Method, device and computer program product for generating neural network model

1 . A method, comprising:

deploying a processor-based trusted execution environment in a multi-party computation system;

verifying, in the trusted execution environment of the multi-party computation system, a first entity that provides training data to be used in training a neural network model and a second entity that provides the neural network model to be trained;

dividing, in the multi-party computation system, the neural network model into multiple parts based on a computational graph of the neural network model, wherein the multiple parts comprise a first part for processing an input to the neural network model, the input comprising at least a portion of the training data provided by the first entity, and a second part for receiving an output from the first part, wherein at least portions of respective ones of the first and second parts collectively comprise a sequence of serially-connected operators of the neural network model;

converting, in the multi-party computation system and based on syntax for the trusted execution environment, a first part of code in source code of the neural network model and corresponding to the first part of the neural network model;

compiling, in the multi-party computation system, the converted first part of code and a second part of code in the source code and corresponding to the second part of the neural network model, wherein compiling the converted first part of code and the second part of code further comprises (i) adding one or more enclave calls and (ii) adding one or more outside calls, to support communication between the trusted execution environment and an untrusted execution environment; and

executing the compiled first part of code and the compiled second part of code respectively in the trusted execution environment and the untrusted execution environment to train the neural network model utilizing the input comprising at least a portion of the training data provided by the first entity.

2 . The method according to claim 1 , wherein dividing the neural network model into multiple parts comprises:

determining the computational graph of the neural network model, wherein the computational graph comprises multiple operators; and

dividing the multiple operators into two sets of operators based on security of the input, wherein the two sets of operators respectively correspond to the first part and the second part.

3 . The method according to claim 2 , further comprising:

acquiring, from the source code, the first part of code corresponding to a first set of operators in the two sets of operators.

4 . The method according to claim 1 , wherein converting the first part of code comprises:

converting the first part of code based on a hard coding rule.

5 . The method according to claim 1 , wherein compiling the converted first part of code and the second part of code comprises:

generating, in the first part of code and the second part of code, code corresponding to an interface capable of communicating between the trusted execution environment and the untrusted execution environment.

6 . The method according to claim 1 , further comprising:

arranging, based on a programming language of the neural network model, a runtime environment in the trusted execution environment.

7 . The method according to claim 1 , further comprising:

acquiring configuration information of a multi-party computation frame for the trusted execution environment, wherein the configuration information comprises at least one of the following: multiple parties participating in computation of the neural network model; a runtime environment of the neural network model; an input address where the multi-party computation frame acquires an input from one of the multiple parties; or an output address where the multi-party computation frame returns a computation result to one of the multiple parties.

8 . The method according to claim 7 , further comprising:

determining whether the trusted execution environment passes verification by each of the multiple parties; and

establishing, in response to determining that the trusted execution environment passes verification by each of the multiple parties, a secure communication channel between each of the multiple parties and the trusted execution environment.

9 . The method according to claim 7 , further comprising:

acquiring encrypted data from the input address;

decrypting the encrypted data;

inputting the decrypted data into the first part of the neural network model to obtain an intermediate result; and

transmitting the intermediate result to the second part so as to train the neural network model.

10 . The method according to claim 9 , further comprising:

returning, based on the configuration information, model parameters for the first part to the output address as the computation result.

11 . An electronic device, comprising:

at least one processor; and

memory coupled to the at least one processor and having instructions stored therein, wherein the instructions, when executed by the at least one processor, cause the electronic device to execute actions comprising:

deploying a processor-based trusted execution environment in a multi-party computation system;

verifying, in the trusted execution environment of the multi-party computation system, a first entity that provides training data to be used in training a neural network model and a second entity that provides the neural network model to be trained;

dividing, in the multi-party computation system, the neural network model into multiple parts based on a computational graph of the neural network model, wherein the multiple parts comprise a first part for processing an input to the neural network model, the input comprising at least a portion of the training data provided by the first entity, and a second part for receiving an output from the first part, wherein at least portions of respective ones of the first and second parts collectively comprise a sequence of serially-connected operators of the neural network model;

