CN110807484B - Privacy protection VGG-based dense image recognition method and system - Google Patents

Abstract

The invention relates to a privacy protection VGG-based secret state image recognition method and a system, wherein the method comprises the steps that firstly, a sender encrypts an original image into two secret state component images and sends the two secret state component images to a first server and a second server respectively; the trusted server then discloses the pretraining parameters, the fine tuning training parameters and the preset super parameters of the VGG network, and generates and distributes random security parameters to the first server and the second server; then the first server and the second server respectively execute safe convolution, activation, pooling and full connection layer operation on the two secret component images; and finally, the receiver receives output results from the first server and the second server respectively and performs decryption operation to obtain feature extraction and identification results of the encrypted image. The method and the system are beneficial to improving the accuracy and the image privacy of the identification of the dense state image.

Description

Secret image recognition method and system based on privacy protection VGG

technical field

The present invention relates to the technical field of deep learning, in particular to a privacy protection VGG-based secret image recognition method and system.

Background technique

In recent years, deep learning has made great progress in the field of artificial intelligence, and has been applied to many fields such as speech recognition, natural language processing, computer vision, image and video analysis, and multimedia. Among them, image recognition is an important direction of artificial intelligence. After three stages of character recognition, digital image processing and recognition, and object recognition, the development of deep learning has provided a driving force for the qualitative leap of image recognition algorithms. Interact intelligently more naturally. The existing deep learning model belongs to the category of neural network. Using the famous backpropagation algorithm, we can train the neural network to simulate the mechanism of brain cognition to solve various target learning tasks, and continuously improve the learning efficiency and accuracy.

The key to image recognition is to extract CNN features from images, and the VGG model is the preferred algorithm. The network has the characteristics of small convolution kernel, small pool kernel, wider feature map with deeper layers, and fully connected convolution. It also performs better than another excellent convolutional neural network in multiple migration learning tasks. Model, GoogLeNet. As the features of the image to be recognized become more complex, the accuracy of image detection increases and the degree of privacy of the information contained in it increases. However, the image detection algorithm of the traditional VGG network cannot provide security guarantee for the image information to be tested, and the privacy problem of the image information to be detected needs to be solved urgently. Therefore, in order to ensure the privacy and security of the image to be tested in the process of using the VGG network for image recognition, a privacy-preserving VGG method and system should be designed. At present, there are few solutions to achieve the privacy of the image under test for this network.

Contents of the invention

The purpose of the present invention is to provide a method and system for identifying dense images based on privacy-protected VGG, which is beneficial to improving the accuracy and privacy of image recognition for dense images.

In order to achieve the above purpose, the technical solution adopted by the present invention is: a secret image recognition method based on privacy protection VGG. First, the sender α encrypts the original image I into two secret component images I ₁ and I ₂ , and respectively Send to the first server S ₁ and the second server S ₂ ; then the trusted server T discloses the pre-training parameters, fine-tuning training parameters and preset hyperparameters of the VGG network, generates and distributes random security parameters to the first server S ₁ and The second server S ₂ ; then the first server S ₁ and the second server S ₂ respectively perform security convolution, activation, pooling and fully connected layer operations on the two dense component images I ₁ and I ₂ ; finally the receiver β The output results O ₁ and O ₂ from the first server S ₁ and the second server S ₂ are respectively received and decrypted to obtain the feature extraction and recognition result O=O ₁ +O ₂ of the encrypted state image.

Further, the sender α adopts the (2,2)-secret partition threshold scheme to encrypt the original image I into two encrypted component images I ₁ and I ₂ , and the method is as follows:

For an original image I, the sender α uses a random number generator to generate a random pixel matrix with the same size as the original image, that is, the dense-state component image I ₁ , and sends it to the first server S ₁ , and then uses the original image I to subtract De-densify the component image I ₁ to obtain the dense-state component image I ₂ , and send it to the second server S ₂ , where the selection range of the random number is [-2 ^n-1 ,2 ^n-1 -1], n= 8, 16, 32, . . .

Further, the methods for the first server S ₁ and the second server S ₂ to respectively perform secure convolution operations on the two dense-state component images I ₁ and I ₂ are as follows:

The trusted server T discloses the pre-training parameters, fine-tuning training parameters and hyper-parameter settings of the VGG network. Knowing the public convolution kernel parameters (w; b), the received image input value is x, and the sender according to (2 , 2)-secret segmentation threshold scheme, splitting the pixels at each position of the original image I to obtain components x ₁ and x ₂ , and x=x ₁ +x ₂ ; the first server S ₁ uses parameters (w; b ) performs a convolution operation on the received input component _x1 ; the second server _S2 performs a convolution operation on the received input component _x2 using the parameter (w; 0).

