Ai model running method, computing system, product, and storage medium

Abstract

The present application relates to the technical field of AI, and provides an AI model running method, a computing system, a product, and a storage medium. In the method, a first computing system performs homomorphic encryption on some layers of an AI model to obtain encrypted layers, and sends the encrypted layers to a second computing system; the second computing system acquires encrypted data obtained after homomorphic encryption, runs the encrypted data on the encrypted layers to obtain a homomorphic operation result of the encrypted layers on the encrypted data, and sends the homomorphic operation result to the first computing system; and the first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the remaining unencrypted layers in the AI model to obtain a running result of the AI model. In view of the above, both data and model parameters received by the second computing system are in a ciphertext state, and the second computing system can perform the homomorphic operation in the ciphertext state to obtain the homomorphic operation result, thereby achieving privacy protection of the model parameters while achieving privacy protection of user data.

Description

AI model operation methods, computing systems, products and storage media

[0001] This application claims priority to Chinese Patent Application No. 202510300013.9, filed on March 13, 2025, entitled "Method for Running an AI Model, Computing System, Product and Storage Medium", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of artificial intelligence technology, and in particular to a method for operating an AI model, a computing system, a product, and a storage medium. Background Technology

[0003] In recent years, artificial intelligence (AI) technology has been widely used in fields such as image recognition, speech recognition, and natural language translation. The protection of user data privacy and the security of AI model parameters in AI applications has also received increasing attention.

[0004] In privacy-preserving computing technologies, homomorphic encryption (HE) can directly perform operations on encrypted data without prior decryption or obtaining the key, thus fully protecting the privacy of the processed content. Therefore, combining homomorphic encryption algorithms with AI models to perform AI computations on encrypted data can guarantee both data privacy and computational accuracy. For example, after a user encrypts data using a homomorphic encryption algorithm and sends it to an AI computing power provider, the provider can run an AI model based on the homomorphic encryption algorithm without decryption, obtain the encrypted result, and return it to the user.

[0005] However, the above methods do not provide encryption protection for the AI ​​model. When the AI ​​computing power provider and the AI ​​model provider are different, there is a risk of leakage of AI model parameters, and the security of the AI ​​model cannot be guaranteed. Summary of the Invention

[0006] This application provides a method for running an AI model, a computing system, a product, and a storage medium, which can protect the privacy of both user data and model parameters. The technical solution is shown below.

[0007] Firstly, a method for operating an artificial intelligence (AI) model is provided, applied to an AI service system. The AI ​​service system includes a first computing system and a second computing system. The first computing system deploys the AI ​​model and is also referred to as the AI ​​model provider. The second computing system provides computing resources to the AI ​​service system and is also referred to as the AI ​​computing power provider. The method includes:

[0008] The second computing system acquires the homomorphically encrypted data;

[0009] The first computing system performs homomorphic encryption on the first part of the AI ​​model to obtain a first encryption layer, and sends the first encryption layer to the second computing system. The first part includes at least one layer of the AI ​​model.

[0010] The second computing system runs encrypted data on the first encryption layer, obtains the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result back to the first computing system;

[0011] The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result. The second part includes the layers of the AI ​​model other than the first part.

[0012] In the above method, the first and second computing systems in the AI ​​service system collaboratively run the AI ​​model. After the second computing system receives homomorphically encrypted data and the first encryption layer sent by the first computing system, it runs the encrypted data on the first encryption layer to obtain the homomorphic operation result of the first encryption layer on the encrypted data. The homomorphic operation result is then sent to the first computing system, which decrypts the result to obtain decrypted data. This decrypted data is then run on the second part of the AI ​​model to obtain the model's execution result. It is evident that for the second computing system, both the received data and model parameters are in ciphertext. The second computing system can perform homomorphic operations in ciphertext to obtain homomorphic operation results. Since homomorphic encryption supports computation in ciphertext, the homomorphic operation result after decryption is consistent with the result calculated in plaintext. Therefore, this method not only ensures the accuracy of model operation but also protects the privacy of model parameters while protecting user data privacy.

[0013] In addition, this approach divides the AI ​​model into two parts. The first part, for example, is the linear computation layer of the AI ​​model. The first computing system performs homomorphic encryption to obtain the first encrypted layer and sends it to the second computing system. The second part, for example, is the nonlinear computation layer of the AI ​​model. It is stored locally in the first computing system. By encrypting the finite layers of the AI ​​model, the errors caused by using homomorphic encryption algorithms to encrypt the nonlinear computation layer can be avoided, thus ensuring the accuracy of the AI ​​model's calculations.

[0014] In some embodiments, the second computing system acquires homomorphically encrypted data, including: the second computing system responding to an inference request to acquire encrypted data; the method further includes: the first computing system sending the running result to the sender of the inference request.

[0015] By applying the above methods to AI model operation scenarios, not only can the accuracy of model inference be guaranteed, but the privacy of model parameters can also be protected while protecting user data privacy.

[0016] In some embodiments, the second computing system acquires homomorphically encrypted data, including: the second computing system responding to a training request to acquire encrypted data; the method further includes: the first computing system performing a parameter update operation based on the running results to obtain an updated AI model; the first computing system performing homomorphic encryption on a first part of the updated AI model to obtain a second encryption layer, and sending the second encryption layer to the second computing system to perform iterative training.

[0017] By applying the above methods to AI model training scenarios, not only can the accuracy of model training be guaranteed, but the privacy of user data and model parameters can also be protected. Furthermore, training the AI ​​model through the collaboration of the first and second computing systems effectively conserves the local computing power of the first computing system.

[0018] In some embodiments, the first part includes at least one linear computation layer of the AI ​​model, and the second part includes at least one nonlinear computation layer of the AI ​​model.

[0019] By encrypting the linear computation layers in the AI ​​model, on the one hand, only a limited number of layers of the AI ​​model are encrypted, without needing to encrypt all network layers, thus supporting an unlimited number of network layers; on the other hand, it avoids the errors caused by using homomorphic encryption algorithms to encrypt nonlinear computation layers, ensuring the accuracy of AI model calculations.

[0020] In some embodiments, the method further includes: the first computing system acquiring an encryption key and a decryption key;

[0021] The first computing system performs homomorphic encryption on the first part of the AI ​​model to obtain a first encryption layer, including: the first computing system uses an encryption key to perform homomorphic encryption on the first part to obtain the first encryption layer;

[0022] The first computing system decrypts the homomorphic operation result to obtain decrypted data, including: the first computing system uses a decryption key to decrypt the homomorphic operation result to obtain decrypted data.

[0023] In this way, the first computing system, which is equipped with the AI ​​model, obtains the key related to homomorphic encryption, ensuring that only the first computing system can use the key to encrypt the model parameters and decrypt the results of the homomorphic operation, thus achieving privacy protection of the model parameters.

[0024] In some embodiments, the method further includes: a first computing system obtaining a homomorphic operation key; the first computing system using a decryption key to decrypt the homomorphic operation result to obtain decrypted data, including: the first computing system using the homomorphic operation key to perform a homomorphic transformation on the homomorphic operation result to obtain a homomorphic transformed homomorphic operation result, and using the decryption key to decrypt the homomorphic transformed homomorphic operation result to obtain decrypted data.

