secretflow#

Classes:

HEU(config, spu_field_type)

Homomorphic encryption device

PYU(party)

PYU is the device doing computation in single domain.

SPU(cluster_def, link_desc, log_options, ...)

Device(device_type)

DeviceObject(device)

HEUObject(device, data, location_party[, ...])

HEU Object

PYUObject(device, data)

PYU device object.

SPUObject(device, meta, shares_name)

Functions:

init([parties, address, cluster_config, ...])

Connect to an existing Ray cluster or start one and connect to it.

proxy(device_object_type[, max_concurrency, ...])

Define a device class which should accept DeviceObject as method parameters and return DeviceObject.

reveal(func_or_object[, heu_encoder])

Get plaintext data from device.

shutdown()

Disconnect the worker, and terminate processes started by secretflow.init().

to(device, data)

Device object conversion.

wait(objects)

Wait for device objects until all are ready or error occurrency.

class secretflow.HEU(config: dict, spu_field_type)[源代码]#

基类:Device

Homomorphic encryption device

Methods:

__init__(config, spu_field_type)

Initialize HEU

init()

sk_keeper_name()

evaluator_names()

get_participant(party)

Get ray actor by name

has_party(party)

__init__(config: dict, spu_field_type)[源代码]#

Initialize HEU

参数:
  • config

    HEU init config, for example

    {
        'sk_keeper': {
            'party': 'alice'
        },
        'evaluators': [{
            'party': 'bob'
        }],
        # The HEU working mode, choose from PHEU / LHEU / FHEU_ROUGH / FHEU
        'mode': 'PHEU',
        # TODO: cleartext_type should be migrated to HeObject.
        'encoding': {
            # DT_I1, DT_I8, DT_I16, DT_I32, DT_I64 or DT_FXP (default)
            'cleartext_type': "DT_FXP"
            # see https://www.secretflow.org.cn/docs/heu/en/getting_started/quick_start.html#id3 for detail
            # available encoders:
            #     - IntegerEncoder: Plaintext = Cleartext * scale
            #     - FloatEncoder (default): Plaintext = Cleartext * scale
            #     - BigintEncoder: Plaintext = Cleartext
            #     - BatchIntegerEncoder: Plaintext = Pack[Cleartext, Cleartext]
            #     - BatchFloatEncoder: Plaintext = Pack[Cleartext, Cleartext]
            'encoder': 'FloatEncoder'
        }
        'he_parameters': {
            'schema': 'paillier',
            'key_pair': {
                'generate': {
                    'bit_size': 2048,
                },
            }
        }
    }
    

  • spu_field_type – Field type in spu, Device.to operation requires the data scale of HEU to be aligned with SPU

init()[源代码]#
sk_keeper_name()[源代码]#
evaluator_names()[源代码]#
get_participant(party: str)[源代码]#

Get ray actor by name

has_party(party: str)[源代码]#
class secretflow.PYU(party: str)[源代码]#

基类:Device

PYU is the device doing computation in single domain.

Essentially PYU is a python worker who can execute any python code.

Methods:

__init__(party)

PYU contructor.

dump(obj, path)

load(path)

__init__(party: str)[源代码]#

PYU contructor.

参数:

party (str) – Party name where this device is located.

dump(obj: PYUObject, path: str)[源代码]#
load(path: str)[源代码]#
class secretflow.SPU(cluster_def: ~typing.Dict, link_desc: ~typing.Optional[~typing.Dict] = None, log_options: ~spu.libspu.logging.LogOptions = <spu.libspu.logging.LogOptions object>, use_link: bool = True)[源代码]#

基类:Device

Methods:

__init__(cluster_def[, link_desc, ...])

SPU device constructor.

init()

Init SPU runtime in each party

reset()

Reset spu to clear corrupted internal state, for test only

shutdown()

dump(obj, paths)

load(paths)

infeed_shares(shares)

outfeed_shares(shares_name)

psi_df(key, dfs, receiver[, protocol, ...])

Private set intersection with DataFrame.

psi_csv(key, input_path, output_path, receiver)

Private set intersection with csv file.

psi_join_df(key, dfs, receiver, join_party)

Private set intersection with DataFrame.

psi_join_csv(key, input_path, output_path, ...)