Further, the methods for the first server S ₁ and the second server S ₂ to respectively perform security activation operations on the two dense-state component images I ₁ and I ₂ are as follows:

For the received activation layer input u, the complete activation operation is to calculate the function max(u,0), set the pixel position of u<0 to 0, and the position of u≥0 remains unchanged; the first server S ₁ and the second The server S ₂ respectively receives the input components of the activation layer, and interactively uses the security comparison function SecComp to obtain the sign bit of the pixel position corresponding to the original image of the two input components; if the sign bit is equal to 1, then S ₁ and S ₂ respectively Components are set to 0, otherwise remain unchanged.

Further, the security comparison function SecComp used in the security activation operation includes a security binary multiplication function SecBitMul, a security binary addition function SecBitAdd and a security bit extraction function SecBitExtra, wherein the function SecBitMul is executed according to the following steps:

Step A1: The trusted server T randomly generates a multiplication triplet, and the third number is the product of the first two numbers; generate three random numbers and distribute them to the first server S ₁ ; combine the three random numbers with the multiplication triplet Groups perform XOR operations correspondingly in turn to obtain three new random numbers and send them to the second server S ₂ ;

Step A2: The first server S ₁ and the second server S ₂ respectively receive the input components of the two multipliers calling the function SecBitMul, use the random multiplication triplet and the corresponding random number, S ₁ and S ₂ finally obtain the output results respectively , satisfying that the value of the XOR of the two output results is equal to the value of the AND of the two multiplication input components, realizing the carry operation of the binary bit;

The function SecBitAdd is executed as follows:

Step B1: The first server S ₁ and the second server S ₂ respectively receive the input components of the two addends calling the function SecBitMul, and S ₁ and S ₂ respectively perform XOR operation on the two input components to obtain the Addend sum; by calling the function SecBitMul, the bit position of the current carry is set to 1; both S ₁ and S ₂ respectively perform the operation of shifting one bit to the left, and transmit the shifted results to the other party for interaction;

Step B2: S ₁ and S ₂ perform XOR operation on the two new components respectively, and judge whether there is a carry, if there is, iteratively call the function SecBitMul and the left shift operation until S ₁ and S ₂ perform the addition operation Add all the carry values of , and jump out of the loop; S ₁ and S ₂ respectively output the component results of the addition;

The function SecBitExtra is executed in the following steps:

Step C1: Trusted server T randomly generates three random numbers r ₁ , r ₂ and γ ₁ , calculates r ₁ XOR r ₂ to get r, subtracts γ ₁ from r to get γ ₂ , and distributes r ₁ and γ ₁ to S ₁ , distribute r ₂ and γ ₂ to S ₂ ;

Step C2: The first server S ₁ and the second server S ₂ receive their respective input components, respectively subtract γ ₁ and γ ₂ from the input components to obtain t ₁ and t ₂ ; S ₂ transfers t ₂ to S ₁ ; S ₁ Calculate the sum of t ₁ and t ₂ as v, and generate a random number v ₁ , calculate v XOR v ₁ to get v ₂ , and pass it to S ₂ ; S ₁ and S ₂ use the function SecBitAdd interactively, that is, S ₁ input r ₁ and v ₁ , S ₂ inputs r ₂ and v ₂ ; S ₁ and S ₂ obtain component output values respectively;

Step C3: S ₁ and S ₂ respectively receive the component output after calling the function SecBitAdd, and judge whether the output result is positive or negative. If it is less than zero, the respective symbol positions are set to 1, otherwise they are set to 0; S ₁ and S ₂ transmit interactively respective sign bits, and perform the XOR operation of the sign bits of both parties at the same time to obtain the final sign bit result; S ₁ and S ₂ respectively output the common final sign bit result.