[0025] In some embodiments, the method further includes: a second computing system obtaining a homomorphic operation key; the second computing system running encrypted data on a first encryption layer to obtain a homomorphic operation result of the first encryption layer on the encrypted data, and sending the homomorphic operation result to the first computing system, including: the second computing system running encrypted data on a first encryption layer to obtain a homomorphic operation result of the first encryption layer on the encrypted data, performing a homomorphic transformation on the homomorphic operation result using the homomorphic operation key to obtain a homomorphic transformed homomorphic operation result, and sending the homomorphic transformed homomorphic operation result to the first computing system; the first computing system decrypting the homomorphic operation result using a decryption key to obtain decrypted data, including: the first computing system decrypting the homomorphic transformed homomorphic operation result using the decryption key to obtain decrypted data.

[0026] The homomorphic operation key is used to support homomorphic transformations of ciphertext. For example, a large number of intermediate results are generated during homomorphic operations. These intermediate results may need to be re-encoded, combined, reduced in dimensionality, or transformed in other ways for subsequent computations. The homomorphic operation key is responsible for performing corresponding operations on the intermediate results, ensuring that they can correctly participate in subsequent homomorphic computations and ultimately yield the correct plaintext computation result through decryption. In this way, the homomorphic operation key can be provided to the first computing system, where both the first and second computing systems jointly complete the homomorphic operation, saving the computing resources of the second computing system; alternatively, it can be provided to the second computing system, where it completes the entire homomorphic operation, saving the computing resources of the first computing system.

[0027] In a second aspect, a computing system is provided, which includes at least one functional module for implementing the functions of the second computing system in the method of running an AI model as provided in the first aspect or any possible implementation of the first aspect.

[0028] Thirdly, this application provides a computer program product for implementing a method of running an AI model as provided in the first aspect or any possible implementation thereof.

[0029] Fourthly, this application provides a computer-readable storage medium for storing at least one piece of program code, which implements a method for running an AI model as provided in the first aspect or any possible implementation thereof. This storage medium includes, but is not limited to, volatile memory, such as random access memory, and non-volatile memory, such as flash memory, hard disk drive (HDD), and solid-state drive (SSD). Attached Figure Description

[0030] Figure 1 is a schematic diagram of an implementation environment provided in an embodiment of this application;

[0031] Figure 2 is a schematic diagram of the hardware structure of a computing device provided in an embodiment of this application;

[0032] Figure 3 is a schematic diagram illustrating the combination of homomorphic encryption algorithm and AI model provided in an embodiment of this application;

[0033] Figure 4 is a schematic diagram of an AI service system provided in an embodiment of this application;

[0034] Figure 5 is a flowchart of an AI model operation method provided in an embodiment of this application;

[0035] Figure 6 is a flowchart of an AI model inference method provided in an embodiment of this application;

[0036] Figure 7 is a flowchart of an AI model training method provided in an embodiment of this application;

[0037] Figure 8 is a schematic diagram of the structure of a computing system provided in an embodiment of this application. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings. It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the inference requests, training requests, and artificial intelligence models involved in this application are all obtained under fully authorized conditions.

[0039] To facilitate understanding, the key terms and concepts involved in this application will be explained below.

[0040] Artificial intelligence (AI) models are a class of mathematical algorithm models that use machine learning concepts to solve practical problems. Typically, AI models include a large number of parameters and computational formulas (or rules). For example, AI models include various types such as neural networks, decision trees, support vector machines, Bayesian networks, and genetic algorithms. These different types of models are each suitable for different tasks and data characteristics.

[0041] Neural networks (NNs) consist of a set of interconnected units called neurons, which can receive and send signals. Neural networks originated from the concept of neural tissue in the brain, and mathematical models built to mimic biological neural networks are called artificial neural networks (ANNs). AI models based on neural networks learn from data to adjust the connection weights between neurons, thereby achieving functions such as feature extraction, pattern recognition, and prediction of input data.

[0042] An activation function is a function that runs on neurons in an artificial neural network. It is responsible for mapping the inputs of the neurons to their outputs and is designed to help the network learn complex patterns in the data.

[0043] Homomorphic encryption is a form of encryption that allows computations to be performed directly on ciphertext data without prior decryption. The computations supported by homomorphic encryption algorithms are called homomorphic operations, also known as homomorphic evaluations. These refer to various types of operations performed on ciphertext data under homomorphic encryption, such as addition, multiplication, or other more complex computations. Currently, homomorphic encryption algorithms can be categorized based on the types and degrees of homomorphic computations they support: partially homomorphic encryption algorithms, hierarchically homomorphic encryption algorithms, and fully homomorphic encryption algorithms. Partially homomorphic encryption algorithms support a specific type of homomorphic operation, typically addition or multiplication. Hierarchically homomorphic encryption algorithms support multiple homomorphic operations at a finite depth on ciphertext data, such as combinations of addition and multiplication. Fully homomorphic encryption algorithms support any number of computations of any type (such as addition, multiplication, logical operations, etc.) on ciphertext data, and the decrypted result is identical to the result of the same computation performed on the plaintext.

[0044] Privacy-preserving refers to the measures (such as encryption or other technical means) taken during data processing, information sharing, and technology application to protect the privacy information of individuals, organizations, or specific entities from being disclosed, misused, or accessed without authorization. In some scenarios, computing modes that do not disclose the privacy information of data during the execution of computing tasks are called privacy-preserving computing.

[0045] A computing card, also known as an acceleration chip, acceleration device, accelerator, or simply acceleration card, is a specialized hardware device or computer system designed to accelerate computation in AI scenarios. In this application, a computing card may be, for example, a graphics processing unit (GPU), a neural network processing unit (NPU), an intelligent processing unit (IPU), a tensor processing unit (TPU), a domain-specific architecture (DSA) chip, and so on, but is not limited to these.

[0046] The application scenarios and implementation environment of this application are described below.

[0047] This application applies to scenarios that combine homomorphic encryption algorithms and AI models to perform AI computations on encrypted data. The application does not limit the type of AI model. For example, the AI ​​model is a neural network-based model applied in fields such as speech processing, text processing, video processing, or audio processing. Specific application scenarios include, but are not limited to, healthcare, education, finance, and information recommendation.

[0048] Figure 1 is a schematic diagram of an implementation environment provided in an embodiment of this application. As shown in Figure 1, the implementation environment includes an AI service system 100, which includes a request sending end 101, a first computing system 102, and a second computing system 103. The request sending end 101, the first computing system 102, and the second computing system 103 are connected by communication via wired or wireless networks.

[0049] The request sender 101 is used to initiate a request to run the AI ​​model, such as an inference request or a training request. In some embodiments, the request sender 101 is a terminal device or server used by a user. Taking a terminal device as an example, the terminal device runs a client or application that provides an interface for the user to interact with the AI ​​service system 100. Illustratively, the user can operate the terminal device to input data required for AI inference or AI training, such as text, images, or voice, triggering the terminal device to initiate an inference request or a training request for the AI ​​model. The terminal device can be a smartphone, game console, desktop computer, augmented reality terminal, tablet computer, e-book reader, laptop computer, or IoT device, etc., and is not limited thereto. It should be noted that the number of request senders 101 shown in the figure is only illustrative and does not constitute a limitation of this application. The number of request senders 101 can be dozens, hundreds, or more, or fewer.