converting, in the multi-party computation system and based on syntax for the trusted execution environment, a first part of code in source code of the neural network model and corresponding to the first part of the neural network model;

compiling, in the multi-party computation system, the converted first part of code and a second part of code in the source code and corresponding to the second part of the neural network model, wherein compiling the converted first part of code and the second part of code further comprises (i) adding one or more enclave calls and (ii) adding one or more outside calls, to support communication between the trusted execution environment and an untrusted execution environment; and

executing the compiled first part of code and the compiled second part of code respectively in the trusted execution environment and the untrusted execution environment to train the neural network model utilizing the input comprising at least a portion of the training data provided by the first entity.

12 . The electronic device according to claim 11 , wherein dividing the neural network model into multiple parts comprises:

determining the computational graph of the neural network model, wherein the computational graph comprises multiple operators; and

dividing the multiple operators into two sets of operators based on security of the input, wherein the two sets of operators respectively correspond to the first part and the second part.

13 . The electronic device according to claim 12 , wherein the actions further comprise:

acquiring, from the source code, the first part of code corresponding to a first set of operators in the two sets of operators.

14 . The electronic device according to claim 11 , wherein converting the first part of code comprises:

converting the first part of code based on a hard coding rule.

15 . The electronic device according to claim 11 , wherein compiling the converted first part of code and the second part of code comprises:

generating, in the first part of code and the second part of code, code corresponding to an interface capable of communicating between the trusted execution environment and the untrusted execution environment.

16 . The electronic device according to claim 11 , wherein the actions further comprise:

arranging, based on a programming language of the neural network model, a runtime environment in the trusted execution environment.

17 . The electronic device according to claim 11 , wherein the actions further comprise:

acquiring configuration information of a multi-party computation frame for the trusted execution environment, wherein the configuration information comprises at least one of the following: multiple parties participating in computation of the neural network model; a runtime environment of the neural network model; an input address where the multi-party computation frame acquires an input from one of the multiple parties; or an output address where the multi-party computation frame returns a computation result to one of the multiple parties.

18 . The electronic device according to claim 17 , wherein the actions further comprise:

determining whether the trusted execution environment passes verification by each of the multiple parties; and

establishing, in response to determining that the trusted execution environment passes verification by each of the multiple parties, a secure communication channel between each of the multiple parties and the trusted execution environment.

19 . The electronic device according to claim 17 , wherein the actions further comprise:

acquiring encrypted data from the input address;

decrypting the encrypted data;

inputting the decrypted data into the first part of the neural network model to obtain an intermediate result; and

transmitting the intermediate result to the second part so as to train the neural network model.

20 . A computer program product comprising a non-transitory computer-readable medium having machine-executable instructions stored therein, wherein the machine-executable instructions, when executed by a machine, cause the machine to perform actions comprising:

deploying a processor-based trusted execution environment in a multi-party computation system;

verifying, in the trusted execution environment of the multi-party computation system, a first entity that provides training data to be used in training a neural network model and a second entity that provides the neural network model to be trained;

dividing, in the multi-party computation system, the neural network model into multiple parts based on a computational graph of the neural network model, wherein the multiple parts comprise a first part for processing an input to the neural network model, the input comprising at least a portion of the training data provided by the first entity, and a second part for receiving an output from the first part, wherein at least portions of respective ones of the first and second parts collectively comprise a sequence of serially-connected operators of the neural network model;

converting, in the multi-party computation system and based on syntax for the trusted execution environment, a first part of code in source code of the neural network model and corresponding to the first part of the neural network model;

compiling, in the multi-party computation system, the converted first part of code and a second part of code in the source code and corresponding to the second part of the neural network model, wherein compiling the converted first part of code and the second part of code further comprises (i) adding one or more enclave calls and (ii) adding one or more outside calls, to support communication between the trusted execution environment and an untrusted execution environment; and

executing the compiled first part of code and the compiled second part of code respectively in the trusted execution environment and the untrusted execution environment to train the neural network model utilizing the input comprising at least a portion of the training data provided by the first entity.