Further, the methods for the first server S ₁ and the second server S ₂ to respectively perform security pooling operations on the two dense component images I ₁ and I ₂ are as follows:

After receiving the input of the pooling layer, the complete MAX-POOL operation is to select the maximum value in the pooling window as the result of pooling in this area; after S ₁ and S ₂ respectively receive the input components of the pooling layer, mark The upper left pixel point in each pooling window is the maximum value position; then S ₁ and S ₂ follow the rules from left to right and from top to bottom, and perform pairwise subtraction on the pixel positions in their respective pooling windows operation, and pass the corresponding pairwise differences to each other for summing, if the summation result is less than zero, mark the pixel where the minuend is located as the maximum value position, otherwise the maximum value position remains the same as the initial value; S ₁ , S ₂ Perform this operation iteratively until the pooling window is traversed; S ₁ and S ₂ output the pixel value at the position of the maximum value in the pooling window to replace the pooling window; S ₁ and S ₂ slide the pooling window to traverse their respective component images Regions, each output the result of the pooling layer.

Further, the methods for the first server S ₁ and the second server S ₂ to respectively perform secure full-connection operations on the two dense-state component images I ₁ and I ₂ are as follows:

The fully connected layer parameter (w; b) disclosed by the trusted server T, for the received input x of the fully connected layer, the operation of the complete fully connected layer is to calculate y=w x+b; the first server _S1 receives To the input component x ₁ , use the parameter (w; b) to execute the full connection operation, that is, calculate y ₁ =w·x ₁ +b; the second server S ₂ receives the input component x ₂ , and use the parameter (w; 0) to execute The full connection operation is to calculate y ₂ =w·x ₂ +0 and satisfy x=x ₁ +x ₂ .

Further, the method for the receiver β to perform the decryption operation is as follows: the first server S ₁ sends the output result O ₁ of the encrypted component image I ₁ to the receiver β after the VGG network forward process; the second server S ₂ sends the encrypted After the state component image I ₂ executes the output result O ₂ of the VGG network forward process, it is sent to the receiver β; β performs the decryption operation, that is, calculates O=O ₁ +O ₂ , and obtains the dense image feature extraction and recognition of the original image I result.

The present invention also provides a dense state image recognition system adopting the above method, comprising:

The sender α is used to perform image encryption operations, that is, to randomly split and encrypt the original image into two dense-state component images;

The trusted server T is used to disclose model training parameters, generate and distribute random security parameters involved in the security functions of each layer;

The first server S ₁ and the second server S ₂ are used to execute the privacy protection VGG network in parallel, and respectively output the feature extraction and recognition results of the dense state component image; and

The receiver β is used to perform image decryption operations, that is, to combine the output results of the first server S ₁ and the second server S ₂ to obtain the same encrypted image recognition result as the original image recognition result.

Compared with the prior art, the present invention has the following beneficial effects: the present invention uses the secret segmentation threshold scheme to encrypt the original image, and uses two randomly split secret-state component images to execute the privacy protection VGG network in parallel, and finally through the combination The output of the dense-state component image obtains the same privilege extraction and recognition effect as the original image. For any component output result, it has no practical significance and will not reveal the privacy of the original image. The invention not only ensures the privacy and security of the original image to be tested during the identification process, but also ensures that the splitting operation does not affect the accuracy of identification and detection, so as to achieve security without sacrificing detection accuracy.

Description of drawings

Fig. 1 is a flow chart of the implementation of the method of the embodiment of the present invention.

Fig. 2 is a schematic diagram of the system structure of the embodiment of the present invention.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

The invention randomly splits the image to be tested into two indistinguishable component images, and sends them to two competing servers for VGG network processing respectively. By constructing an interactive security function to replace each type of layer in the traditional VGG network, the effect of combining two component images after VGG network processing in parallel is equivalent to the effect of the original image after VGG network processing.

Based on the above ideas, the present invention provides a secret image recognition method based on privacy protection VGG, as shown in Figure 1, first, the sender α encrypts the original image I into two secret component images I ₁ , I ₂ , and Send them to the first server S ₁ and the second server S ₂ respectively; then the trusted server T discloses the pre-training parameters, fine-tuning training parameters and preset hyperparameters of the VGG network, generates and distributes random security parameters to the first server S ₁ and the second server S ₂ ; then the first server S ₁ and the second server S ₂ perform security convolution, activation, pooling and fully connected layer operations on the two dense component images I ₁ and I ₂ respectively; finally the receiver β receives the output results O ₁ and O ₂ from the first server S ₁ and the second server S ₂ respectively, and performs a decryption operation to obtain the feature extraction and recognition results of the encrypted image O=O ₁ +O ₂ .