[0050] The first computing system 102 deploys AI models, also known as model providers. For example, it develops, trains, and optimizes AI models to achieve specific AI tasks. The first computing system 102 is also used to maintain and update AI models, promptly fix problems in the AI ​​models, improve their performance, and so on. Illustratively, the first computing system 102 can be an AI R&D team, research institution, or AI model provider. For example, the first computing system 102 owns and manages computing devices that support AI models, enabling model training and testing, such as computing card clusters, physical server clusters, etc. Alternatively, the first computing system 102 can also build its own R&D and operating environment on a cloud platform, renting virtual machines, storage, and computing resources from the cloud platform to develop, train, and deploy models in a virtual environment; this application does not limit this.

[0051] The second computing system 103 provides computing resources to the AI ​​service system 100 to support the operation of the AI ​​model. The second computing system 103 is also referred to as a computing power provider. The second computing system 103 typically owns and manages large-scale computing devices, such as computing card clusters and server clusters. For example, the second computing system 103 can also be a cloud data center, cloud computing platform, or cloud server. A cloud computing platform, or cloud platform for short, refers to a service based on hardware and software resources that provides computing, networking, and storage capabilities. Through the network "cloud," massive amounts of data are processed and analyzed remotely before being returned to the user, featuring large scale, distributed computing, virtualization, high availability, scalability, on-demand service, and security. Cloud servers can achieve rapid deployment and release of configurable computing resources with relatively low management costs or low interaction complexity between users and service providers. In some embodiments, the cloud platform uses virtualization technology to virtualize physical computing resources into multiple virtual instances for different tasks. Automated management tools are used to configure, monitor, and manage computing resources. This application is not limited to utilizing distributed computing and parallel computing technologies to improve computing efficiency.

[0052] In this application, the AI ​​service system 100 supports homomorphic encryption algorithms. The request sender 101, the first computing system 102, and the second computing system 103 can collaboratively implement the inference or training process of the AI ​​model based on homomorphic encryption algorithms, thereby achieving privacy protection for user data and AI model parameters. This application does not limit the specific implementation form of the homomorphic encryption algorithm. For example, a fully homomorphic encryption algorithm can be used, supporting arbitrary number and type of calculations on the encrypted data, applicable to various types of AI models, thus improving the universality of the solution.

[0053] Furthermore, the aforementioned wireless or wired networks utilize standard communication technologies and / or protocols. These networks include, but are not limited to, data center networks, storage area networks (SANs), local area networks (LANs), metropolitan area networks (MANs), wide area networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some implementations, technologies and / or formats, including Hypertext Markup Language (HTML) and Extensible Markup Language (XML), are used to represent data exchanged over the network. Additionally, conventional encryption technologies such as Secure Sockets Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPsec) can be used to encrypt all or part of the link. In other embodiments, customized and / or dedicated data communication technologies can replace or supplement the aforementioned data communication technologies.

[0054] Based on the above implementation environment, this application provides a computing device that can be configured as any computing node in the aforementioned terminal device, independent physical server, or cloud data center, etc. Accordingly, the AI ​​model operation method provided in this application can be collaboratively executed by a first computing device cluster consisting of at least one computing device and a second computing device cluster consisting of at least one computing device. The first computing device cluster is used to implement the functions of the first computing system 102, and the second computing device cluster is used to implement the functions of the second computing system 103. Schematically, referring to FIG2, FIG2 is a schematic diagram of the hardware structure of a computing device provided in an embodiment of this application. As shown in FIG2, the computing device 200 includes a memory 201, a processor 202, a communication interface 203, and a bus 204. The memory 201, processor 202, and communication interface 203 are interconnected via the bus 204.

[0055] The memory 201 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or it may be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Indicatively, the memory 201 is used to store at least one piece of program code. When the program code stored in the memory 201 is executed by the processor 202, the processor 202 executes the method for running the AI ​​model provided in the following method embodiments.

[0056] The processor 202 can be a network processor (NP), a central processing unit (CPU), a graphics processing unit (GPU), an application-specific integrated circuit (ASIC), or an integrated circuit used to control the execution of the program in this application. The processor 202 can be a single-core processor or a multi-core processor. The number of processors 202 can be one or more. For example, depending on the actual needs of point cloud data processing, the computing device 200 may include multiple processors 202, each of which may include one or more processor cores. These multiple processors 202 may include CPUs, GPUs, neural network processing units (NPUs), intelligent processing units (IPUs), tensor processing units (TPUs), domain-specific architecture (DSA) chips, and so on, and are not limited to these. Among them, a GPU, also known as a display core, visual processor, or display chip, is a microprocessor specifically designed for image processing. The NPU simulates human neurons and synapses at the circuit layer and directly processes large-scale neurons and synapses using a deep learning instruction set, with one instruction completing the processing of a group of neurons.

[0057] The communication interface 203 uses a transceiver module, such as a transceiver, to enable communication between the computing device 200 and other devices or communication networks. For example, data can be acquired through the communication interface 203.

[0058] The memory 201 and the processor 202 can be set separately or integrated together.

[0059] Bus 204 may include a pathway for transmitting information between various components of computing device 200 (e.g., memory 201, processor 202, communication interface 203).

[0060] The following section describes the process of implementing AI model operation in the AI ​​service system.

[0061] For ease of understanding, the principle of this application will be introduced below with reference to Figure 3. Figure 3 is a schematic diagram of combining a homomorphic encryption algorithm and an AI model according to an embodiment of this application. As shown in Figure 3, the AI ​​model run by the AI ​​service system includes two parts: an encryption layer and the remaining layers. The encryption layer is obtained by homomorphically encrypting one or more layers of the original AI model that process the data first using a homomorphic encryption algorithm. The remaining layers are the layers in the original AI model other than the encrypted layers (such as hidden layers and output layers). When the AI ​​model processes data (i.e., training or inference), the AI ​​service system performs homomorphic operations on the encryption layer. That is, it performs homomorphic operations on the encryption layer and the homomorphically encrypted data. The obtained calculation result is still in ciphertext state (also called the homomorphic operation result), which is decrypted and input into the remaining layers to complete the entire processing.

[0062] As described above, the AI ​​service system provided in this application includes a request sending end, a first computing system, and a second computing system. Referring to Figure 4, which is a schematic diagram of an AI service system provided in an embodiment of this application, the AI ​​model containing an encryption layer and other layers is provided by the first computing system. The second computing system can obtain the encryption layer of the AI ​​model obtained through homomorphic encryption from the first computing system and obtain the encrypted data obtained through homomorphic encryption from the request sending end. The other layers of the AI ​​model are stored locally on the first computing system. That is, for the second computing system, the received data and model parameters are in ciphertext. The second computing system can perform homomorphic operations in the ciphertext state to obtain the homomorphic operation result. Since homomorphic encryption supports computation in the ciphertext state, the homomorphic operation result after decryption is consistent with the result of computation in the plaintext state. Therefore, this method not only ensures the accuracy of model operation but also protects the privacy of model parameters while protecting user data privacy, thus safeguarding the security and intellectual property rights of the AI ​​model. Moreover, this approach divides the AI ​​model into two parts. The first part, for example, is the linear computation layer of the AI ​​model. The first computing system performs homomorphic encryption to obtain the first encrypted layer and sends it to the second computing system. The second part, for example, is the nonlinear computation layer of the AI ​​model. It is stored locally in the first computing system. By encrypting the finite layers of the AI ​​model, the errors caused by using homomorphic encryption algorithms to encrypt the nonlinear computation layer can be avoided, thus ensuring the accuracy of the AI ​​model's calculations.