Private set intersection with csv file.

pir_setup(server, input_path, key_columns, ...)

Private information retrival offline setup. :param server: Which party is pir server. :type server: str :param input_path: Server's CSV file path. comma separated and contains header. Use an absolute path. :type input_path: str :param key_columns: Column(s) used as pir key :type key_columns: str, List[str] :param label_columns: Column(s) used as pir label :type label_columns: str, List[str] :param oprf_key_path: Ecc oprf secret key path, 32B binary format. Use an absolute path. :type oprf_key_path: str :param setup_path: Offline/Setup phase output data dir. Use an absolute path. :type setup_path: str :param num_per_query: Items number per query. :type num_per_query: int :param label_max_len: Max number bytes of label, padding data to label_max_len Max label bytes length add 4 bytes(len). :type label_max_len: int.

pir_query(server, config[, protocol])

Private information retrival online query. :param server: Which party is pir server. :type server: str :param config: Server/Client config dict For example.

__init__(cluster_def: ~typing.Dict, link_desc: ~typing.Optional[~typing.Dict] = None, log_options: ~spu.libspu.logging.LogOptions = <spu.libspu.logging.LogOptions object>, use_link: bool = True)[源代码]#

SPU device constructor.

参数:
  • cluster_def

    SPU cluster definition. More details refer to SPU runtime config.

    For example

    {
        'nodes': [
            {
                'party': 'alice',
                # The address for other peers.
                'address': '127.0.0.1:9001',
                # The listen address of this node.
                # Optional. Address will be used if listen_address is empty.
                'listen_address': '',
                # Optional. TLS related options.
                'tls_opts': {
                    'server_ssl_opts': {
                        'certificate_path': 'servercert.pem',
                        'private_key_path': 'serverkey.pem',
                        # The options used for verify peer's client certificate
                        'ca_file_path': 'cacert.pem',
                        # Maximum depth of the certificate chain for verification
                        'verify_depth': 1
                    },
                    'client_ssl_opts': {
                        'certificate_path': 'clientcert.pem',
                        'private_key_path': 'clientkey.pem',
                        # The options used for verify peer's server certificate
                        'ca_file_path': 'cacert.pem',
                        # Maximum depth of the certificate chain for verification
                        'verify_depth': 1
                    }
                }
            },
            {
                'party': 'bob',
                'address': '127.0.0.1:9002',
                'listen_address': '',
                'tls_opts': {
                    'server_ssl_opts': {
                        'certificate_path': "bob's servercert.pem",
                        'private_key_path': "bob's serverkey.pem",
                        'ca_file_path': "other's client cacert.pem",
                        'verify_depth': 1
                    },
                    'client_ssl_opts': {
                        'certificate_path': "bob's clientcert.pem",
                        'private_key_path': "bob's clientkey.pem",
                        'ca_file_path': "other's server cacert.pem",
                        'verify_depth': 1
                    }
                }
            },
        ],
        'runtime_config': {
            'protocol': spu.spu_pb2.SEMI2K,
            'field': spu.spu_pb2.FM128,
            'sigmoid_mode': spu.spu_pb2.RuntimeConfig.SIGMOID_REAL,
        }
    }
    

  • link_desc

    Optional. A dict specifies the link parameters. Available parameters are:

    1. connect_retry_times

    2. connect_retry_interval_ms

    3. recv_timeout_ms

    4. http_max_payload_size

    5. http_timeout_ms

    6. throttle_window_size

    7. brpc_channel_protocol refer to https://github.com/apache/brpc/blob/master/docs/en/client.md#protocols

    8. brpc_channel_connection_type refer to https://github.com/apache/brpc/blob/master/docs/en/client.md#connection-type

  • log_options – Optional. Options of spu logging.