In this embodiment, the sender α adopts the (2,2)-secret segmentation threshold scheme to encrypt the original image I into two secret-state component images I ₁ and I ₂ , and the method is as follows:

For an original image I, the sender α uses a random number generator to generate a random pixel matrix with the same size as the original image, that is, the dense-state component image I ₁ , and sends it to the first server S ₁ , and then uses the original image I to subtract De-densify the component image I ₁ to obtain the dense-state component image I ₂ , and send it to the second server S ₂ , where the selection range of the random number is [-2 ^n-1 ,2 ^n-1 -1], n= 8, 16, 32, . . .

In this embodiment, the methods for the first server S ₁ and the second server S ₂ to respectively perform secure convolution operations on the two dense-state component images I ₁ and I ₂ are as follows:

The trusted server T discloses the pre-training parameters, fine-tuning training parameters and hyper-parameter settings of the VGG network. Knowing the public convolution kernel parameters (w; b), the received image input value is x, and the sender according to (2 , 2)-secret segmentation threshold scheme, splitting the pixels at each position of the original image I to obtain components x ₁ and x ₂ , and x=x ₁ +x ₂ ; the first server S ₁ uses parameters (w; b ) performs a convolution operation on the received input component _x1 ; the second server _S2 performs a convolution operation on the received input component _x2 using the parameter (w; 0).

In this embodiment, the methods for the first server S ₁ and the second server S ₂ to respectively perform security activation operations on the two dense-state component images I ₁ and I ₂ are as follows:

For the received activation layer input u, the complete activation operation is to calculate the function max(u,0), set the pixel position of u<0 to 0, and the position of u≥0 remains unchanged; the first server S ₁ and the second The server S ₂ respectively receives the input components of the activation layer, and interactively uses the security comparison function SecComp to obtain the sign bit of the pixel position corresponding to the original image of the two input components; if the sign bit is equal to 1, then S ₁ and S ₂ respectively Components are set to 0, otherwise remain unchanged.

Wherein, the security comparison function SecComp used in the security activation operation includes a security binary multiplication function SecBitMul, a security binary addition function SecBitAdd and a security bit extraction function SecBitExtra.

The function SecBitMul is executed as follows:

Step A1: The trusted server T randomly generates a multiplication triplet, and the third number is the product of the first two numbers; generate three random numbers and distribute them to the first server S ₁ ; combine the three random numbers with the multiplication triplet Groups perform XOR operations correspondingly in turn to obtain three new random numbers and send them to the second server S ₂ ;

Step A2: The first server S ₁ and the second server S ₂ respectively receive the input components of the two multipliers calling the function SecBitMul (for example. known multipliers r=r ₁ +r ₂ , v=v ₁ +v ₂ , S ₁ receives r ₁ , v ₁ , S ₂ receives r ₂ , v ₂ ), using random multiplication triplets and corresponding random numbers, S ₁ and S ₂ finally get output results respectively, satisfying that the two output results are identical The value of XOR is equal to the value of the addition of two multiplication input components, realizing the carry operation of binary bits.

The function SecBitAdd is executed as follows:

Step B1: The first server S ₁ and the second server S ₂ respectively receive the input components of the two addends that call the function SecBitMul (for example, known addends r=r ₁ +r ₂ , v=v ₁ +v ₂ , S ₁ receives r ₁ , v ₁ , S ₂ receives r ₂ , v ₂ ), S ₁ , S ₂ respectively perform XOR operation on the two input components to obtain the addend sum without carry; by calling the function SecBitMul, set the bit position of the current carry to 1; S ₁ and S ₂ respectively perform the operation of shifting one bit to the left, and transmit the shifted results to the other party for interaction;

Step B2: S ₁ and S ₂ perform XOR operation on the two new components respectively, and judge whether there is a carry, if there is, iteratively call the function SecBitMul and the left shift operation until S ₁ and S ₂ perform the addition operation Add all the carry values of , and jump out of the loop; S ₁ and S ₂ respectively output the component results of the addition.

