction devices, cellular phones, camera phones, smart phones, personal digital assistants, media players, navigation devices, electronic mail devices, game consoles, tablet computers, wearable devices, or combinations of any of these devices.

[0097] Although the method operational steps are provided in one or more embodiments herein in the order listed, other embodiments could include fewer or more steps and / or different ordering of the steps, based on the common or inventive concepts. The order in which steps are listed is merely one example of the ordering of the steps. The steps listed in the embodiments can be performed in an order different than the order listed, or performed in parallel, in some embodiments. The term "comprising" or "including" or any other variant is intended to cover a non-exclusive inclusion, such that processes, methods, articles, or apparatuses that comprise a list of elements are not required to comprise only those elements on the list, but can include other elements not expressly listed, or inherent to such processes, methods, articles, or apparatuses. The term "an" or "one" is intended to be inclusive of the singular and plural, unless otherwise indicated. For example, the articles "a" or "an" as used in the specification and claims are to be construed as meaning "one or more" unless otherwise indicated.

[0098] For the convenience of description, the above apparatus is described in various modules according to functions. Of course, when implementing one or more of the embodiments, the functions of the modules can be implemented in one or more software and / or hardware, or the modules implementing the same function can be combined to implement a module or a sub-module, etc. The apparatus embodiments described above are merely illustrative, for example, the division of the modules is merely a logical function division, and actual implementation can have another division manner, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed modules can be indirect coupling or communication connection through some interfaces, devices or modules, and can be electrical, mechanical or other forms.

[0099] The present application is described with reference to the flowcharts and / or block diagrams of the methods, apparatus (systems) and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce the functions specified in one or more flows in the flowcharts and / or one or more blocks in the block diagrams.

[0100] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0101] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart or flowsheets and / or block or blocks of the block diagrams.

[0102] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0103] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), flash memory, or other memory technologies, about which the processor can execute instructions. The memory is an example of computer readable media.

[0104] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0105] Those skilled in the art will appreciate that the one or more embodiments described herein can be provided as a method, a system or a computer program product. Accordingly, the one or more embodiments described herein can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the one or more embodiments described herein can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable code.

[0106] The one or more embodiments described herein can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The one or more embodiments described herein can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0107] The various embodiments described in this specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform particular tasks or implement particular abstract data types. The various embodiments described in this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including memory storage devices.

[0108] The above description is only some embodiments of the one or more embodiments described in this specification and is not intended to limit the one or more embodiments described in this specification. Those skilled in the art can make various modifications and changes to the one or more embodiments described in this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the one or more embodiments described in this specification shall be included in the scope of the claims.

Claims

1. A method for using a tree model, performed by a model party, the tree model comprising a decision tree, the method comprising: sending, to a data party, a plurality of ciphertext tree models corresponding to the tree model, the plurality of ciphertext tree models comprising a first ciphertext tree model and a second ciphertext tree model, the first ciphertext tree model comprising a first ciphertext tree, the second ciphertext tree model comprising a second ciphertext tree, the first ciphertext tree being generated by adding a perturbation value to a value of each leaf node of the decision tree, the second ciphertext tree being generated based on the first ciphertext tree, the model party recording indication information and perturbation information corresponding to the perturbation value, the indication information being used to indicate a ciphertext model score corresponding to the first ciphertext tree model in a plurality of ciphertext model scores output by the plurality of ciphertext tree models; receiving, from the data party, a plurality of ciphertext model scores output by the plurality of ciphertext tree models for feature data of a target object; based on the indication information, obtaining a first ciphertext model score corresponding to the first ciphertext tree model from the plurality of ciphertext model scores; processing the first ciphertext model score based on the perturbation information to obtain a prediction result of the tree model.

2. The method of claim 1, wherein the tree model comprises n decision trees, the perturbation information comprises a sum of n random numbers, and the n random numbers correspond to the n decision trees respectively; the plurality of ciphertext tree models comprise g first ciphertext tree models, the first ciphertext tree models comprise one or more first ciphertext trees, and the plurality of ciphertext model scores comprise g first ciphertext model scores; calculating a sum of the g first ciphertext model scores, and subtracting the sum of the n random numbers from the sum of the g first ciphertext model scores to obtain a prediction score of the tree model. The processing of the ciphertext model score based on the disturbance information includes:

3. The method of claim 1 or 2, wherein a value range of the perturbation value is greater than or equal to a first value and less than or equal to a second value, the first value being a minimum value among values of all leaf nodes included in the tree model, and the second value being a maximum value among the values of all the leaf nodes included in the tree model.

4. The method of claim 2, wherein a value range of a leaf node of the second ciphertext tree is greater than or equal to a third value and less than or equal to a fourth value, the third value being a minimum value among perturbed values of all leaf nodes included in the tree model, and the fourth value being a maximum value among the perturbed values of all the leaf nodes included in the tree model.

5. The method of claim 5, wherein a split feature included in the second ciphertext tree is determined based on split features included in the n decision trees and a number of occurrences of the split features, and a split value of each split feature in the second ciphertext tree is selected based on a value range of a split value of the split feature in the n decision trees.

6. The method of claim 2, wherein each first ciphertext tree model comprises k first ciphertext trees or k+1 first ciphertext trees, the k being determined based on n and g, and each second ciphertext tree model comprises k or k+1 second ciphertext trees. ​ 7. The method of claim 2, wherein the plurality of ciphertext tree models comprises m second ciphertext tree models, and wherein the indication information comprises a sequence of indication values corresponding to the order determined randomly.

8. The method of claim 2, wherein the tree model comprises an activation layer configured to perform classification based on a score output by the decision tree, and wherein the method further comprises: inputting the predicted score into the activation layer to obtain a classification result of the target object. The processing of the ciphertext score based on the disturbance information comprises:

9. The method of claim 8, wherein the method further comprises: adding a perturbation value to a value of each leaf node of the decision tree to obtain a first ciphertext tree, generating a second ciphertext tree based on the first ciphertext tree, generating a first ciphertext tree model based on the first ciphertext tree, generating a second ciphertext tree model based on the second ciphertext tree, and recording perturbation information corresponding to the perturbation value and the indication information.

9. The method of claim 1, further comprising:

10. An apparatus for using a tree model, deployed at a model side, wherein the tree model comprises a decision tree, and wherein the apparatus comprises: a sending unit configured to send, to a data side, a plurality of ciphertext tree models corresponding to the tree model, wherein the plurality of ciphertext tree models comprises a first ciphertext tree model and a second ciphertext tree model, wherein the first ciphertext tree model comprises a first ciphertext tree, wherein the second ciphertext tree model comprises a second ciphertext tree, wherein the first ciphertext tree is generated by adding a perturbation value to a value of each leaf node of the decision tree, wherein the second ciphertext tree is generated based on the first ciphertext tree, wherein the model side records indication information and perturbation information corresponding to the perturbation value, and wherein the indication information is used to indicate a ciphertext model score corresponding to the first ciphertext tree model in a plurality of ciphertext model scores output by the plurality of ciphertext tree models; a receiving unit configured to receive, from the data side, a plurality of ciphertext model scores output by the plurality of ciphertext tree models for feature data of a target object; an obtaining unit configured to obtain, based on the indication information, a first ciphertext model score corresponding to the first ciphertext tree model from the plurality of ciphertext model scores; a processing unit configured to process the first ciphertext model score based on the perturbation information to obtain a prediction result of the tree model.

11. A computer program product comprising computer programs / instructions, which, when executed by a processor, implement the steps of the method of any one of claims 1-9.

12. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and wherein the processor, when executing the executable codes, implements the method of any one of claims 1-9. ​ ​ ​

Images