  • use_link – Optional. flag for create brpc link, default True.

init()[源代码]#

Init SPU runtime in each party

reset()[源代码]#

Reset spu to clear corrupted internal state, for test only

shutdown()[源代码]#
dump(obj: SPUObject, paths: List[str])[源代码]#
load(paths: List[str]) SPUObject[源代码]#
infeed_shares(shares: List[Union[ObjectRef, FedObject]]) List[Union[ObjectRef, FedObject]][源代码]#
outfeed_shares(shares_name: List[Union[ObjectRef, FedObject]]) List[Union[ObjectRef, FedObject]][源代码]#
psi_df(key: Union[str, List[str], Dict[Device, List[str]]], dfs: List[PYUObject], receiver: str, protocol='KKRT_PSI_2PC', precheck_input=True, sort=True, broadcast_result=True, bucket_size=1048576, curve_type='CURVE_25519', preprocess_path=None, ecdh_secret_key_path=None, dppsi_bob_sub_sampling=0.9, dppsi_epsilon=3)[源代码]#

Private set intersection with DataFrame.

参数:
  • key (str, List[str], Dict[Device, List[str]]) – Column(s) used to join.

  • dfs (List[PYUObject]) – DataFrames to be joined, which

  • runtimes. (should be colocated with SPU) –

  • receiver (str) – Which party can get joined data, others will get None.

  • protocol (str) – PSI protocol.

  • precheck_input (bool) – Whether to check input data before join.

  • sort (bool) – Whether sort data by key after join.

  • broadcast_result (bool) – Whether to broadcast joined data to all parties.

  • bucket_size (int) – Specified the hash bucket size used in psi.

  • memory. (Larger values consume more) –

  • curve_type (str) – curve for ecdh psi.

  • preprocess_path (str) – preprocess file path for unbalanced psi.

  • ecdh_secret_key_path (str) – ecdh_oprf secretkey file path, binary format, 32B, for unbalanced psi.

  • dppsi_bob_sub_sampling (double) – bob subsampling bernoulli_distribution probability of dp psi

  • dppsi_epsilon (double) – epsilon of dp psi

返回:

Joined DataFrames with order reserved.

返回类型:

List[PYUObject]

psi_csv(key: Union[str, List[str], Dict[Device, List[str]]], input_path: Union[str, Dict[Device, str]], output_path: Union[str, Dict[Device, str]], receiver: str, protocol='KKRT_PSI_2PC', precheck_input=True, sort=True, broadcast_result=True, bucket_size=1048576, curve_type='CURVE_25519', preprocess_path=None, ecdh_secret_key_path=None, dppsi_bob_sub_sampling=0.9, dppsi_epsilon=3)[源代码]#

Private set intersection with csv file.

参数:
  • key (str, List[str], Dict[Device, List[str]]) – Column(s) used to join.

  • input_path – CSV files to be joined, comma separated and contains header. Use an absolute path.

  • output_path – Joined csv files, comma separated and contains header. Use an absolute path.

  • receiver (str) – Which party can get joined data.

  • -1. (Others won't generate output file and intersection_count get) –

  • protocol (str) – PSI protocol.

  • precheck_input (bool) – Whether check input data before joining,

  • now (for) –

  • duplicate. (it will check if key) –

  • sort (bool) – Whether sort data by key after joining.

  • broadcast_result (bool) – Whether broadcast joined data to all parties.

  • bucket_size (int) – Specified the hash bucket size used in psi.

  • memory. (Larger values consume more) –

  • curve_type (str) – curve for ecdh psi.

  • preprocess_path (str) – preprocess file path for unbalanced psi.

  • ecdh_secret_key_path (str) – ecdh_oprf secretkey file path, binary format, 32B.

  • dppsi_bob_sub_sampling (double) – bob subsampling bernoulli_distribution probability of dp psi

  • dppsi_epsilon (double) – epsilon of dp psi

返回:

PSI reports output by SPU with order reserved.

返回类型:

List[Dict]

psi_join_df(key: Union[str, List[str], Dict[Device, List[str]]], dfs: List[PYUObject], receiver: str, join_party: str, protocol='KKRT_PSI_2PC', precheck_input=True, bucket_size=1048576, curve_type='CURVE_25519')[源代码]#

Private set intersection with DataFrame.

参数:
  • key (str, List[str], Dict[Device, List[str]]) – Column(s) used to join.

  • dfs (List[PYUObject]) – DataFrames to be joined, which should be colocated with SPU runtimes.

  • receiver (str) – Which party can get joined data. Others won’t generate output file and intersection_count get -1

  • join_party (str) – party can get joined data

  • protocol (str) – PSI protocol.