The function SecBitExtra is executed in the following steps:

Step C1: Trusted server T randomly generates three random numbers r ₁ , r ₂ and γ ₁ , calculates r ₁ XOR r ₂ to get r, subtracts γ ₁ from r to get γ ₂ , and distributes r ₁ and γ ₁ to S ₁ , distribute r ₂ and γ ₂ to S ₂ ;

Step C2: The first server S ₁ and the second server S ₂ receive their respective input components, subtract γ ₁ and γ ₂ from the input components respectively to obtain t 1 _and t 2 ; S ₂ transfers _{t 2 to} S ₁ ; S ₁ Calculate the sum of t ₁ and t ₂ as v, and generate a random number v ₁ , calculate v XOR v ₁ to get v ₂ , and pass it to S ₂ ; S ₁ and S ₂ use the function SecBitAdd interactively, that is, S ₁ input r ₁ and v ₁ , S ₂ inputs r ₂ and v ₂ ; S ₁ and S ₂ obtain component output values respectively;

Step C3: S ₁ and S ₂ respectively receive the component output after calling the function SecBitAdd, and judge whether the output result is positive or negative. If it is less than zero, the respective symbol positions are set to 1, otherwise they are set to 0; S ₁ and S ₂ transmit interactively respective sign bits, and perform the XOR operation of the sign bits of both parties at the same time to obtain the final sign bit result; S ₁ and S ₂ respectively output the common final sign bit result.

In this embodiment, the methods for the first server S ₁ and the second server S ₂ to respectively perform security pooling operations on the two dense component images I ₁ and I ₂ are as follows:

After receiving the input of the pooling layer, the complete MAX-POOL operation is to select the maximum value in the pooling window as the result of pooling in this area; after S ₁ and S ₂ respectively receive the input components of the pooling layer, mark The upper left pixel point in each pooling window is the maximum value position; then S ₁ and S ₂ follow the rules from left to right and from top to bottom, and perform pairwise subtraction on the pixel positions in their respective pooling windows operation, and pass the corresponding pairwise differences to each other for summing, if the summation result is less than zero, mark the pixel where the minuend is located as the maximum value position, otherwise the maximum value position remains the same as the initial value; S ₁ , S ₂ Perform this operation iteratively until the pooling window is traversed; S ₁ and S ₂ output the pixel value at the position of the maximum value in the pooling window to replace the pooling window; S ₁ and S ₂ slide the pooling window to traverse their respective component images Regions, each output the result of the pooling layer.

In this embodiment, the methods for the first server S ₁ and the second server S ₂ to perform secure full-connection operations on the two dense-state component images I ₁ and I ₂ are as follows:

The fully connected layer parameter (w; b) disclosed by the trusted server T, for the received input x of the fully connected layer, the operation of the complete fully connected layer is to calculate y=w x+b; the first server _S1 receives To the input component x ₁ , use the parameter (w; b) to execute the full connection operation, that is, calculate y ₁ =w·x ₁ +b; the second server S ₂ receives the input component x ₂ , and use the parameter (w; 0) to execute The full connection operation is to calculate y ₂ =w·x ₂ +0 and satisfy x=x ₁ +x ₂ .

In this embodiment, the method for the receiver β to perform the decryption operation is as follows: the first server S ₁ sends the output result O ₁ of the dense-state component image I ₁ to the receiver β after the VGG network forward process is completed; the second server S ₂ Send the output result O ₂ of the dense-state component image I ₂ after the VGG network forward process is executed to the receiver β; β performs the decryption operation, that is, calculates O=O ₁ +O ₂ , and obtains the dense-state image features of the original image I Extract and identify results.

The present invention also provides a secret image recognition system adopting the above method, as shown in FIG. 2 , including a sender α, a trusted server T, a first server S ₁ , a second server S ₂ and a receiver β.

The sender α is used to perform an image encryption operation, that is, the original image is randomly split and encrypted into two encrypted component images;

The trusted server T is used to disclose model training parameters, generate and distribute random security parameters involved in the security functions of each layer;

The first server S ₁ and the second server S ₂ are used to execute the privacy protection VGG network in parallel, and output feature extraction and recognition results of dense state component images respectively;

The receiver β is used for image decryption operation, that is, combining the output results of the first server S ₁ and the second server S ₂ to obtain the same encrypted image recognition result as the original image recognition result.

The above are the preferred embodiments of the present invention, and all changes made according to the technical solution of the present invention, when the functional effect produced does not exceed the scope of the technical solution of the present invention, all belong to the protection scope of the present invention.