[0063] Taking an AI model inference request initiated by a requesting end as an example, the requesting end is also the sender of the inference request. The requesting end uses a homomorphic encryption algorithm to encrypt the input data of the AI ​​model, obtaining encrypted input data, which is then sent to the second computing system. The second computing system, based on the inference request from the requesting end, uses homomorphic evaluation in the homomorphic encryption algorithm to perform homomorphic operations on the encrypted input data and encryption layers, obtaining an encrypted intermediate result (or homomorphic operation result), which is then sent to the first computing system. The first computing system can obtain the key related to the homomorphic encryption algorithm from the requesting end, decrypt the encrypted intermediate result using the key, obtaining the intermediate result (or decrypted data), inputting the intermediate result into the remaining layers of the AI ​​model to obtain the inference result of the AI ​​model, and returning the inference result to the requesting end. In other words, the requesting end and the first computing system can share the key of the homomorphic encryption algorithm, enabling the first computing system to locally encrypt a limited number of layers of the AI ​​model using the key, and to decrypt the encrypted intermediate result calculated by the second computing system, ensuring that the parameters of the AI ​​model are not leaked. In some embodiments, the ciphertext after homomorphic operation performed by the second computing system needs to be processed by the homomorphic operation key. Whether to process this key and by whom is determined by the AI ​​service system based on the operation performed by the homomorphic encryption algorithm are not limited in this application. The homomorphic operation key is typically used to reduce ciphertext noise to ensure correctness, or to transform parameters to optimize performance.

[0064] Taking the requesting end initiating a training request for an AI model as an example, the requesting end is also the sender of the training request. The requesting end uses a homomorphic encryption algorithm to encrypt the training data of the AI ​​model, obtaining encrypted training data, and sends the encrypted training data to the second computing system. The second computing system, based on the request sent by the requesting end, uses homomorphic evaluation in the homomorphic encryption algorithm to perform homomorphic operations on the encrypted training data and the encryption layer, obtaining an encrypted intermediate result (or homomorphic operation result), and sends the encrypted intermediate result to the first computing system. The first computing system can obtain the key related to the homomorphic encryption algorithm from the requesting end, decrypt the encrypted intermediate result using the key, obtain the intermediate result (or decrypted data), input the intermediate result into the remaining layers of the AI ​​model to obtain the AI ​​model's prediction result, update the AI ​​model's parameters based on the prediction result, and encrypt the parts of the updated AI model that need encryption, obtaining an updated encryption layer. The updated encryption layer is sent to the second computing system so that the second computing system can enter the next iteration. This process repeats until the training deadline is met, at which point the iteration stops, and the first computing system returns the trained AI model (i.e., the training result) to the requesting end.

[0065] In addition, the request sender, the first computing system, and the second computing system are logically independent objects. Neither the request sender nor the first computing system obtains the other's original data, effectively ensuring the security of user data and model parameters.

[0066] The following describes the process of implementing AI model operation in an AI service system through several methodological examples.

[0067] Figure 5 is a flowchart of an AI model operation method provided in an embodiment of this application. As shown in Figure 5, the method is applied to an AI service system, which includes a request sending end, a first computing system, and a second computing system. The first computing system deploys an AI model, and the method includes the following steps 501 to 508.

[0068] 501. Request the sending end to send homomorphically encrypted data to the second computing system.

[0069] In this embodiment, the request sender, acting as the sender of the AI ​​model's execution request, uses a homomorphic encryption algorithm to homomorphically encrypt the AI ​​model's input data, obtaining encrypted data. This encrypted data is then sent to the second computing system via a secure network channel (such as an HTTP protocol using SSL / TLS encryption) to ensure data integrity and confidentiality, preventing data tampering or theft. This application does not limit the type of homomorphic encryption algorithm. For example, when using a fully homomorphic encryption algorithm, the key includes an encryption key, a decryption key, and a homomorphic operation key. Based on this, the request sender uses the encryption key to homomorphically encrypt the AI ​​model's input data to obtain encrypted data.

[0070] This application does not limit the type of AI model. For example, an AI model is a neural network-based model applied to fields such as speech processing, text processing, video processing, or audio processing. Accordingly, the input data of the AI ​​model can be speech, text, video, or audio, etc. In some embodiments, the input data of the AI ​​model can also be data obtained after feature extraction from the original data; this application does not limit this.

[0071] Furthermore, the request sender, the first computing system, and the second computing system can pre-negotiate the homomorphic encryption algorithm used during AI model runtime, for example, by negotiating the homomorphic encryption algorithm in a configuration file or during communication. In some embodiments, when sending encrypted data to the second computing system, the request sender sends auxiliary information to the second computing system. The auxiliary information includes the homomorphic encryption algorithm used during AI model runtime. If the key of the homomorphic encryption algorithm includes a homomorphic operation key, the auxiliary information also includes the homomorphic operation key. That is, the request sender uses the auxiliary information to notify the second computing system of the homomorphic encryption algorithm and the homomorphic operation key used during AI model runtime. This application does not limit this aspect.

[0072] 502. The second computing system obtains the homomorphically encrypted data.

[0073] 503. The requesting end sends the key related to the homomorphic encryption algorithm to the first computing system.

[0074] In this embodiment, the requesting end sends the key to the first computing system through a secure network channel. For example, a key exchange protocol is used to establish a secure communication session between the requesting end and the first computing system, and then the key is transmitted in this session. The key related to the homomorphic encryption algorithm includes an encryption key and a decryption key; in some scenarios, it also includes a homomorphic operation key. The encryption key is used to encrypt data, the decryption key is used to decrypt data, and the homomorphic operation key is used to perform homomorphic transformations on the ciphertext. For example, a large number of intermediate results are generated during the homomorphic operation process. These intermediate results may need to be re-encoded, combined, reduced in dimension, or transformed in other ways for subsequent calculations. The homomorphic operation key is responsible for performing corresponding operations on the intermediate results in this process, ensuring that the intermediate results can correctly participate in the subsequent homomorphic calculations, and ultimately, the correct plaintext calculation result can be obtained through decryption. Furthermore, the homomorphic operation key is generally not involved in encryption or decryption, and its processing does not leak the privacy of the processed content.

[0075] In some embodiments, the homomorphic operation key is given to the second computing system without being provided to the first computing system; that is, the entire homomorphic operation is performed by the second computing system. In other embodiments, the homomorphic operation key is given to the first computing system, and the homomorphic operation is performed jointly by the first and second computing systems. Therefore, providing the homomorphic operation key to the first computing system is optional and not limited in this application.

