Model encryption method and device and model decryption method and device

Abstract

The invention discloses a model encryption method and device and a model decryption method and device, and the method comprises the steps: carrying out the parameter confusion processing of original parameters of at least one target network layer in a to-be-encrypted model, and obtaining a model after the parameter confusion processing and parameter confusion data, the parameter confusion data is used for restoring original parameters of the target network layer before parameter confusion processing; intercepting at least one target byte block from a target byte stream corresponding to the model after parameter confusion processing; performing encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block; each target byte block in the target byte stream is replaced with the corresponding encrypted byte block, the encrypted byte stream and position index data are obtained, and the position index data are used for indicating the position of the encrypted byte block in the encrypted byte stream; and integrating the encrypted byte stream, the encrypted parameter confusion data, the encrypted data and the position index data to obtain model encrypted data of the model.

Description

Technical Field

[0001] The present application relates to the field of model encryption technology, and in particular to a model encryption method and device, and a model decryption method and device. Background Art

[0002] With the development of deep learning technology, models based on deep learning are widely used in various industries. As the core technology of model development companies, model development companies encrypt their models to prevent others from accessing the model parameters.

[0003] At present, model encryption methods generally include the following two methods: one is to use encryption algorithms such as AES (Advanced Encryption Standard, symmetric encryption algorithm) to fully encrypt the model file of the model. This encryption method requires the full decryption of the model file when the model is applied before model reasoning can be started based on the decrypted model file. Full decryption takes a long time, which delays the startup speed of model reasoning, resulting in a large model reasoning delay. Moreover, since the fully decrypted model file exists in plain text, the model parameters are easily leaked; the other is to use secure multi-party computing, homomorphic encryption and other technologies to encrypt the model. This encryption method uses the model in ciphertext form for reasoning when the model is applied. Although the possibility of model parameter leakage in ciphertext form is small, the computational overhead and communication overhead of model reasoning in ciphertext form are large, resulting in a large model reasoning delay.

[0004] Therefore, how to reduce the possibility of model parameter leakage while reducing the model inference delay caused by model encryption has become an urgent problem that needs to be solved. Summary of the Invention

[0005] This application proposes a model encryption method and device, and a model decryption method and device, the main purpose of which is to reduce the possibility of model parameter leakage while reducing the model inference delay caused by model encryption.

[0006] In order to achieve the above objectives, this application mainly provides the following technical solutions:

[0007] In a first aspect, the present application provides a model encryption method, which includes: performing parameter obfuscation processing on the original parameters of at least one target network layer in the encryption model to obtain the model and parameter obfuscation data after the parameter obfuscation processing, and the parameter obfuscation data is used to restore the original parameters of the target network layer before the parameter obfuscation processing; intercepting at least one target byte block from the target byte stream corresponding to the model after the parameter obfuscation processing; performing encryption processing on each of the target byte blocks to obtain an encrypted byte block and encrypted data corresponding to each of the target byte blocks, and the encrypted data is used to restore the target byte block corresponding to the encrypted byte block; replacing each of the target byte blocks in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data, and the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream; integrating the encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data to obtain the model encryption data of the model to be encrypted.

[0008] In the second aspect, the present application provides a model decryption method, which may include: obtaining model encryption data of the model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted by the model encryption method described in the first aspect; loading the encrypted byte stream included in the model encryption data, and decrypting the encrypted data and position index data included in the model encryption data; locating the encrypted byte block in the encrypted byte stream based on the decrypted encrypted data; decrypting each encrypted byte block based on the decrypted encrypted data, and restoring the target byte block corresponding to each encrypted byte block; replacing each target byte block in the encrypted byte stream with the corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted; performing model conversion processing on the target byte stream to obtain the model to be decrypted; if the model to be decrypted is called for business reasoning, then each time it is applied to a target network layer in the model to be decrypted, the parameter obfuscation data corresponding to the target network layer included in the model encryption data is decrypted, and the original parameters of the target network layer before the parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer performs business reasoning based on the original parameters.

[0009] In a third aspect, the present application provides a model encryption device, the model encryption device comprising:

[0010] A first processing module is configured to perform parameter obfuscation processing on original parameters of at least one target network layer in the to-be-encrypted model to obtain a model and parameter obfuscation data after the parameter obfuscation processing, wherein the parameter obfuscation data is used to restore the original parameters of the target network layer before the parameter obfuscation processing;

[0011] An interception module, configured to intercept at least one target byte block from a target byte stream corresponding to the model after parameter obfuscation processing;

[0012] a second processing module, configured to perform encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block, wherein the encrypted data is used to restore the target byte block corresponding to the encrypted byte block;

[0013] a first replacing module, configured to replace each target byte block in the target byte stream with a corresponding encrypted byte block, to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate a position of the encrypted byte block in the encrypted byte stream;

[0014] An integration module is used to integrate the encrypted byte stream and the parameter obfuscation data, encrypted data, and position index data after encryption to obtain the model encryption data of the model to be encrypted.

[0015] In a fourth aspect, the present application provides a model decryption device, the model decryption device comprising:

[0016] An acquisition module, configured to acquire model encryption data of the model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted using the model encryption method described in the first aspect;

[0017] a processing module, configured to load the encrypted byte stream included in the model encrypted data, and decrypt the encrypted data and position index data included in the model encrypted data;

[0018] a positioning module, configured to locate an encrypted byte block in the encrypted byte stream based on the decrypted position index data;

[0019] A restoration module, configured to perform decryption processing on each encrypted byte block based on the decrypted encrypted data, and restore a target byte block corresponding to each encrypted byte block;

[0020] A second replacement module is used to replace each target byte block in the encrypted byte stream with a corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted;

[0021] A conversion module, configured to perform model conversion processing on the target byte stream to obtain a model to be decrypted;

[0022] A calling module is used to decrypt the parameter obfuscation data corresponding to the target network layer included in the model encryption data if the model to be decrypted is called for business reasoning, and restore the original parameters of the target network layer before the parameter obfuscation processing based on the decrypted parameter obfuscation data, so that the target network layer performs business reasoning based on the original parameters.

[0023] In a fifth aspect, the present application provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the model encryption method described in the first aspect, and / or execute the model decryption method described in the second aspect.

[0024] In a sixth aspect, the present application provides an electronic device, comprising: a memory for storing a program; a processor, coupled to the memory, for running the program to execute the model encryption method described in the first aspect, and / or, execute the model decryption method described in the second aspect.

[0025] The model encryption method and device, and the model decryption method and device provided in this application adopt the method of first performing parameter obfuscation processing on the original parameters of at least part of the network layer of the model, then intercepting the target byte block from the byte stream of the model after the parameter obfuscation processing and encrypting the target byte block, and finally encrypting the model by replacing the original intercepted target byte block with the encrypted byte block. It can be seen that the solution provided by this embodiment encrypts the model from the two dimensions of parameter obfuscation and byte encryption, thereby at least being able to obtain the following technical effects: First, since only the target byte block intercepted from the byte stream is encrypted, only the target byte block needs to be decrypted to restore the byte stream of the model when the model is applied. In this way, the decryption takes less time and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; second, since the parameters of at least part of the network layer of the model are subjected to parameter obfuscation processing, the original parameters of these network layers cannot be obtained from the restored byte stream, thereby reducing the possibility of leakage of the original parameters of the model. Third, when calling the model for inference based on the restored byte stream, only the parameters of the currently applied network layer are restored, while the parameters of the currently unapplied network layer are not restored. This not only ensures the smooth progress of model inference based on the restored original parameters, but also minimizes the possibility of model parameter leakage.