  • precheck_input (bool) – Whether check input data before joining, for now, it will check if key duplicate.

  • bucket_size (int) – Specified the hash bucket size used in psi. Larger values consume more memory.

  • curve_type (str) – curve for ecdh psi

返回:

Joined DataFrames with order reserved.

返回类型:

List[PYUObject]

psi_join_csv(key: Union[str, List[str], Dict[Device, List[str]]], input_path: Union[str, Dict[Device, str]], output_path: Union[str, Dict[Device, str]], receiver: str, join_party: str, protocol='KKRT_PSI_2PC', precheck_input=True, bucket_size=1048576, curve_type='CURVE_25519')[源代码]#

Private set intersection with csv file.

参数:
  • key (str, List[str], Dict[Device, List[str]]) – Column(s) used to join.

  • input_path – CSV files to be joined, comma separated and contains header. Use an absolute path.

  • output_path – Joined csv files, comma separated and contains header. Use an absolute path.

  • receiver (str) – Which party can get joined data. Others won’t generate output file and intersection_count get -1

  • join_party (str) – party can get joined data

  • protocol (str) – PSI protocol.

  • precheck_input (bool) – Whether check input data before joining, for now, it will check if key duplicate.

  • bucket_size (int) – Specified the hash bucket size used in psi. Larger values consume more memory.

  • curve_type (str) – curve for ecdh psi

返回:

PSI reports output by SPU with order reserved.

返回类型:

List[Dict]

pir_setup(server: str, input_path: Union[str, Dict[Device, str]], key_columns: Union[str, List[str]], label_columns: Union[str, List[str]], oprf_key_path: str, setup_path: str, num_per_query: int, label_max_len: int, protocol='KEYWORD_PIR_LABELED_PSI')[源代码]#

Private information retrival offline setup. :param server: Which party is pir server. :type server: str :param input_path: Server’s CSV file path. comma separated and contains header.

Use an absolute path.

参数:
  • key_columns (str, List[str]) – Column(s) used as pir key

  • label_columns (str, List[str]) – Column(s) used as pir label

  • oprf_key_path (str) – Ecc oprf secret key path, 32B binary format. Use an absolute path.

  • setup_path (str) – Offline/Setup phase output data dir. Use an absolute path.

  • num_per_query (int) – Items number per query.

  • label_max_len (int) – Max number bytes of label, padding data to label_max_len Max label bytes length add 4 bytes(len).

返回:

PIR report output by SPU.

返回类型:

Dict

pir_query(server: str, config: Dict, protocol='KEYWORD_PIR_LABELED_PSI')[源代码]#

Private information retrival online query. :param server: Which party is pir server. :type server: str :param config: Server/Client config dict

For example

{
    # client config
    alice: {
        'input_path': '/path/intput.csv',
        'key_columns': 'id',
        'output_path': '/path/output.csv',
    },
    # server config
    bob: {
        'oprf_key_path': '/path/oprf_key.bin',
        'setup_path': '/path/setup_dir',
    },
}
server config dict must have:

‘oprf_key_path’,’setup_path’ oprf_key_path (str): Ecc oprf secret key path, 32B binary format.

Use an absolute path.

setup_path (str): Offline/Setup phase output data dir. Use an absolute path.

client config dict must have:

‘input_path’,’key_columns’, ‘output_path’ input_path (str): Client’s CSV file path. comma separated and contains header.

Use an absolute path.

key_columns (str, List[str]): Column(s) used as pir key output_path (str): Query result save to output_path, csv format.

返回:

PIR report output by SPU.

返回类型:

Dict

class secretflow.Device(device_type: DeviceType)[源代码]#

基类:ABC

Methods:

__init__(device_type)

Abstraction device base class.

Attributes:

device_type

Get underlying device type

__init__(device_type: DeviceType)[源代码]#

Abstraction device base class.

参数:

device_type (DeviceType) – underlying device type

property device_type#

Get underlying device type

class secretflow.DeviceObject(device: Device)[源代码]#

基类:ABC

Methods:

__init__(device)

Abstraction device object base class.

to(device, *args, **kwargs)

Device object conversion.