[0076] Steps 501 and 503 can be executed simultaneously, or step 503 can be executed first and then step 501. This application does not limit this.

[0077] 504. The first computing system performs homomorphic encryption on the first part of the AI ​​model to obtain a first encryption layer, the first part including at least one layer of the AI ​​model.

[0078] In this embodiment, at least one encrypted layer in the AI ​​model is referred to as the first part of the AI ​​model, and the unencrypted layer is referred to as the second part of the AI ​​model. This application does not limit the number of layers in the first and second parts of the AI ​​model. For AI models of different sizes and complexities, the first and second parts can be reasonably divided according to actual conditions to adapt to different computing resources and security requirements. Illustratively, the first computing system performs homomorphic encryption on the first part of the AI ​​model based on the key and homomorphic encryption algorithm sent by the requesting end, obtaining the first encryption layer. Specifically, the first computing system performs homomorphic encryption on the first part of the AI ​​model based on the encryption key. For example, during the encryption process, the parameters of the first part are encoded into the mathematical structure used by the homomorphic encryption algorithm, and then encryption operations are performed to obtain the first encryption layer.

[0079] In some embodiments, the first part of the AI ​​model includes at least one linear computation layer, and the second part of the AI ​​model includes at least one non-linear computation layer. Linear computation layers typically include fully connected layers, convolutional layers, etc., used to perform operations such as weight multiplication and summation. Non-linear computation layers typically include activation function layers used to execute activation functions. Generally, linear computation layers are the network layers in the AI ​​model that process data first. After the input data of the AI ​​model is processed by the linear computation layer, intermediate results are obtained. These intermediate results are then processed by the non-linear computation layer to obtain the final result. By applying homomorphic encryption to the linear computation layers in the AI ​​model, on the one hand, a limited number of layers in the AI ​​model are encrypted, eliminating the need to encrypt all network layers, thus supporting an unlimited number of network layers and avoiding or reducing the cost of private domain deployment; on the other hand, it avoids the errors introduced when using homomorphic encryption algorithms to encrypt non-linear computation layers, ensuring the accuracy of the AI ​​model's calculations.

[0080] 505. The first computing system sends the first encryption layer to the second computing system.

[0081] 506. The second computing system obtains the first encryption layer.

[0082] 507. The second computing system runs the encrypted data on the first encryption layer, obtains the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system.

[0083] The homomorphic operation result indicates the intermediate result obtained after processing the input data of the AI ​​model through the first part of the AI ​​model. It should be understood that homomorphic encryption algorithms support direct computation on encrypted data without prior decryption. By performing homomorphic operations on encrypted data and the first encryption layer, the computation result of the first part of the AI ​​model can be simulated. The homomorphic operation result obtained after decryption is consistent with the result of performing the same computation on the plaintext. For example, in the homomorphic computation of the fully connected layer, homomorphic multiplication and homomorphic addition operations are performed on encrypted data and encrypted weights to obtain the encrypted weighted sum result, which is the homomorphic operation result of the encrypted fully connected layer on the encrypted data. It should be noted that the homomorphic operations involved in this step are related to the type of homomorphic encryption algorithm used by the AI ​​service system. In practical applications, the homomorphic encryption algorithm can be selected according to the inference requirements, and this application does not impose any limitations on this.

[0084] In some embodiments, the ciphertext after the homomorphic operation is performed by the second computing system needs to be processed by the homomorphic operation key. Based on the aforementioned step 503, it is known that the homomorphic operation key can be given to the second computing system without being provided to the first computing system, or it can be given to the first computing system, and the homomorphic operation can be completed jointly by the first computing system and the second computing system.

[0085] When the requesting end sends a homomorphic operation key to the second computing system, the second computing system runs encrypted data on the first encryption layer. After obtaining the homomorphic operation result of the encrypted data by the first encryption layer, it uses the homomorphic operation key to perform a homomorphic transformation on the homomorphic operation result, obtains the homomorphic transformation result, and sends the homomorphic transformation result to the first computing system. Thus, the first computing system does not need to perform the homomorphic transformation, saving the computing resources of the first computing system.

[0086] When the requesting end sends a homomorphic operation key to the first computing system, the second computing system runs encrypted data on the first encryption layer. After obtaining the homomorphic operation result of the encrypted data by the first encryption layer, it sends the homomorphic operation result to the first computing system, which then uses the homomorphic operation key to perform a homomorphic transformation. This application does not limit the specific implementation of this method. Homomorphic transformation refers to re-encoding, combining, or reducing the dimensionality of the homomorphic operation result to convert it into a form suitable for decryption.

[0087] As can be seen from the foregoing, the second computing system can be a cloud computing platform. Based on this, the second computing system can utilize parallel computing technologies, such as multithreading and NPU parallel computing, to decompose homomorphic operations into multiple subtasks and execute them in parallel on multiple computing units, thereby improving the execution efficiency of homomorphic operations.

[0088] 508. The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result. The second part includes the layers of the AI ​​model other than the first part.

[0089] In this system, after receiving the homomorphic operation result, the first computing system decrypts the result based on the key sent by the requesting end, obtaining decrypted data. This decrypted data is then input into the second part of the AI ​​model, where it is run to obtain the model's execution result. In some embodiments, the key sent by the requesting end includes an encryption key and a decryption key. The first computing system decrypts the homomorphic operation result based on the decryption key to obtain decrypted data.

[0090] In some embodiments, the ciphertext after the homomorphic operation is performed by the second computing system needs to be processed by the homomorphic operation key. Based on the aforementioned steps 503 and 507, it can be known that the homomorphic operation key can be given to the second computing system without being provided to the first computing system, or it can be given to the first computing system, and the homomorphic operation can be completed jointly by the first computing system and the second computing system.

[0091] Since the second computing system has already performed a homomorphic transformation, the homomorphic operation result received by the first computing system is the homomorphic operation result after the homomorphic transformation. Therefore, the first computing system can decrypt the received homomorphic operation result based on the decryption key and the homomorphic encryption algorithm to obtain the decrypted data.

[0092] Without the second computing system performing a homomorphic transformation, the key sent by the requesting end to the first computing system also includes a homomorphic operation key. The first computing system, based on the homomorphic operation key and the homomorphic encryption algorithm, performs a homomorphic transformation on the homomorphic operation result to obtain the homomorphically transformed homomorphic operation result. Then, based on the decryption key and the homomorphic encryption algorithm, it decrypts the homomorphically transformed homomorphic operation result to obtain the decrypted data. Here, homomorphic transformation refers to re-encoding, combining, or reducing the dimensionality of the intermediate encryption result to convert it into a form suitable for decryption.

[0093] Based on the foregoing introduction to the AI ​​model, the layer in the second part can be a nonlinear computation layer. Accordingly, the first computing system inputs the decrypted data obtained after decryption into the second part for nonlinear computation to obtain the running result of the AI ​​model. It should be understood that the running result of the AI ​​model depends on the task type of the AI ​​model, such as classification labeling, numerical prediction, etc., and this application does not limit it in this regard.