[0026] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0028] Figure 1 A flow chart of a model encryption method provided by one embodiment of the present application is shown;

[0029] Figure 2 A flow chart of a model decryption method provided by one embodiment of the present application is shown;

[0030] Figure 3 A schematic diagram of a target network layer of a model provided by an embodiment of the present application is shown;

[0031] Figure 4 A schematic diagram of a model encryption process provided by an embodiment of the present application is shown;

[0032] Figure 5 A schematic diagram showing a model decryption process provided by an embodiment of the present application is shown;

[0033] Figure 6 A schematic structural diagram of a model encryption device provided by an embodiment of the present application is shown;

[0034] Figure 7 A schematic structural diagram of a model encryption device provided by another embodiment of the present application is shown;

[0035] Figure 8 A schematic structural diagram of a model decryption device provided by an embodiment of the present application is shown;

[0036] Figure 9 A schematic structural diagram of a model decryption device provided in another embodiment of the present application is shown. DETAILED DESCRIPTION

[0037] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0038] Models are the core technology of model development companies. If model parameters become known to others, there are at least two negative consequences: First, the model can be directly used by those who know it, infringing on the rights and interests of the model development company and weakening its technological competitiveness. Second, those who know the model can launch white-box attacks based on the model parameters, causing the model to misjudge or fail, thereby creating negative public opinion about the model's application, giving the model a bad reputation, and thus weakening its market competitiveness. Based on these two negative consequences, model development companies typically encrypt their models to reduce the possibility of model parameter leakage.

[0039] Existing model encryption methods that fully encrypt the model file based on encryption algorithms such as AES require the full decryption of the model file before model inference can be started based on the decrypted model file when the model is applied. Full decryption takes a long time, which delays the startup speed of model inference and causes a large model inference delay. Moreover, since the fully decrypted model file exists in plaintext, the model parameters are easily leaked. Existing model encryption methods that encrypt the model using technologies such as secure multi-party computing and homomorphic encryption perform inference in ciphertext when the model is applied. Although the possibility of model parameter leakage in ciphertext is low, the computational and communication overhead of model inference in ciphertext is high, resulting in a large model inference delay. It can be seen that existing model encryption methods are difficult to reduce the possibility of model parameter leakage while reducing the model inference delay caused by model encryption, resulting in poor model performance.

[0040] After research, it was found that when encrypting a model, the original parameters of at least part of the network layer of the model can be first obfuscated, and the obfuscated parameter data can be recorded. The obfuscated parameter data is used to restore the original parameters of these network layers before the obfuscation. Then, byte blocks are intercepted from the corresponding byte stream of the model after the obfuscation and encrypted to obtain the encrypted model. It can be seen that the model can be encrypted from the two dimensions of parameter obfuscation and byte encryption, so that at least the following technical effects can be obtained: First, since only the target byte blocks intercepted from the byte stream are encrypted, only the target byte blocks need to be decrypted when the model is applied to restore the byte stream of the model. In this way, the decryption time is short, and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; second, since the parameters of at least part of the network layer of the model are obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, so the possibility of leakage of the original parameters of the model can be reduced. Third, when calling the model for inference based on the restored byte stream, only the parameters of the currently applied network layer that has been processed with parameter obfuscation are restored, while the parameters of the currently unapplied network layer that has been processed with parameter obfuscation are not restored. This not only ensures the smooth progress of model inference based on the restored original parameters, but also minimizes the possibility of model parameter leakage.

[0041] Based on the above findings, this embodiment specifically provides a technical solution for model encryption, which is: performing parameter obfuscation processing on the original parameters of at least one target network layer in the model to be encrypted to obtain the model and parameter obfuscation data after parameter obfuscation processing, and the parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation processing; intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing; encrypting each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block, and the encrypted data is used to restore the target byte block corresponding to the encrypted byte block; replacing each target byte block in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data, and the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream; integrating the encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data to obtain model encryption data of the model to be encrypted.

[0042] Accordingly, based on the above-mentioned model encryption technical solution, this embodiment also proposes a model decryption technical solution, specifically comprising: obtaining model encryption data of the model to be decrypted, the model encryption data being obtained by encrypting the model to be decrypted using the above-mentioned model encryption technical solution; loading the encrypted byte stream included in the model encryption data, and decrypting the encrypted data and position index data included in the model encryption data; locating the encrypted byte blocks in the encrypted byte stream based on the decrypted position index data; decrypting each encrypted byte block based on the decrypted encrypted data, restoring the target byte block corresponding to each encrypted byte block; replacing each target byte block in the encrypted byte stream with the corresponding target byte block, to obtain a target byte stream corresponding to the model to be decrypted; performing model conversion on the target byte stream to obtain the model to be decrypted; and if the model to be decrypted is called for business inference, decrypting the parameter obfuscation data corresponding to the target network layer included in the model encryption data for each target network layer applied to the model to be decrypted. Based on the decrypted parameter obfuscation data, restoring the original parameters of the target network layer before the parameter obfuscation process, so that the target network layer can perform business inference based on the original parameters.

[0043] The technical solutions for model encryption and model decryption provided in this embodiment can be applied to any model, and this embodiment does not limit the type of model. For example, the model may include, but is not limited to, a large model based on deep learning technology. In addition, the reasoning capability of the model can also be flexibly selected based on business needs. For example, the reasoning capability of the model may include, but is not limited to, network security assessment, image recognition, speech recognition, etc. Based on the technical solutions for model encryption and model decryption described above, this embodiment specifically provides a model encryption method and device, and a model decryption method and device. The model encryption method and device, and the model decryption method and device provided in this embodiment are specifically described below.

[0044] The present application embodiment provides a model encryption method, such as Figure 1 As shown, the model encryption method provided in this embodiment may at least include the following steps 101 to 105.

[0045] 101. Perform parameter obfuscation processing on original parameters of at least one target network layer in the encryption model to obtain a model and parameter obfuscation data after the parameter obfuscation processing, and the parameter obfuscation data is used to restore the original parameters of the target network layer before the parameter obfuscation processing.

[0046] Methods for determining the model to be encrypted may include the following two: First, monitoring whether there is a newly added model in the designated space, the designated space being used to store models that need to be encrypted; if so, determining the newly added model as the model to be encrypted. The newly added model may include, but is not limited to: a newly developed model, and a developed model after a version upgrade. Second, monitoring whether a designated instruction for the model to be encrypted is received; if so, determining the model specified by the designated instruction for the model to be encrypted as the model to be encrypted, wherein the designated instruction for the model to be encrypted may be issued in the form of voice, text, etc. At least one of the above two methods for determining the model to be encrypted may be flexibly selected based on business needs, which is not limited in this embodiment.