Attributes:

device_type

Get underlying device type

__init__(device: Device)[源代码]#

Abstraction device object base class.

参数:

device (Device) – Device where this object is located.

property device_type#

Get underlying device type

to(device: Device, *args, **kwargs)[源代码]#

Device object conversion.

参数:
  • device (Device) – Target device

  • config – configuration of this data movement

返回:

Target device object.

返回类型:

DeviceObject

class secretflow.HEUObject(device, data: ObjectRef, location_party: str, is_plain: bool = False)[源代码]#

基类:DeviceObject

HEU Object

data#

The data hold by this Heu object

location#

The party where the data actually resides

is_plain#

Is the data encrypted or not

Methods:

__init__(device, data, location_party[, ...])

Abstraction device object base class.

encrypt([heu_audit_log])

Force encrypt if data is plaintext

sum()

Sum of HeObject elements over a given axis.

dump(path)

Dump ciphertext into files.

select_sum(item)

Sum of HEUObject selected elements

batch_select_sum(item)

Sum of HEUObject selected elements

feature_wise_bucket_sum(subgroup_map, ...[, ...])

Sum of HEUObject selected elements

batch_feature_wise_bucket_sum(subgroup_map, ...)

Sum of HEUObject selected elements

__init__(device, data: ObjectRef, location_party: str, is_plain: bool = False)[源代码]#

Abstraction device object base class.

参数:

device (Device) – Device where this object is located.

encrypt(heu_audit_log: Optional[str] = None)[源代码]#

Force encrypt if data is plaintext

sum()[源代码]#

Sum of HeObject elements over a given axis.

返回:

sum_along_axis

dump(path)[源代码]#

Dump ciphertext into files.

select_sum(item)[源代码]#

Sum of HEUObject selected elements

batch_select_sum(item)[源代码]#

Sum of HEUObject selected elements

feature_wise_bucket_sum(subgroup_map, order_map, bucket_num, cumsum=False)[源代码]#

Sum of HEUObject selected elements

batch_feature_wise_bucket_sum(subgroup_map, order_map, bucket_num, cumsum=False)[源代码]#

Sum of HEUObject selected elements

class secretflow.PYUObject(device: PYU, data: Union[ObjectRef, FedObject])[源代码]#

基类:DeviceObject

PYU device object.

data#

Reference to underlying data.

Methods:

__init__(device, data)

Abstraction device object base class.

__init__(device: PYU, data: Union[ObjectRef, FedObject])[源代码]#

Abstraction device object base class.

参数:

device (Device) – Device where this object is located.

class secretflow.SPUObject(device: Device, meta: Union[ObjectRef, FedObject], shares_name: Sequence[Union[ObjectRef, FedObject]])[源代码]#

基类:DeviceObject

Methods:

__init__(device, meta, shares_name)

SPUObject refers to a Python Object which could be flattened to a list of SPU Values.

__init__(device: Device, meta: Union[ObjectRef, FedObject], shares_name: Sequence[Union[ObjectRef, FedObject]])[源代码]#

SPUObject refers to a Python Object which could be flattened to a list of SPU Values. An SPU value is a Numpy array or equivalent. e.g.

1. If referred Python object is [1,2,3] Then meta would be referred to a single SPUValueMeta, and shares is a list of referrence to pieces of share of [1,2,3].

2. If referred Python object is {‘a’: 1, ‘b’: [3, np.array(…)]} The meta would be referred to something like {‘a’: SPUValueMeta1, ‘b’: [SPUValueMeta2, SPUValueMeta3]} Each element of shares would be referred to something like {‘a’: share1, ‘b’: [share2, share3]}

3. shares is a list of ObjectRef to share slices while these share slices are not necessarily located at SPU device. The data transfer would only happen when SPU device consumes SPU objects.

参数:
  • meta – Union[ray.ObjectRef, fed.FedObject]: Ref to the metadata.