Claims (9)

1. A confidential image recognition method based on privacy-preserving VGG, characterized in that first, the sender α encrypts the original image I into two encrypted component images I ₁ and I ₂ , and sends them to the first server S ₁ respectively and the second server S ₂ ; then the trusted server T discloses the pre-training parameters, fine-tuning training parameters and preset hyperparameters of the VGG network, generates and distributes random security parameters to the first server S ₁ and the second server S ₂ ; then The first server S ₁ and the second server S ₂ perform security convolution, activation, pooling and fully connected layer operations on the two dense component images I ₁ and I ₂ respectively; finally, the receiver β respectively receives data from the first server The output results O ₁ and O ₂ of S ₁ and the second server S ₂ are decrypted to obtain the feature extraction and recognition result O=O ₁ +O ₂ of the encrypted state image. 2. The secret image recognition method based on privacy protection VGG according to claim 1, wherein the sender α adopts (2,2)-secret segmentation threshold scheme to encrypt the original image I into two secret component images I ₁ , I ₂ , the method is: For an original image I, the sender α uses a random number generator to generate a random pixel matrix with the same size as the original image, that is, the dense-state component image I ₁ , and sends it to the first server S ₁ , and then uses the original image I to subtract De-densify the component image I ₁ to obtain the dense-state component image I ₂ , and send it to the second server S ₂ , where the selection range of the random number is [-2 ^n-1 ,2 ^n-1 -1], n= 8, 16, 32, . . . 3. The confidential image recognition method based on privacy protection VGG according to claim 2, characterized in that, the first server S ₁ and the second server S ₂ respectively identify the two confidential component images I ₁ , I ₂ The method to perform a secure convolution operation is: The trusted server T discloses the pre-training parameters, fine-tuning training parameters and hyper-parameter settings of the VGG network. Knowing the public convolution kernel parameters (w; b), the received image input value is x, and the sender according to (2 , 2)-secret segmentation threshold scheme, splitting the pixels at each position of the original image I to obtain components x ₁ and x ₂ , and x=x ₁ +x ₂ ; the first server S ₁ uses parameters (w; b ) performs a convolution operation on the received input component _x1 ; the second server _S2 performs a convolution operation on the received input component _x2 using the parameter (w; 0). 4. The confidential image recognition method based on privacy protection VGG according to claim 3, characterized in that, the first server S ₁ and the second server S ₂ respectively identify two confidential component images I ₁ , I ₂ The method to perform security activation operation is: For the received activation layer input u, the complete activation operation is to calculate the function max(u,0), set the pixel position of u<0 to 0, and the position of u≥0 remains unchanged; the first server S ₁ and the second The server S ₂ respectively receives the input components of the activation layer, and interactively uses the security comparison function SecComp to obtain the sign bit of the pixel position corresponding to the original image of the two input components; if the sign bit is equal to 1, then S ₁ and S ₂ respectively Components are set to 0, otherwise remain unchanged. 5. The secret image recognition method based on privacy protection VGG according to claim 4, wherein the security comparison function SecComp used in the security activation operation comprises a security binary multiplication function SecBitMul, a security binary addition function SecBitAdd and a security The bit extraction function SecBitExtra, in which the function SecBitMul is executed according to the following steps: Step A1: The trusted server T randomly generates a multiplication triplet, and the third number is the product of the first two numbers; generate three random numbers and distribute them to the first server S ₁ ; combine the three random numbers with the multiplication triplet Groups perform XOR operations correspondingly in turn to obtain three new random numbers and send them to the second server S ₂ ; Step A2: The first server S ₁ and the second server S ₂ respectively receive the input components of the two multipliers calling the function SecBitMul, use the random multiplication triplet and the corresponding random number, S ₁ and S ₂ finally obtain the output results respectively , satisfying that the value of the XOR of the two output results is equal to the value of the AND of the two multiplication input components, realizing the carry operation of the binary bit; The function SecBitAdd is executed as follows: Step B1: The first server S ₁ and the second server S ₂ respectively receive the input components of the two addends calling the function SecBitMul, and S ₁ and S ₂ respectively perform XOR operation on the two input components to obtain the Addend sum; by calling the function SecBitMul, set the bit position of the current carry to 1; S ₁ and S ₂ respectively perform the operation of shifting one bit to the left, and transmit the shifted results to the other party for interaction; Step B2: S ₁ and S ₂ perform XOR