[0047] After determining the model to be encrypted, it is necessary to select at least one target network layer from the network layers included in the model to be encrypted, and perform parameter obfuscation processing on the original parameters of the target network layer. This parameter obfuscation process hides the original parameters of the target network layer, thereby reducing the possibility of the original parameters being leaked. Based on this, the model encryption method provided in this embodiment may also include the step of selecting a target network layer. The implementation methods of this step may include at least the following five methods:

[0048] The first method is to select the key network layer in the model to be encrypted as the target network layer.

[0049] Critical network layers influence model reasoning and determine the model's functionality and performance. Once the original parameters of these critical network layers are known, others can use them to train or fine-tune the same model for use. They can also launch white-box attacks against the model based on these original parameters, causing it to misjudge or fail. For this reason, the critical network layers in the model to be encrypted are selected as target network layers.

[0050] In some embodiments, different types of models correspond to different key network layers. Based on this, the key network layers are determined based on the type of model to be encrypted. For example, if the model to be encrypted is a convolutional neural network model, the key network layers determined include convolutional layers, pooling layers, and fully connected layers. For another example, if the model to be encrypted is a recurrent neural network model, the key network layers determined include recurrent layers and embedding layers.

[0051] The second method is to select a first target number of network layers applicable to the total number of network layers of the model to be encrypted based on the correspondence between at least one preset interval of the total number of network layers and the target number; and select the first target number of target network layers from the network layers of the model to be encrypted.

[0052] In some embodiments, to improve the efficiency of selecting target network layers, a correspondence between at least one interval of the total number of network layers and the target number can be summarized in advance based on the encryption experience of a large number of past models. In this way, after determining the model to be encrypted, a first target number of network layers suitable for the model to be encrypted is directly selected based on the correspondence, and the first target number of target network layers is selected from the network layers of the model to be encrypted.

[0053] It should be noted that the selected target network layers have any of the following characteristics: First, the first target number of target network layers are network layers that exist continuously in the model to be encrypted. Exemplarily, the first number is 5, and the 10th to 14th network layers in the model to be encrypted are selected as target network layers. Second, there is at least one pair of first network layers in the first target number of target network layers, and the two first network layers in each pair of first network layers are adjacent in the target network layer, and the two first network layers are separated by at least one network layer in the model to be encrypted. Exemplarily, the first number is 5, and the 10th, 13th, 14th, 15th, and 16th network layers in the model to be encrypted are selected as target network layers. It can be seen that the 10th network layer and the 13th network layer are adjacent in all target network layers, and the 10th network layer and the 13th network layer are separated by the 11th to 12th network layers in the model to be encrypted. Third, any two adjacent target network layers in the second target number of target network layers are separated by at least one network layer in the model to be encrypted, and at least two pairs of adjacent target network layers have different numbers of network layers between them. For example, if the first number is 5, the 10th, 13th, 14th, 15th, and 17th network layers in the model to be encrypted are selected as target network layers. This shows that the 10th and 13th network layers are separated by the 11th and 12th network layers in the model to be encrypted, and the 15th and 17th network layers are separated by the 16th network layer in the model to be encrypted. The characteristics of the three target network layers can be flexibly selected based on business needs and are not limited in this embodiment. It should be noted that the more complex the characteristics of the target network layers, the higher the security provided by parameter obfuscation of the original parameters of these target network layers, the more difficult it is for malicious actors to identify cracking patterns, and the less likely they are to obtain the original parameters of the target network layers.

[0054] The third method is to select a target layer sequence number set suitable for the total number of network layers of the model to be encrypted based on the correspondence between at least one preset interval of the total number of network layers and a layer sequence number set; and select the network layer in the model to be encrypted whose layer sequence number is included in the target layer sequence number set as the target network layer.

[0055] In some embodiments, in order to improve the efficiency of selecting the target network layer, based on the encryption experience of a large number of past models, the correspondence between at least one interval of the total number of network layers and a set of layer sequence numbers can be summarized in advance, and the layer sequence number set is the layer sequence number corresponding to the target network layer applicable to the corresponding interval of the total number of network layers. In this way, after determining the model to be encrypted, the target layer sequence number set applicable to the total number of network layers of the model to be encrypted is directly selected based on the correspondence, and the network layer in the model to be encrypted whose layer sequence number is included in the target layer sequence number set is selected as the target network layer. Exemplarily, the total number of network layers of the model to be encrypted is 20, and the target layer sequence number set applicable to the total number of network layers 20 selected based on the correspondence includes layer sequence numbers 3, 6, and 8, then the 3rd, 6th, and 8th network layers in the model to be encrypted are selected as the target network layers.

[0056] Fourth, to enable the encryption party to flexibly select the target network layer based on its own business needs, the encryption party is granted permission to issue network layer selection instructions. This allows the encryption party to select the network layer that meets its own encryption needs as the target network layer based on the network layer selection instructions. Based on this, the encryption party monitors whether a network layer selection instruction for the model to be encrypted has been received. If so, the network layer specified by the network layer selection instruction in the model to be encrypted is selected as the target network layer.

[0057] The fifth type is to consider that the more network layers involved in parameter obfuscation processing, the more secure the model is. Based on this, all network layers included in the model to be encrypted are selected as target network layers.

[0058] The above five implementation methods can be selected based on business needs, and this embodiment does not limit this. It should be noted that when one method cannot meet business needs, at least two of the first four implementation methods can be selected for use.

[0059] After the target network layer is selected, the step of performing parameter obfuscation processing on the original parameters of at least one target network layer in the encryption model is performed. The implementation process of this step is to perform the following steps 101A to 101C for each target network layer:

[0060] 101A. Determine the corresponding obfuscation factor and obfuscation processing logic of the current target network layer.

[0061] Methods for determining the obfuscation factor and obfuscation processing logic corresponding to the current target network layer may include the following two methods: First, a preset obfuscation factor and a preset obfuscation processing logic are respectively determined as the obfuscation factor and obfuscation processing logic corresponding to the current target network layer. This can improve the efficiency of determining the obfuscation factor and obfuscation processing logic. Second, a random obfuscation factor generation function is used to generate a corresponding obfuscation factor for the current target network layer, and the corresponding obfuscation processing logic is randomly selected from a plurality of preset obfuscation processing logics for the current target network layer. This enhances the randomness of the obfuscation factor and obfuscation processing logic. The original parameters of the current target network layer processed by this highly random obfuscation factor and obfuscation processing logic are more difficult to decipher, thereby reducing the possibility of parameter leakage.

[0062] It should be noted that when the number of target network layers of the model to be encrypted is at least two, the confusion factors and confusion processing logic of each target network layer may include the following two situations: one is that the confusion factors and confusion processing logic of each target network layer are the same, so that when the model is subsequently decrypted, it is convenient to quickly restore the original parameters of each target network layer before the parameter confusion processing, thereby facilitating the rapid execution of model reasoning and reducing the model reasoning delay caused by model encryption. The other is that there is target data corresponding to at least one network layer in the target network layer of the model to be encrypted, which is different from the target data of other target network layers, and the target data includes at least one of the following: confusion factors, confusion processing logic. In this way, the complexity of the confusion factors and confusion processing logic between the target network layers is enhanced. Based on the highly complex confusion factors and confusion processing logic, the difficulty of deciphering the parameters can be increased, thereby reducing the possibility of parameter leakage.