  • shares_name – Sequence[Union[ray.ObjectRef, fed.FedObject]]: names of shares of data in each SPU node.

secretflow.init(parties: Optional[Union[str, List[str]]] = None, address: Optional[str] = None, cluster_config: Optional[Dict] = None, num_cpus: Optional[int] = None, log_to_driver=True, omp_num_threads: Optional[int] = None, logging_level: str = 'info', cross_silo_grpc_retry_policy: Optional[Dict] = None, cross_silo_send_max_retries: Optional[int] = None, cross_silo_messages_max_size_in_bytes: Optional[int] = None, cross_silo_serializing_allowed_list: Optional[Dict] = None, cross_silo_timeout_in_seconds: int = 3600, exit_on_failure_cross_silo_sending: bool = True, enable_waiting_for_other_parties_ready: bool = True, tls_config: Optional[Dict[str, Dict]] = None, auth_manager_config: Optional[Dict] = None, party_key_pair: Optional[Dict[str, Dict]] = None, tee_simulation: bool = False, **kwargs)[源代码]#

Connect to an existing Ray cluster or start one and connect to it.

参数:
  • parties – parties this node represents, e.g: ‘alice’, [‘alice’, ‘bob’, ‘carol’]. If parties are provided, then simulation mode will be enabled, which means a single ray cluster will simulate as multi parties. If you want to run SecretFlow in production mode, plean keep it None.

  • address – The address of the Ray cluster to connect to. If this address is not provided, then a local ray will be started.

  • cluster_config

    the cluster config of multi SecretFlow parties. Must be provided if you run SecretFlow in cluster mode. E.g.

    # For alice
    {
        'parties': {
            'alice': {
                # The address for other parties.
                'address': '127.0.0.1:10001',
                # (Optional) the listen address, the `address` will
                # be used if not prodived.
                'listen_addr': '0.0.0.0:10001'
            },
            'bob': {
                # The address for other parties.
                'address': '127.0.0.1:10002',
                # (Optional) the listen address, the `address` will
                # be used if not prodived.
                'listen_addr': '0.0.0.0:10002'
            },
        },
        'self_party': 'alice'
    }
    
    # For bob
    {
        'parties': {
            'alice': {
                # The address for other parties.
                'address': '127.0.0.1:10001',
                # (Optional) the listen address, the `address` will
                # be used if not prodived.
                'listen_addr': '0.0.0.0:10001'
            },
            'bob': {
                # The address for other parties.
                'address': '127.0.0.1:10002',
                # (Optional) the listen address, the `address` will
                # be used if not prodived.
                'listen_addr': '0.0.0.0:10002'
            },
        },
        'self_party': 'bob'
    }
    

  • num_cpus – Number of CPUs the user wishes to assign to each raylet.

  • log_to_driver – Whether direct output of worker processes on all nodes to driver.

  • omp_num_threads – set environment variable OMP_NUM_THREADS. It works only when address is None.

  • logging_level – optional; works only in production mode. the logging level, could be debug, info, warning, error, critical, not case sensititive.

  • cross_silo_grpc_retry_policy

    optional, works only in production mode. a dict descibes the retry policy for cross silo rpc call. If None, the following default retry policy will be used. More details please refer to retry-policy.

    {
        "maxAttempts": 4,
        "initialBackoff": "0.1s",
        "maxBackoff": "1s",
        "backoffMultiplier": 2,
        "retryableStatusCodes": [
            "UNAVAILABLE"
        ]
    }
    

  • cross_silo_send_max_retries – optional, works only in production mode. the max retries for sending data cross silo.

  • cross_silo_messages_max_size_in_bytes – int, works only in production mode. the max number of byte for one transaction. The size must be strictly less than 2GB, i.e. 2 * (1024 ** 3).

  • cross_silo_serializing_allowed_list

    optional, works only in production mode. A dict describes the package or class list allowed for cross-silo serializing(deserializating). It’s used for avoiding pickle deserializing execution attack when crossing silos. E.g.

    {
        "numpy.core.numeric": ["*"],
        "numpy": ["dtype"],
    }
    

  • cross_silo_timeout_in_seconds – The timeout in seconds of a cross-silo RPC call. It’s 3600 by default.

  • exit_on_failure_cross_silo_sending – optional, works only in production mode. whether exit when failure on cross-silo sending. If True, a SIGTERM will be signaled to self if failed to sending cross-silo data.

  • enable_waiting_for_other_parties_ready – wait for other parties ready if True.

  • tls_config

    optional, a dict describes the tls certificate and key infomations. E.g.