[0094] In summary, in the AI ​​model operation method provided in this application, after the second computing system obtains the homomorphically encrypted data and the first encryption layer sent by the first computing system, it runs the encrypted data on the first encryption layer to obtain the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system. The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result of the AI ​​model. It can be seen that for the second computing system, the data and model parameters received by the second computing system are in ciphertext state. The second computing system can perform homomorphic operations in ciphertext state to obtain homomorphic operation results. Since homomorphic encryption supports computation in ciphertext state, the homomorphic operation result after decryption is consistent with the result of computation in plaintext state. Therefore, this method not only ensures the accuracy of model operation but also achieves privacy protection for model parameters while protecting user data privacy.

[0095] In addition, this approach divides the AI ​​model into two parts. The first part, for example, is the linear computation layer of the AI ​​model. The first computing system performs homomorphic encryption to obtain the first encrypted layer and sends it to the second computing system. The second part, for example, is the nonlinear computation layer of the AI ​​model. It is stored locally in the first computing system. By encrypting the finite layers of the AI ​​model, the errors caused by using homomorphic encryption algorithms to encrypt the nonlinear computation layer can be avoided, thus ensuring the accuracy of the AI ​​model's calculations.

[0096] The process of the AI ​​service system running an AI model was described using the embodiment shown in Figure 5 above. The process of the AI ​​service system responding to inference and training requests from the AI ​​model to run the AI ​​model is described below with reference to Figures 6 and 7 respectively.

[0097] Figure 6 is a flowchart of an AI model inference method provided in an embodiment of this application. As shown in Figure 6, the method is applied to an AI service system, which includes a request sending end, a first computing system, and a second computing system. The first computing system deploys an AI model, and the method includes the following steps 601 to 608.

[0098] 601. The second computing system responds to the inference request and obtains the homomorphically encrypted data.

[0099] In this embodiment, the inference request is sent by the request sender. The request sender uses a homomorphic encryption algorithm to homomorphically encrypt the input data of the AI ​​model, obtaining encrypted data, and then sends the encrypted data to the second computing system through a secure network channel.

[0100] This application does not limit the timing of the AI ​​model's inference request and the transmission of encrypted data. For example, the requesting end may send the inference request to the second computing system before sending the encrypted data to the second computing system. Alternatively, the requesting end may include the encrypted data in the inference request and send the inference request to the second computing system, so that the second computing system responds to the inference request and retrieves the encrypted data.

[0101] In addition, the process of requesting the sending end to perform homomorphic encryption on the input data of the AI ​​model in this step is the same as the aforementioned step 501, and will not be repeated here.

[0102] 602. The requesting end sends the key related to the homomorphic encryption algorithm to the first computing system.

[0103] 603. The first computing system performs homomorphic encryption on the first part of the AI ​​model to obtain a first encryption layer, the first part including at least one layer of the AI ​​model.

[0104] Steps 602 and 603 are the same as steps 503 and 504 mentioned above, so they will not be repeated here.

[0105] 604. The first computing system sends the first encryption layer to the second computing system.

[0106] 605. The second computing system obtains the first encryption layer.

[0107] In some scenarios, the request sender and the second computing system can be the same object. For example, the request sender and the second computing system can be implemented by different virtual instances of a cloud platform. In this scenario, the second computing system sends an authorization request to the first computing system to request access to the first encryption layer of the AI ​​model. Based on the authorization request, the first computing system sends the first encryption layer to the second computing system. For example, the authorization request includes the identity information of the second computing system and the type of the requested AI model. That is, after obtaining authorization from the first computing system, the second computing system obtains the encryption layer from the first computing system, thus ensuring the security of the model parameters.

[0108] 606. The second computing system runs the encrypted data on the first encryption layer, obtains the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system.

[0109] The homomorphic operation result indicates the intermediate result obtained after reasoning through the input data of the AI ​​model using the first part of the AI ​​model. Furthermore, steps 606 and 507 described above are similar and will not be repeated here.

[0110] 607. The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result. The second part includes the layers of the AI ​​model other than the first part.

[0111] The result of the operation is the reasoning result of the reasoning request.

[0112] 608. The first computing system returns the results of the AI ​​model's operation to the requesting end.

[0113] In some embodiments, the first computing system may send the running result to the requesting end through the network channel between the first computing system and the requesting end, or it may forward the running result to the requesting end through the second computing system. This application does not limit this.

[0114] By applying the above methods to AI model operation scenarios, we can not only ensure the accuracy of model inference, but also protect the privacy of model parameters while protecting user data privacy.

[0115] Figure 7 is a flowchart of an AI model training method provided in an embodiment of this application. As shown in Figure 7, the method is applied to an AI service system, which includes a request sending end, a first computing system, and a second computing system. The first computing system deploys an AI model, and the method includes the following steps 701 to 709.

[0116] 701. The second computing system responds to the training request and obtains the homomorphically encrypted data.

[0117] In this embodiment, the training request is sent by the request sending end. The request sending end uses a homomorphic encryption algorithm to homomorphically encrypt the training data of the AI ​​model, obtaining encrypted data. This encrypted data is then sent to the second computing system through a secure network channel (such as an HTTP protocol using SSL / TLS encryption) to ensure data integrity and confidentiality, preventing data tampering or theft. It should be understood that this step is similar to the aforementioned step 601, and therefore will not be repeated.

[0118] 702. The requesting end sends the key related to the homomorphic encryption algorithm to the first computing system.

[0119] 703. The first computing system performs homomorphic encryption on the first part of the AI ​​model to obtain the first encryption layer. The first part includes at least one layer of the AI ​​model.

[0120] Steps 702 and 703 are the same as steps 503 and 504 mentioned above, so they will not be repeated here.

[0121] 704. The first computing system sends the first encryption layer to the second computing system.

[0122] 705. The second computing system obtains the first encryption layer.

[0123] In some scenarios, the request sender and the second computing system can be the same object. For example, the request sender and the second computing system can be implemented by different virtual instances of a cloud platform. In this scenario, the second computing system sends an authorization request to the first computing system to request access to the first encryption layer of the AI ​​model. Based on the authorization request, the first computing system sends the first encryption layer to the second computing system. For example, the authorization request includes the identity information of the second computing system and the type of the requested AI model. That is, after obtaining authorization from the first computing system, the second computing system obtains the encryption layer from the first computing system, thus ensuring the security of the model parameters.

[0124] 706. The second computing system runs the encrypted data on the first encryption layer, obtains the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system.

[0125] The homomorphic operation result indicates the intermediate result obtained after processing the training data of the AI ​​model through the first part of the AI ​​model. Furthermore, steps 706 and 507 described above are similar and will not be repeated here.

[0126] 707. The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result. The second part includes the layers of the AI ​​model other than the first part.

[0127] 708. The first computing system performs parameter update operations based on the running results to obtain the updated AI model.

[0128] 709. The first computing system performs homomorphic encryption on the first part of the updated AI model to obtain a second encryption layer, and sends the second encryption layer to the second computing system to perform iterative training.

[0129] In this process, the first computing system sends the second encryption layer to the second computing system so that the second computing system can enter the next iteration. That is, it performs iterative training in the same way as steps 704 to 709 above, until the training cutoff condition is met and the iteration stops. The first computing system then returns the trained AI model to the requesting end.