operation on the two new components respectively, and judge whether there is a carry, if there is, iteratively call the function SecBitMul and the left shift operation until S ₁ and S ₂ perform the addition operation Add all the carry values of , and jump out of the loop; S ₁ and S ₂ respectively output the component results of the addition; The function SecBitExtra is executed in the following steps: Step C1: Trusted server T randomly generates three random numbers r ₁ , r ₂ and γ ₁ , calculates r ₁ XOR r ₂ to get r, subtracts γ ₁ from r to get γ ₂ , and distributes r ₁ and γ ₁ to S ₁ , distribute r ₂ and γ ₂ to S ₂ ; Step C2: The first server S ₁ and the second server S ₂ receive their respective input components, respectively subtract γ ₁ and γ ₂ from the input components to obtain t ₁ and t ₂ ; S ₂ transfers t ₂ to S ₁ ; S ₁ Calculate the sum of t ₁ and t ₂ as v, and generate a random number v ₁ , calculate v XOR v ₁ to get v ₂ , and pass it to S ₂ ; S ₁ and S ₂ use the function SecBitAdd interactively, that is, S ₁ input r ₁ and v ₁ , S ₂ inputs r ₂ and v ₂ ; S ₁ and S ₂ obtain component output values respectively; Step C3: S ₁ and S ₂ respectively receive the component output after calling the function SecBitAdd, and judge whether the output result is positive or negative. If it is less than zero, the respective symbol positions are set to 1, otherwise they are set to 0; S ₁ and S ₂ transmit interactively respective sign bits, and perform the XOR operation of the sign bits of both parties at the same time to obtain the final sign bit result; S ₁ and S ₂ respectively output the common final sign bit result. 6. The confidential image recognition method based on privacy protection VGG according to claim 5, characterized in that, the first server S ₁ and the second server S ₂ respectively identify two confidential component images I ₁ , I ₂ The method to perform security pooling operation is: After receiving the input of the pooling layer, the complete MAX-POOL operation is to select the maximum value in the pooling window as the pooling result of the pooling window; after S ₁ and S ₂ respectively receive the input components of the pooling layer , mark the upper-left pixel point in the respective pooling window as the maximum position; then S ₁ and S ₂ follow the rules from left to right and from top to bottom, and perform pairwise Subtraction operation, and transfer the corresponding pairwise differences to each other for summation. If the summation result is less than zero, mark the pixel where the minuend is located as the maximum value position, otherwise the maximum value position remains unchanged from the initial value; S ₁ , S ₂ performs this operation iteratively until the pooling window is traversed; S ₁ and S ₂ output the pixel value at the position of the maximum value in the pooling window to replace the pooling window; S ₁ and S ₂ slide the pooling window to traverse their respective The component image regions each output the pooling layer results. 7. The confidential image recognition method based on privacy-preserving VGG according to claim 6, wherein the first server S ₁ and the second server S ₂ respectively identify two confidential component images I ₁ , I ₂ The method to perform secure full connection operation is: The fully connected layer parameter (w; b) disclosed by the trusted server T, for the received input x of the fully connected layer, the operation of the complete fully connected layer is to calculate y=w x+b; the first server _S1 receives To the input component x ₁ , use the parameter (w; b) to execute the full connection operation, that is, calculate y ₁ =w·x ₁ +b; the second server S ₂ receives the input component x ₂ , and use the parameter (w; 0) to execute The full connection operation is to calculate y ₂ =w·x ₂ +0 and satisfy x=x ₁ +x ₂ . 8. The confidential image recognition method based on privacy protection VGG according to claim 7, characterized in that, the receiver β performs the decryption operation as follows: the first server _S1 executes the encrypted component image _I1 through the VGG network The output result O ₁ of the forward process is sent to the receiver β; the second server S ₂ sends the output result O ₂ of the dense-state component image I ₂ after the VGG network forward process is executed to the receiver β; β performs the decryption operation, namely O=O ₁ +O ₂ is calculated to obtain the dense image feature extraction and recognition results of the original image I. 9. A dense state image recognition system adopting the method according to any one of claims 1-8, characterized in that it comprises: The sender α is used to perform image encryption operations, that is, to randomly split and encrypt the original image into two dense-state component images; The trusted server T is used to disclose model training parameters, generate and distribute random security parameters involved in the security functions of each layer; The first server S ₁ and the second server S ₂ are used to execute the privacy protection VGG network in parallel, and respectively output the feature extraction and recognition results of the dense state component image; and The receiver β is used to perform image decryption operations, that is, to combine the output results of the first server S ₁ and the second server S ₂ to obtain the same encrypted image recognition result as the original image recognition result.

Images