[0063] 101B. Obfuscate the original parameters of the current target network layer using obfuscation processing logic based on the obfuscation factor.

[0064] The obfuscation processing logic is a processing logic that converts the original parameters of the current target network layer into other parameters based on the obfuscation factor to protect the original parameters of the current target network layer. The obfuscation factor includes at least a confusion scaling factor and a confusion offset factor, and the obfuscation processing logic includes at least confusion scaling logic and confusion offset logic. The obfuscation scaling logic is used to scale the original parameters of the current target network layer based on the scaling factor. The obfuscation scaling logic may include but is not limited to any of the following: multiplication operation logic, division operation logic. The obfuscation offset logic is used to further offset the parameters obtained by the obfuscation scaling logic based on the offset factor. The obfuscation offset logic may include but is not limited to any of the following: addition operation logic, subtraction operation logic.

[0065] Based on this, the process of obfuscating the original parameters of the target network layer through the obfuscation processing logic based on the obfuscation factor can include: scaling the original parameters of the target network layer through the obfuscation scaling logic based on the obfuscation scaling factor; offsetting the scaled parameters through the obfuscation offset logic based on the obfuscation offset factor to obtain the obfuscated parameters of the target network layer.

[0066] The parameters of the model to be encrypted that participate in the parameter obfuscation process can be flexibly selected based on business needs, and this embodiment does not limit this. Exemplarily, the parameters of the model to be encrypted that participate in the parameter obfuscation process may include, but are not limited to, at least one of the following: weight, bias, scaling parameter, and offset parameter.

[0067] The following takes the parameters of the model to be encrypted that participate in the parameter obfuscation process as an example of weights to illustrate the specific process of obfuscating the original parameters of the target network layer through the obfuscation processing logic based on the obfuscation factor. Exemplarily, it is determined that the obfuscation factor of the current target network layer k includes the obfuscation scaling factor Ak and the obfuscation offset factor Bk, and the obfuscation processing logic includes the obfuscation scaling logic "multiplication operation logic" and the obfuscation offset logic "addition operation logic", then the specific process of obtaining the obfuscated parameters of the current target network layer can be expressed by the following formula: Wk'=Ak×Wk+Bk. Wk' represents the obfuscated parameters of the current target network layer k, Ak represents the obfuscation scaling factor Ak of ​​the current target network layer k, Bk represents the obfuscation offset factor of the current target network layer k, and Wk represents the original parameters of the current target network layer k before obfuscation.

[0068] 101C. Replace the original parameters of the current target network layer with the obfuscated parameters.

[0069] The original parameters of the current target network layer are replaced with the obfuscated parameters to protect the original parameters of the current target network layer. In this way, even if the obfuscated parameters are leaked, it will not affect the model itself.

[0070] When the original parameters of each target network layer of the model to be encrypted have been parameter-obfuscated, the parameter-obfuscated model and parameter-obfuscated data are obtained. The parameter-obfuscated model serves as the basic data for subsequent encryption operations. The parameter-obfuscated data is used to restore the original parameters of the target network layer before the parameter obfuscation process. The parameter obfuscation data includes at least the identifier of each target network layer and the corresponding obfuscation factor and obfuscation processing logic of each target network, so as to restore the original parameters of each target network layer before the parameter obfuscation process based on these data. It should be noted that in order to further ensure the security of the model, for any target network layer, only when the model is called for business reasoning and the business reasoning is applied to the target network layer, the parameter obfuscation data supports the restoration of the original parameters of the target network layer before the parameter obfuscation process, so as to enable the target network layer to perform business reasoning based on the restored original parameters. In this way, the model restores the original parameters of the target network layer while reasoning, which can minimize the possibility of the original parameters of the target network layer being leaked.

[0071] 102. Intercept at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing.

[0072] When the original parameters of each target network layer of the model to be encrypted have been parameter-obfuscated, in order to further ensure the security of the model, further encryption operations need to be performed on the model. The first step of the encryption operation is to intercept at least one target byte block from the target byte stream of the model after parameter obfuscation, so as to encrypt the model to be encrypted from the byte dimension based on the target byte block.

[0073] Before intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing, it is first necessary to convert the model after parameter obfuscation processing into the corresponding target byte stream. The conversion process may include: determining the format of the model to be encrypted (for example, bin format or safetensor format), and using a serialization tool corresponding to the format to convert the model after parameter obfuscation processing into the corresponding target byte stream.

[0074] After obtaining the target byte stream, the step of intercepting at least one target byte block from the target byte stream corresponding to the model after the parameter obfuscation process is performed. The implementation methods of this step may include at least the following three methods:

[0075] Method 1: The specific process of intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing may include the following: determining a first number of target byte blocks to be intercepted from the target byte stream based on the first byte length and the total byte length of the target byte stream; selecting a first number of first bytes from the target byte stream according to the byte order of the target byte stream; starting with each first byte, intercepting a target byte block with a first byte length corresponding to each first byte.

[0076] This method intercepts the target sub-byte block based on the total byte length of the target byte stream and the preset first byte length. The first byte length is the empirical byte length evaluated from past model encryption instances, or the first byte length is the byte length customized by the encryption personnel for the model to be encrypted based on business needs.

[0077] When determining the first number, the ratio between the total byte length and the first byte length is first determined. Based on business needs, a number not greater than the ratio is determined as the first number of target byte blocks to be intercepted from the target byte stream. It should be noted that the principles for determining the first number are: first, if security is a priority, the first number needs to be as close to the ratio as possible or be the ratio; second, considering that a larger first number increases the difficulty of encryption and, accordingly, the difficulty of decryption, the first number can be much smaller than the ratio. However, this much smaller first number also needs to be a value that can ensure the security of the model.

[0078] According to the byte order of the target byte stream, a first number of first bytes are selected from the target byte stream, and starting with each first byte, a target byte block having a first byte length corresponding to each first byte is extracted. The first byte is the starting byte of each target byte block to be extracted. Each first byte is separated from the next adjacent first byte by at least the first byte length. This ensures that there is no byte overlap between the extracted target byte blocks, thereby avoiding byte confusion in the subsequent encrypted byte stream due to byte overlap.

[0079] Method 2 is that the specific process of intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing may include the following: determining the corresponding second byte length of each target byte block to be intercepted from the target byte stream; selecting the second byte required to intercept each target byte block from the target byte stream according to the byte order of the target byte stream; starting with each second byte, intercepting the target byte block with the corresponding second byte length corresponding to each second byte; wherein, each second byte is separated from the adjacent subsequent second byte by at least bytes of the corresponding second byte length.

[0080] This second method intercepts target sub-byte blocks based on the corresponding second byte length of each target byte block. This second byte length is the second byte length of each target byte block to be intercepted, customized by the encryption personnel for the encryption model based on business needs. The relationship between the second byte lengths of each target byte block to be intercepted can fall into two situations: first, the second byte length of each target byte block is the same; second, at least two byte blocks in the target byte block have different second byte block lengths. These two situations can be flexibly selected based on business needs and are not limited in this embodiment.