    {
        'key': 'server key in pem.'
        'cert': 'server certificate in pem.',
        'ca_cert': 'root ca certificate of other parties.'
    }
    

  • auth_manager_config

    optional, a dict describes the config about authority manager service. Authority manager helps manage the authority of TEE data. This parameter is for TEE users only. An example,

    {
        'host': 'host of authority manager service.'
        'mr_enclave': 'mr_enclave of authority manager.',
        'ca_cert': 'optional, root ca certificate of authority manager.'
    }
    

  • party_key_pair

    optional, a dict describes the asymmetric key pair. This is required for party who wants to send data to TEEU. E.g.

    # For alice
    {
        'alice': {
            'public_key': 'RSA public key of alice in pem.',
            'private_key': 'RSA private key of alice in pem.',
        }
    }
    
    # For bob
    {
        'bob': {
            'public_key': 'RSA public key of bob in pem.',
            'private_key': 'RSA private key of bob in pem.',
        }
    }
    

  • tee_simulation – optional, enable TEE simulation if True. When simulation is enabled, the remote attestation for auth manager will be ignored. This is for test only and keep it False when for production.

  • **kwargs – see ray.init() parameters.

secretflow.proxy(device_object_type: Type[DeviceObject], max_concurrency: Optional[int] = None, _simulation_max_concurrency: Optional[int] = None)[源代码]#

Define a device class which should accept DeviceObject as method parameters and return DeviceObject.

This proxy function mainly does the following work: 1. Add an additional parameter device: Device to init method __init__. 2. Wrap class methods, allow passing DeviceObject as parameters, which must be on the same device as the class instance. 3. According to the return annotation of class methods, return the corresponding number of DeviceObject.

@proxy(PYUObject)
class Model:
    def __init__(self, builder):
        self.weights = builder()

    def build_dataset(self, x, y):
        self.dataset_x = x
        self.dataset_y = y

    def get_weights(self) -> np.ndarray:
        return self.weights

    def train_step(self, step) -> Tuple[np.ndarray, int]:
        return self.weights, 100

alice = PYU('alice')
model = Model(builder, device=alice)
x, y = alice(load_data)()
model.build_dataset(x, y)
w = model.get_weights()
w, n = model.train_step(10)
参数:
  • device_object_type (Type[DeviceObject]) – DeviceObject type, eg. PYUObject.

  • max_concurrency (int) – Actor threadpool size.

  • _simulation_max_concurrencty (int) – Actor threadpool size only for simulation (single controller mode). This argument takes effect only when max_concurrency is None.

返回:

Wrapper function.

返回类型:

Callable

secretflow.reveal(func_or_object, heu_encoder=None)[源代码]#

Get plaintext data from device.

NOTE: Use this function with extreme caution, as it may cause privacy leaks. In SecretFlow, we recommend that data should flow between different devices and rarely revealed to driver. Only use this function when data dependency control flow occurs.

参数:
  • func_or_object – May be callable or any Python objects which contains Device objects.

  • heu_encoder – Can be heu Encoder or EncoderParams. This is used to replace the default encoder from config

secretflow.shutdown()[源代码]#

Disconnect the worker, and terminate processes started by secretflow.init().

This will automatically run at the end when a Python process that uses Ray exits. It is ok to run this twice in a row. The primary use case for this function is to cleanup state between tests.

secretflow.to(device: Device, data: Any)[源代码]#

Device object conversion.

参数:
  • device (Device) – Target device.

  • data (Any) – DeviceObject or plaintext data.

返回:

Target device object.

返回类型:

DeviceObject

secretflow.wait(objects: Any)[源代码]#

Wait for device objects until all are ready or error occurrency.

NOTE: This function uses reveal internally, but won’t reveal result to public. So this is secure to use this as synchronization semantics.

参数:

objects – struct of device objects.

示例

>>> spu = sf.SPU()
>>> spu_value = spu(some_function)(some_value)
>>> alice_value = spu_value.to(alice)
>>> # synchronization
>>> sf.wait(alice(some_save_value_function_locally)(alice_value))

secretflow.cli#

Functions:

print_version(ctx, param, value)

secretflow.cli.print_version(ctx, param, value)[源代码]#

secretflow.version#