[0130] By applying the above methods to AI model operation scenarios, we can not only ensure the accuracy of model inference, but also protect the privacy of model parameters while protecting user data privacy.

[0131] As can be seen from the method embodiments shown in Figures 5 to 7 above, in the AI ​​service system provided by this application, the second computing system can perform homomorphic operations based on the received encrypted data and encryption layer to obtain the homomorphic operation result. That is, the second computing system supports performing homomorphic operations in ciphertext state to provide homomorphic encryption services. Based on this, this application also provides a method for running an AI model applied to the above-mentioned second computing system. Schematic, this method is described using an application to a computing system (capable of realizing the functions of the second computing system in the aforementioned method embodiments) as an example, including the following steps.

[0132] Step 1: The computing system obtains the homomorphically encrypted data and the encryption layer of the AI ​​model. The encryption layer is obtained by homomorphically encrypting at least one layer of the AI ​​model.

[0133] The encrypted data can be either encrypted input data used for AI model inference or encrypted training data used for AI model training; this application does not limit the specific data type. Accordingly, the computing system responds to an inference request by obtaining the encrypted data and encryption layer, the inference request being sent by the sender of the inference request. Alternatively, the computing system responds to a training request by obtaining the encrypted data and encryption layer, the training request being sent by the sender of the training request.

[0134] In some embodiments, the encryption layer obtained by the computing system is obtained by homomorphically encrypting all layers of the AI ​​model. For example, the deployment end of the AI ​​model (e.g., the first computing system in the aforementioned method embodiment) performs homomorphic encryption on all layers of the AI ​​model to obtain the encryption layer, and then sends the encryption layer to the computing system.

[0135] In other embodiments, the encryption layer obtained by the computing system is obtained by homomorphically encrypting a first part of the AI ​​model. The first part includes at least one layer of the AI ​​model, and the AI ​​model also includes a second part, which includes all layers of the AI ​​model other than the first part. For example, the deployment end of the AI ​​model (e.g., the first computing system in the aforementioned method embodiments) performs homomorphic encryption on the first part of the AI ​​model to obtain the encryption layer and sends the encryption layer to the computing system. In some embodiments, the first part includes at least one linear computation layer of the AI ​​model, and the second part includes at least one nonlinear computation layer of the AI ​​model.

[0136] In step 1, the computing system obtains the encrypted data and encryption layer in the same way as the method embodiments shown in Figures 5 to 7 above, and will not be described again.

[0137] Step 2: The computing system runs the encrypted data on the encryption layer to obtain the homomorphic operation result of the encryption layer on the encrypted data.

[0138] The homomorphic operation result indicates the intermediate result obtained after processing the input data of the AI ​​model through at least one layer of the AI ​​model. It should be understood that homomorphic encryption algorithms support direct computation on ciphertext data without prior decryption. By performing homomorphic operations on encrypted data and encryption layers, the computation results of at least one layer in the AI ​​model can be simulated. The resulting homomorphic operation result, after decryption, is consistent with the result of performing the same computation on the plaintext.

[0139] Furthermore, as can be seen from the method embodiments shown in Figures 5 to 7 above, in some embodiments, the ciphertext after homomorphic operation needs to be processed by the homomorphic operation key. Accordingly, the computing system obtains the homomorphic operation key (e.g., sent by the request sender); runs the encrypted data on the encryption layer to obtain the homomorphic operation result of the encryption layer on the encrypted data; and uses the homomorphic operation key to perform a homomorphic transformation on the homomorphic operation result to obtain the homomorphically transformed homomorphic operation result. The implementation of this process is the same as in the aforementioned method embodiments and will not be described again.

[0140] After the computing system executes steps 1 and 2 to obtain the homomorphic operation result of the encryption layer on the encrypted data, the computing system can also send the homomorphic operation result to the deployment end of the AI ​​model. For example, if the encryption layer is obtained by homomorphically encrypting the first part of the AI ​​model, the computing system sends the homomorphic operation result to the deployment end of the AI ​​model so that the deployment end of the AI ​​model can decrypt the homomorphic operation result to obtain the decrypted data and then run it on the second part of the AI ​​model to obtain the running result. The implementation method of this process is the same as that of the aforementioned method embodiment, and will not be described again.

[0141] In some embodiments, when the computing system receives encrypted data and an encryption layer in response to a training request, the computing system can also obtain an updated encryption layer to perform iterative training. The updated encryption layer is obtained by the deployment end of the AI ​​model performing parameter update operations based on the running results of the AI ​​model to obtain an updated AI model, and then performing homomorphic encryption on at least one layer of the updated AI model. The implementation of this process is the same as in the aforementioned method embodiments and will not be described again.

[0142] Using the above-described AI model operation method, the data and model parameters received by the computing system are in ciphertext. The computing system can perform homomorphic operations in the ciphertext state to obtain the homomorphic operation results. Since homomorphic encryption supports computation in the ciphertext state, the homomorphic operation results are consistent with the results of computation in the plaintext state after decryption. Therefore, this method can not only ensure the accuracy of model operation, but also achieve privacy protection of model parameters while protecting user data privacy.

[0143] This application provides a computing system capable of implementing the functions of the second computing system in the aforementioned method embodiments. Schematic, Figure 8 is a structural diagram of a computing system provided in an embodiment of this application. This computing system can implement some or all of the functions of the second computing system in the aforementioned AI service system through software, hardware, or a combination of both. As shown in Figure 8, the system includes an acquisition module 801 and a running module 802. In some embodiments, the system further includes a sending module 803.

[0144] The acquisition module 801 is used to acquire homomorphically encrypted data and the encryption layer of the AI ​​model. The encryption layer is obtained by homomorphically encrypting at least one layer of the AI ​​model.

[0145] The execution module 802 is used to run encrypted data on the encryption layer to obtain the homomorphic operation results of the encryption layer on the encrypted data.

[0146] In some embodiments, the acquisition module 801 is configured to acquire encrypted data and encryption layer in response to an inference request.

[0147] In some embodiments, the acquisition module 801 is used to acquire encrypted data and encryption layer in response to a training request;

[0148] The acquisition module 801 is also used to acquire the updated encryption layer of the AI ​​model to perform iterative training. The updated encryption layer is obtained by the deployment end of the AI ​​model performing parameter update operations based on the running results of the AI ​​model to obtain the updated AI model and performing homomorphic encryption on at least one layer of the updated AI model.

[0149] In some embodiments, the encryption layer is obtained by homomorphically encrypting all layers of the AI ​​model; or, the encryption layer is obtained by homomorphically encrypting a first part of the AI ​​model, the first part including at least one layer of the AI ​​model, and the AI ​​model further including a second part, the second part including the layers of the AI ​​model other than the first part. In some embodiments, the first part includes at least one linear computation layer of the AI ​​model, and the second part includes at least one nonlinear computation layer of the AI ​​model.

[0150] In some embodiments, the sending module 803 is used to send the homomorphic operation result to the deployment end of the AI ​​model. The homomorphic operation result is used to run on the second part of the AI ​​model after the decrypted data is obtained to obtain the running result.