[0081] According to the byte order of the target byte stream, the second byte required to intercept each target byte block is selected from the target byte stream. Starting with each second byte, target byte blocks corresponding to each second byte and having a corresponding second byte length are intercepted. These second bytes serve as the starting bytes of each target byte block to be intercepted. Each second byte is separated from the adjacent subsequent second byte by at least a number of bytes corresponding to the second byte length. This ensures that there is no byte overlap between the intercepted target byte blocks, thereby avoiding byte confusion in the subsequent encrypted byte stream caused by byte overlap.

[0082] Method three is that the specific process of intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing may include the following: based on the correspondence between at least one preset total data interval of the network layer and the sample layer sequence number set, selecting a target sample layer sequence number set that is applicable to the total number of network layers of the model to be encrypted, the target sample layer sequence number set including at least one pair of layer sequence numbers, one layer sequence number in each pair of layer sequence numbers being located after the other layer sequence number, and the layer sequence number intervals covered by different pairs of layer sequence numbers not overlapping. Based on each pair of layer sequence numbers included in the target sample layer sequence number set, intercepting the target byte block corresponding to each pair of layer sequence numbers from the target byte stream.

[0083] In some embodiments, to improve the efficiency of target byte block interception, a correspondence between at least one network layer total data interval and a set of sample layer sequence numbers can be pre-established based on extensive encryption experience with previous models. Thus, after determining the byte stream, a target set of sample layer sequence numbers appropriate for the total number of network layers in the model is directly selected based on this correspondence. Based on each pair of layer sequence numbers included in the target sample layer sequence number set, the target byte block corresponding to each pair of layer sequence numbers is intercepted from the target byte stream.

[0084] The above three methods for implementing the step of intercepting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing can be flexibly selected for use based on business needs, and this embodiment does not limit this.

[0085] 103. Perform encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block.

[0086] After extracting the target byte block, the target byte block needs to be encrypted to protect the bytes included in the target byte block and prevent the bytes from being leaked. The implementation method for encrypting each target byte block to obtain the corresponding encrypted byte block and encrypted data for each target byte block may include at least the following two methods:

[0087] The first method is to encrypt each target byte block to obtain the encrypted byte block and encrypted data corresponding to each target byte block. The specific process is to perform the following steps 103A to 103C for each target byte block:

[0088] 103A. Select at least one first byte block for a current target byte block from at least one target byte block.

[0089] Considering encryption security, at least one first byte block is selected for a current target byte block from the at least one intercepted target byte block, and bytes included in the first byte block are used as a key for the current target byte block. Before selecting the first byte block, an order of appearance of the at least one intercepted target byte block in the target byte stream is determined, and the first byte block is selected based on the order of appearance.

[0090] Specifically, if the current target byte block is determined to be first in the order of appearance, the first number of target byte blocks adjacent to the current target byte block, or the second number of target byte blocks preceding the current target byte block in the reverse order of appearance, are selected as the first byte block of the current target byte block. Both the first number and the second number can be determined based on business needs and are not limited in this embodiment.

[0091] For example, both the first number and the second number are 1. The intercepted target byte blocks are, in order of appearance, target byte block 1, target byte block 2, and target byte block 3. When the current target byte block is target byte block 1, target byte block 2 is determined as the first byte block of the current target byte block, or target byte block 3 is determined as the first byte block of the current target byte block.

[0092] Specifically, if the current target byte block is not the first in the order of appearance, the third number of target byte blocks adjacent to the current target byte block are selected as the first byte block of the current target byte block. In other words, for a target byte block not at the first in the order of appearance, its key is determined by the byte blocks preceding it in the order of appearance. This third number can be determined based on business needs and is not limited in this embodiment.

[0093] For example, both the first number and the second number are 1. The intercepted target byte blocks are, in order of appearance, target byte block 1, target byte block 2, and target byte block 3. When the current target byte block is target byte block 2, target byte block 1 is determined as the first byte block of the current target byte block. When the current target byte block is target byte block 3, target byte block 2 is determined as the first byte block of the current target byte block. In this way, the encryption of the next target byte block depends on the adjacent previous target byte block, thereby achieving recursive encryption and improving encryption security.

[0094] Furthermore, to reduce encryption complexity, the target byte block that is first in the order of appearance can directly use an externally provided key, without having to set a key based on the byte blocks included in other byte blocks. Based on this, if the current target byte block is determined to be first in the order of appearance, a determination is made as to whether an initial key has been set for the first target byte block. If so, the initial key is set as the key corresponding to the current target byte block. If not, step 103A is executed to select at least one first byte block for the current target byte block from the at least one intercepted target byte block.

[0095] 103B. Set a key corresponding to the current target byte block based on at least part of the bytes included in the at least one first byte block.

[0096] The bytes included in the first byte block are most likely not publicly known bytes, so the encryption performance of the key determined based on these bytes is better. Based on this, the key corresponding to the current target byte block is set based on at least part of the bytes included in the at least one first byte block. The bytes included in the first byte used to set the key corresponding to the current target byte block can be the following: First, the bytes used to set the key are all the bytes included in the first byte block corresponding to the current target byte block; Second, the bytes used to set the key are part of the bytes included in each corresponding first byte block. Which bytes in the first byte block are used to set the key for the current target byte block can be selected based on business needs, and this embodiment does not limit this. Exemplarily, the first byte block of the current target byte block is the target byte block that appears before it in the order of appearance, and the first 16 bytes in the first byte block are set as the key corresponding to the current target byte block. The above two situations can be flexibly selected based on business needs, and this embodiment does not limit this.

[0097] 103C. Encrypt the current target byte block based on the key to obtain an encrypted byte block corresponding to the current target byte block.

[0098] An encryption tool is invoked to encrypt the current target byte block based on the key, thereby obtaining an encrypted byte block corresponding to the current target byte block. The encryption tool can be flexibly selected based on business needs and is not limited in this embodiment. Furthermore, to further improve the encryption effect, the key of the current target byte can be first encrypted using a preset key, and then the current target byte block is encrypted using the encrypted key to obtain an encrypted byte block corresponding to the current target byte block.

[0099] The second method is to encrypt each target byte block to obtain the encrypted byte block and encrypted data corresponding to each target byte block. The specific process is to perform the following steps 103D to 103E for each target byte block:

[0100] 103D. Select a corresponding target key for the current target byte block, and set the target key to the key corresponding to the current target byte block.

[0101] There are two scenarios for target keys: First, the target key for each intercepted target byte block is the same, reducing the difficulty of subsequent encryption. Second, the target key for at least two byte blocks in the intercepted target byte block is different, improving the effectiveness of subsequent encryption. The above two scenarios can be flexibly selected based on business needs and are not limited in this embodiment.

[0102] 103E. Encrypt the current target byte block based on the set key to obtain an encrypted byte block corresponding to the current target byte block.

[0103] There are two encryption processing scenarios: one in which the same encryption method is used for each intercepted target byte block to reduce encryption difficulty. The other in which different encryption methods are used for at least two of the intercepted target byte blocks to improve encryption effectiveness. Both scenarios can be flexibly selected based on business needs and are not limited in this embodiment.

[0104] The above two implementation methods of encrypting each target byte block to obtain the encrypted byte block and encrypted data corresponding to each target byte block can be flexibly selected based on business needs and are not limited in this embodiment.

[0105] When each encrypted byte block corresponding to a target byte block is obtained, encrypted data is also obtained. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block. The encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. The decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block, for example, to obtain the key used to encrypt the byte block or the setting rules for the key used.

[0106] 104. Replace each target byte block in the target byte stream with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data, where the position index data is used to indicate a position of the encrypted byte block in the encrypted byte stream.

[0107] After obtaining the encrypted byte block corresponding to each target byte block, each target byte block in the target byte stream is replaced with the corresponding encrypted byte block to avoid exposing the original bytes in the target byte block.

[0108] When the encrypted byte stream is obtained, position index data is obtained. The position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream. The position can be specifically expressed by the start and end index positions of the encrypted byte block in the encrypted byte stream.

[0109] 105. Integrate the encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data to obtain model encryption data of the model to be encrypted.

[0110] To ensure data security, a first encryption algorithm is used to encrypt the parameter obfuscation data, encrypted data, and location index data. The first encryption algorithm can be flexibly selected based on business needs and is not limited in this embodiment. For example, the preset algorithm may include, but is not limited to, the RSA encryption algorithm.

[0111] After obtaining the encrypted parameter obfuscation data, encrypted data, and position index data, these data are integrated with the encrypted byte stream to obtain model encrypted data of the model to be encrypted. This integration may include, but is not limited to, encrypting the encrypted byte stream, the encrypted parameter obfuscation data, the encrypted data, and the position index data into a single encrypted file using a second encryption algorithm.

[0112] When the encrypted model needs to be applied, the model encryption data of the encrypted model can be decrypted to implement business reasoning in the application process based on the encrypted model after decryption. The model decryption process is described in the following model decryption method and will not be repeated here.

[0113] The model encryption method provided in an embodiment of the present application, when a model to be encrypted exists, performs parameter obfuscation on the original parameters of at least one target network layer in the model to be encrypted, obtaining a model after parameter obfuscation and parameter obfuscation data for restoring the original parameters of the target network layer before parameter obfuscation. At least one target byte block is then intercepted from the target byte stream corresponding to the parameter obfuscated model, and each target byte block is encrypted to obtain an encrypted byte block corresponding to each target byte block and encrypted data for restoring the target byte block corresponding to the encrypted byte block. Each target byte block in the target byte stream is then replaced with the corresponding encrypted byte block, obtaining an encrypted byte stream and position index data indicating the position of the encrypted byte block in the encrypted byte stream. Finally, the encrypted byte stream, the encrypted parameter obfuscation data, the encrypted data, and the position index data are integrated to obtain model encrypted data of the model to be encrypted. Thus, the solution provided in this embodiment encrypts the model by first performing parameter obfuscation on the original parameters of at least part of the network layer of the model, then intercepting and encrypting the target byte blocks from the byte stream of the parameter obfuscated model, and finally replacing the intercepted target byte blocks with the encrypted encrypted byte blocks. It can be seen that the solution provided by this embodiment encrypts the model from two dimensions: parameter obfuscation and byte encryption, thereby achieving at least the following technical effects: First, since only the target byte block intercepted from the byte stream is encrypted, when the model is applied, only the target byte block needs to be decrypted to restore the byte stream of the model. In this way, decryption takes less time and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; second, since the parameters of at least part of the network layer of the model are parameter obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thereby reducing the possibility of leakage of the original parameters of the model. Third, when calling the model for reasoning based on the restored byte stream, only the parameters of the currently applied network layer are restored, while the parameters of the currently unapplied network layer are not restored. This not only ensures the smooth progress of model reasoning based on the restored original parameters, but also minimizes the possibility of leakage of model parameters.

[0114] In some embodiments of the present application, to facilitate model encryption, before performing parameter obfuscation processing on the original parameters of at least one target network layer in the model to be encrypted in step 101, the model encryption method provided in this embodiment may further include the following steps: determining whether the format of the model to be encrypted is a preset format; if so, executing step 101; otherwise, converting the model to be encrypted to the preset format, and after converting to the preset format, executing step 101. The preset format can be selected based on business needs. Exemplarily, the preset format may include, but is not limited to, the bin format and the safetensor format.

[0115] In some embodiments of the present application, when the model is applied, in addition to the data of the model itself, it also requires auxiliary code to support model loading and deployment. Based on this, the model encryption method provided by this embodiment may also include the following steps: obfuscating the auxiliary code of the model to be encrypted, the auxiliary code is used to support the loading and deployment of the model; encapsulating the obfuscated compiled auxiliary code and the encrypted data into a model application package. When the model is provided to any terminal for use, the terminal can implement the loading and deployment of the model based on the auxiliary code in the model application package, and then decrypt the model based on the encrypted byte stream in the model encrypted data included in the model application and the encrypted parameter obfuscation data, encrypted data, and position index data, so as to apply the decrypted model to perform corresponding business reasoning.

[0116] The present application embodiment provides a model decryption method, such as Figure 2 As shown, the model decryption method provided in this embodiment may include at least the following steps 201 to 207:

[0117] 201. Obtain model encryption data of the model to be decrypted.

[0118] The model to be decrypted is the model selected by the user for business reasoning, and its business reasoning capabilities meet the user's needs. After selecting the model to be decrypted, the encrypted model data of the model to be decrypted is obtained. This encrypted model data is obtained by encrypting the model to be decrypted using the above-mentioned model encryption method. The detailed process of obtaining this data is described in the detailed description of the above-mentioned model encryption method and will not be repeated here.

[0119] 202. Load the encrypted byte stream included in the model encryption data, and decrypt the encrypted data and position index data included in the model encryption data.

[0120] Auxiliary code corresponding to the model to be decrypted, used to support model loading, is obtained and invoked to load the encrypted byte stream included in the model's encrypted data. When decrypting the encrypted data and position index data included in the model's encrypted data, a decryption process corresponding to the encryption process in step 105 is performed to obtain the encrypted data and position index data. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block, and the position index data indicates the position of the encrypted byte block in the encrypted byte stream. By combining the encrypted data and position index data, the encrypted bytes in the encrypted byte stream can be restored to the corresponding target byte block.

[0121] 203. Locate the encrypted byte block in the encrypted byte stream based on the decrypted position index data.

[0122] The position index data includes the start and end index positions of each encrypted byte block in the encrypted byte stream. Based on this, the encrypted byte block is located in the encrypted byte stream based on the start and end index positions of each encrypted byte block in the encrypted byte stream.

[0123] 204. Decrypt each encrypted byte block based on the decrypted encrypted data to restore the target byte block corresponding to each encrypted byte block.

[0124] After locating the encrypted byte block, each encrypted byte block is decrypted based on the encrypted data to obtain a target byte block corresponding to each encrypted byte block.