[0151] In some embodiments, the acquisition module 801 is further configured to acquire the homomorphic operation key;

[0152] The execution module 802 is used to run encrypted data on the encryption layer, obtain the homomorphic operation result of the encryption layer on the encrypted data, and perform homomorphic transformation on the homomorphic operation result using the homomorphic operation key to obtain the homomorphic operation result after homomorphic transformation.

[0153] Through the aforementioned computing system, the data and model parameters received by the computing system are in ciphertext. The computing system can perform homomorphic operations in the ciphertext state to obtain the homomorphic operation results. Since homomorphic encryption supports computation in the ciphertext state, the homomorphic operation results are consistent with the results of computation in the plaintext state after decryption. Therefore, this method can not only ensure the accuracy of model operation, but also achieve privacy protection of model parameters while protecting user data privacy.

[0154] It should be noted that the computing system provided in the above embodiments is only illustrated by the division of the above functional modules when running the AI ​​model. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the system can be divided into different functional modules to complete all or part of the functions described above. In addition, the computing system and the AI ​​model running method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0155] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items that have substantially the same function and purpose. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor does it limit the quantity or execution order. It should also be understood that although the following description uses the terms "first," "second," etc., to describe various elements, these elements should not be limited by the terms. These terms are merely used to distinguish one element from another. For example, without departing from the scope of the various examples described, a first encryption layer may be referred to as a second encryption layer, and similarly, a second encryption layer may be referred to as a first encryption layer. Both the first and second encryption layers can be encryption layers, and in some cases, they can be separate and distinct encryption layers.

[0156] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple encryption layers means two or more encryption layers.

[0157] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0158] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, in the form of program structure information. This program structure information includes one or more program instructions. When these program instructions are loaded and executed on a computing device, the processes or functions according to the embodiments of this application are generated, in whole or in part.

[0159] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0160] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for operating an artificial intelligence (AI) model, characterized in that, Applied to an AI service system, the AI ​​service system comprising a first computing system and a second computing system, wherein an AI model is deployed in the first computing system, the method includes: The second computing system acquires the homomorphically encrypted data; The first computing system performs homomorphic encryption on a first part of the AI ​​model to obtain a first encryption layer, and sends the first encryption layer to the second computing system. The first part includes at least one layer of the AI ​​model. The second computing system runs the encrypted data on the first encryption layer, obtains the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system; The first computing system decrypts the homomorphic operation result to obtain decrypted data, and runs the decrypted data on the second part of the AI ​​model to obtain the running result. The second part includes the layers of the AI ​​model other than the first part.

2. The method according to claim 1, characterized in that, The second computing system acquires homomorphically encrypted data, including: The second computing system responds to the inference request to obtain the encrypted data; The method further includes: The first computing system sends the running results to the sending end of the inference request.

3. The method according to claim 1, characterized in that, The second computing system acquires homomorphically encrypted data, including: The second computing system responds to the training request and obtains the encrypted data; The method further includes: The first computing system performs a parameter update operation based on the running results to obtain the updated AI model; The first computing system performs homomorphic encryption on the first part of the updated AI model to obtain a second encryption layer, and sends the second encryption layer to the second computing system to perform iterative training.

4. The method according to any one of claims 1 to 3, characterized in that, The first part includes at least one linear computation layer of the AI ​​model, and the second part includes at least one nonlinear computation layer of the AI ​​model.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: The first computing system obtains the encryption key and the decryption key; The first computing system performs homomorphic encryption on a first part of the AI ​​model to obtain a first encryption layer, including: the first computing system uses the encryption key to perform homomorphic encryption on the first part to obtain the first encryption layer; The first computing system decrypts the homomorphic operation result to obtain decrypted data, including: the first computing system uses the decryption key to decrypt the homomorphic operation result to obtain the decrypted data.

6. The method according to claim 5, characterized in that, The method further includes: The first computing system obtains the homomorphic operation key; The first computing system uses the decryption key to decrypt the homomorphic operation result to obtain the decrypted data, including: the first computing system uses the homomorphic operation key to perform a homomorphic transformation on the homomorphic operation result to obtain a homomorphic transformed homomorphic operation result, and uses the decryption key to decrypt the homomorphic transformed homomorphic operation result to obtain the decrypted data.

7. The method according to claim 5, characterized in that, The method further includes: The second computing system obtains the homomorphic operation key; The second computing system runs the encrypted data on the first encryption layer to obtain the homomorphic operation result of the first encryption layer on the encrypted data, and sends the homomorphic operation result to the first computing system, including: the second computing system runs the encrypted data on the first encryption layer to obtain the homomorphic operation result of the first encryption layer on the encrypted data, performs a homomorphic transformation on the homomorphic operation result using the homomorphic operation key to obtain the homomorphic transformed homomorphic operation result, and sends the homomorphic transformed homomorphic operation result to the first computing system; The first computing system uses the decryption key to decrypt the homomorphic operation result to obtain the decrypted data, including: the first computing system uses the decryption key to decrypt the homomorphic operation result after homomorphic transformation to obtain the decrypted data.

8. A computing system, characterized in that, The computing system includes: The acquisition module is used to acquire homomorphically encrypted data and the encryption layer of the AI ​​model, wherein the encryption layer is obtained by homomorphically encrypting at least one layer of the AI ​​model; The execution module is used to run the encrypted data on the encryption layer to obtain the homomorphic operation result of the encryption layer on the encrypted data.

9. The system according to claim 8, characterized in that, The acquisition module is used to acquire the encrypted data and the encryption layer in response to a reasoning request.

10. The system according to claim 8, characterized in that, The acquisition module is used to acquire the encrypted data and the encryption layer in response to a training request; The acquisition module is further configured to acquire the updated encryption layer of the AI ​​model for iterative training. The updated encryption layer is obtained by the deployment end of the AI ​​model performing parameter update operations based on the running results of the AI ​​model to obtain the updated AI model and performing homomorphic encryption on at least one layer of the updated AI model.

11. The system according to any one of claims 8 to 10, characterized in that, The encryption layer is obtained by homomorphically encrypting all layers of the AI ​​model; or... The encryption layer is obtained by homomorphically encrypting the first part of the AI ​​model, the first part including at least one layer of the AI ​​model, and the AI ​​model also including a second part, the second part including the layers of the AI ​​model other than the first part.

12. The system according to claim 11, characterized in that, The first part includes at least one linear computation layer of the AI ​​model, and the second part includes at least one nonlinear computation layer of the AI ​​model.

13. The system according to any one of claims 8 to 12, characterized in that, The acquisition module is also used to acquire the homomorphic operation key; The running module is used to run the encrypted data on the encryption layer, obtain the homomorphic operation result of the encryption layer on the encrypted data, and perform homomorphic transformation on the homomorphic operation result using the homomorphic operation key to obtain the homomorphic operation result after homomorphic transformation.

14. A computer program product, characterized in that, The computer program product is used to implement the method of running the AI ​​model as described in any one of claims 1 to 7.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store at least one piece of program code, which is used to implement the method of running the AI ​​model as described in any one of claims 1 to 7.

Images