[0125] 205. Replace each target byte block in the encrypted byte stream with a corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted.

[0126] Since only the encrypted byte blocks in the encrypted byte stream are decrypted without the need to decrypt the entire encrypted byte stream, decryption takes less time and the byte stream of the model to be decrypted can be quickly obtained to start model inference, thereby reducing the model inference delay caused by model encryption.

[0127] 206. Perform model conversion processing on the target byte stream to obtain a model to be decrypted.

[0128] The deserialization tool used to convert the byte stream into a model is called to deserialize the target byte stream and obtain the model to be decrypted. The deserialization tool is dependent on the type of model to be decrypted and can be flexibly selected based on the type of model to be decrypted. The model to be decrypted is a model that has at least some of the original parameters of the target network layer obfuscated. It can be called to initiate the corresponding business inference.

[0129] 207. If the model to be decrypted is called for business reasoning, each time it is applied to a target network layer in the model to be decrypted, the parameter obfuscation data corresponding to the target network layer included in the decrypted model encryption data is restored based on the decrypted parameter obfuscation data. The original parameters of the target network layer before the parameter obfuscation processing are restored so that the target network layer performs business reasoning based on the original parameters.

[0130] The original parameters of the target network layer in the model to be decrypted have been obfuscated. As the reasoning progresses, it is necessary to restore the parameters of only the target network layer to which the business reasoning is currently applied. This not only enables correct reasoning based on the restored original parameters of the target network layer, but also reduces the possibility of model parameter leakage because the parameters of other unapplied target network layers are not restored. Based on this, if the model to be decrypted is called for business reasoning, in order to ensure the accuracy of the reasoning, each time a target network layer in the model to be decrypted is applied, the corresponding parameter obfuscation data of the target network layer included in the decrypted model encryption data is included, and the original parameters of the target network layer before the parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer can perform business reasoning based on the restored original parameters. The process of restoring the original parameters of the target network layer here is the inverse operation of the parameter obfuscation operation mentioned in step 101 above, so it will not be repeated here, and the specific details of step 101 will be explained in detail.

[0131] The model decryption method provided by the embodiment of the present application can at least achieve the following technical effects: First, since only the target byte block intercepted from the byte stream is encrypted, when the model is applied, only the target byte block needs to be decrypted to restore the byte stream of the model. In this way, the decryption takes less time and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; Second, since the parameters of at least part of the network layer of the model are parameter obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thereby reducing the possibility of leakage of the original parameters of the model. Third, when calling the model for reasoning based on the restored byte stream, only the parameters of the currently applied network layer are restored, while the parameters of the currently unapplied network layer are not restored. This not only ensures the smooth progress of model reasoning based on the restored original parameters, but also minimizes the possibility of leakage of model parameters.

[0132] In some embodiments of the present application, in order to further enhance the security of the model, the encrypted byte stream is loaded into a first secure isolation environment for supporting decryption of the model to be applied, and the first secure isolation environment has a corresponding model calling interface. Then, the model decryption method provided by this embodiment may further include: if the model calling interface is monitored to receive a model calling instruction, it is determined that the model to be decrypted is called for business reasoning. The first secure isolation environment is an environment specially constructed for the model to be applied to support the use of the model to be applied, which can block external attacks, thereby avoiding data leakage of the model to be applied. The first secure isolation environment has a corresponding model calling interface. If the model calling interface is monitored to receive a model calling instruction, it is determined that the model to be decrypted is called for business reasoning. In this way, the probability of the model to be decrypted being exposed to external attacks when being called is low, thereby reducing the possibility of model parameters being leaked during model application.

[0133] In some embodiments of the present application, the encrypted parameter obfuscation data included in the model encryption data is stored in a second secure isolation environment, and the second secure isolation environment has a data call interface. Based on this, the specific execution process of decrypting the parameter obfuscation data corresponding to the network layer included in the model encryption data in step 207 and restoring the parameters of the network layer before the parameter obfuscation processing based on the decrypted parameter obfuscation data may include the following steps: calling a decryption tool in the second secure isolation environment to decrypt the parameter obfuscation data corresponding to the target network layer; calling the parameter obfuscation data corresponding to the target network layer from the data call interface, and restoring the parameters of the target network layer before the parameter obfuscation processing.

[0134] Considering that parameter leakage will seriously endanger the technical competitiveness and market competitiveness of model research and development companies, and parameter obfuscation data is the key to restoring the original parameters of the network layer, if the parameter obfuscation data is leaked, it is possible to cause the leakage of network layer parameters. Based on this, in order to further reduce the possibility of network layer parameter leakage, the encrypted parameter obfuscation data included in the model encryption data is stored in the second secure isolation environment to decrypt the parameter obfuscation data in the second secure isolation environment to realize the possibility of parameter obfuscation data being leaked. In addition, in order to be able to use the parameter obfuscation data to restore the original parameters of the target network, the corresponding parameter obfuscation data of the target network layer can be called from the data call interface of the second secure isolation environment. In this way, the exposure of the parameter obfuscation data can be minimized to reduce the probability of the parameter obfuscation data being leaked.

[0135] In some embodiments of the present application, the specific process of applying the model encryption method and model decryption method provided in this embodiment to a target model is described below. In this embodiment, the target model is selected as the model to be encrypted to reduce the possibility of leakage of the model parameters of the target model while reducing the target model inference delay caused by model encryption. The specific process of encrypting the target model may include the following steps (1) to (8):

[0136] (1) Determine the target model as the model to be encrypted.

[0137] In this embodiment, since model encryption requires the use of the model's byte stream, if the target model is determined to be in bin format or safetensor format (these formats are formats that can be converted to byte streams), step (2) is executed. If the target model is not in bin format or safetensor format, the target model is converted to bin format or safetensor format.

[0138] (2) Loading the target model, reading the network layers of the target model, and selecting at least one target network layer from the read network layers.

[0139] In this embodiment, it is determined that the target model includes M network layers, and k target network layers are selected from the M network layers. In order to reduce encryption complexity, k is much smaller than the total number of network layers M of the target model, and both k and M are positive integers greater than 1.

[0140] (3) Perform parameter confusion processing on the original parameters of each target network layer in the target model to obtain a parameter-confused model and parameter-confused data.

[0141] In this embodiment, the original parameters of the target network layer are selected as weights. Specifically, the following steps are performed for each target network layer: determine that the confusion factor of the current target network layer k includes a confusion scaling factor Ak and a confusion offset factor Bk, and the confusion processing logic includes a confusion scaling logic "multiplication operation logic" and a confusion offset logic "addition operation logic"; scale the original parameters of the target network layer based on the confusion scaling factor through the confusion scaling logic, and offset the scaled parameters based on the confusion offset factor through the confusion offset logic to obtain the confused parameters of the current target network layer. The specific process of the above steps can be expressed by the following formula: Wk'=Ak×Wk+Bk. Wk' represents the weight of the current target network layer k after confusion processing, Ak represents the confusion scaling factor Ak of ​​the current target network layer k, Bk represents the confusion offset factor of the current target network layer K, and Wk represents the original weight of the current target network layer K before confusion processing. As Figure 3 As shown, Figure 3 It is shown in the figure that k network layers are selected from the target model, and the original weights of the target network layer 1 to the target network layer k are W1 to Wk respectively. After the parameter confusion processing, the weights of the target network layer 1 to the target network layer k after the confusion processing are Figure 3 (W1'=A1×W1+B1) to (Wk'=Ak×Wk+Bk). It should be noted that, Figure 3 This is only an illustration of the target network layer and does not limit the specific structure of the target network layer.

[0142] After performing parameter obfuscation on the original parameters of each target network layer in the target model, parameter obfuscation data is obtained. The parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation. The parameter obfuscation data records the identifier of each target network layer and the corresponding obfuscation factor and obfuscation processing logic of each target network, so as to restore the original parameters of each target network layer before parameter obfuscation based on this data. The parameter obfuscation data is equivalent to the network layer lock file (i.e., Layer lock), which can be stored as a network layer lock file, for example, a network layer lock file named layer.shuffle.

[0143] (4) Convert the target model after parameter obfuscation into a target byte stream, and intercept at least one target byte block from the target byte stream.

[0144] In this embodiment, after the parameter obfuscation in the above step (3), it is also necessary to encrypt the model at the byte dimension to further improve the effect of model encryption. Based on this, intercept at least one target byte block from the target byte stream of the target model to encrypt the target byte block.

[0145] Exemplarily, as Figure 4 shown, the total byte length of the target byte stream of the target model is N, and the byte length of a preset single target byte block needs to take the value of the first byte length r. Based on the first byte length r and the total byte length N of the target byte stream, select n first bytes from the target byte stream in the order of byte appearance in the target byte stream, and record the selected n first bytes as [x1, x2,..., xn] according to the index positions of the first bytes in the target byte stream, where 1 < xi < N - r, and the byte length between adjacent xi is greater than r, xi is the i-th byte in the first bytes, and the value range of i is [1, n]. Then, starting from each first byte, intercept the corresponding target byte block with the first byte length r for each first byte. The target byte blocks are recorded as [G1, G2,..., Gn], and Gj represents the j-th target byte block in the intercepted target byte blocks, and the value range of j is [1, n]. It can be seen from Figure 4 that the byte range involved in G1 is [x1, x1 + r], the byte range involved in G2 is [x2, x2 + r], and so on, and the byte range involved in Gn is [xn, xn + r].

[0146] (5) Perform encryption processing on each target byte block to obtain the corresponding encrypted byte block and encrypted data for each target byte block. In this embodiment, in order to reduce the complexity of encryption, the target byte block at the first position in the appearance order (the appearance order is the order in which the target byte block appears in the target byte stream) needs to be directly encrypted using a preset initial key.

[0147] Based on this, as Figure 4As shown, the step of encrypting each target byte block can be, in order from small to large values, taking a value for j from the value interval [1, n], and executing the following process: judging whether the current value of j is 1; if it is 1, it means that the target byte block Gj corresponding to the current value is the first target byte block appearing in the target byte stream, then the current target byte block G1 is AES encrypted using the initial key key1 to generate the corresponding encrypted byte block F1; if j is not 1, it means that the target byte block Gj corresponding to the current value is not the first target byte block appearing in the target byte stream, then the target byte block G(j-1) located before the target byte block Gj is determined as the first byte block of the target byte block Gj (the bytes in the first byte block are used to set the corresponding key of the target byte block Gj), the first 16 bytes of the target byte block G(j-1) are used as the corresponding key keyj of the target byte block Gj, and the current target byte block Gj is AES encrypted using the key keyj to generate the corresponding encrypted byte block Fj of the current target byte block Gj.

[0148] The encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. The decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block, such as the key used to obtain the encrypted byte block (e.g., initial key key1) or the setting rules for the key used. Specifically, the starting index position of each target byte block in the encrypted data in the target byte stream can be represented as: [x1, x2, ..., xn]. The length of the encrypted byte block corresponding to each target byte block can be a length sequence: [S1, S2, ..., Sn].

[0149] (6) Each target byte block in the target byte stream is replaced with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data. Each target byte block in the target byte stream is replaced with a corresponding encrypted byte block. Specifically, the corresponding target byte block is replaced with an encrypted byte block, and the resultant blocks are concatenated into a new byte sequence and saved to form an encrypted byte stream.

[0150] The position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream. The position can be specifically expressed by the start and end index positions of the encrypted byte block in the encrypted byte stream. Specifically, Figure 4As shown, when j is 1, the position index data of the encrypted byte block F1 is expressed as [x1, x1+s1], when j is 2, the position index data of the encrypted byte block F1 is expressed as [x2+s1-r, x2+s1-r+s2], and so on. When j is n, the position index data of the encrypted byte block F1 is expressed as [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r]. If the start and end positions of each encrypted byte block index position are retrieved as [Yj, Yjj], the position index data can be expressed as: [(Y1, Y11), (Y2, Y22), ..., (Yn, Ynn)]. In some embodiments, the encrypted data and the position index data can be encrypted into an encrypted file named model.index.

[0151] (7) Use the RSA encryption algorithm to encrypt and save layer.shuffle and model.index.

[0152] (8) Integrate the encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data to obtain the model encryption data of the target model, and perform obfuscation compilation on the auxiliary code of the target model. The obfuscated compiled auxiliary code and model encryption data are encapsulated into a model application package for the target model to be used for corresponding business reasoning.

[0153] In this embodiment, the auxiliary code is used to support the loading and deployment of the target model. In this embodiment, when the target model is selected and applied to the corresponding terminal to perform the corresponding business reasoning, the target model needs to be decrypted. The specific process of decrypting the target model may include the following steps (9) to (15):

[0154] (9) Obtain the model encryption data of the target model.

[0155] (10) Loading the encrypted byte stream included in the model encryption data, and decrypting the encrypted data and position index data included in the model encryption data.

[0156] In this embodiment, the decrypted encrypted data and position index data are obtained by decrypting the model.index file. The decrypted encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. The decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block. Specifically, the starting index position of each target byte block in the encrypted data in the target byte stream can be expressed as: [x1, x2, ..., xn]. The length of the encrypted byte block corresponding to each target byte block can be a length sequence: [S1, S2, ..., Sn]. The position index data indicates the position of each encrypted byte block in the encrypted byte stream. Specifically, Figure 5As shown, when j is 1, the position index data of the encrypted byte block F1 is expressed as [x1, x1+s1], when j is 2, the position index data of the encrypted byte block F1 is expressed as [x2+s1-r, x2+s1-r+s2], and so on. When j is n, the position index data of the encrypted byte block Fn is expressed as [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r].

[0157] (11) Locate the encrypted byte block in the encrypted byte stream based on the decrypted position index data.

[0158] Based on this, Figure 5 As shown, in ascending order, the value of j is selected from the value interval [1, n], and the following process is performed: Determine whether the current value of j is 1; if it is 1, it means that the encrypted byte block Fj corresponding to the current value is the first encrypted byte block in the encrypted byte stream, and then locate the encrypted byte block F1 in the encrypted byte stream based on the position index data [x1, x1+s1]. If it is not 1, it means that the encrypted byte block Fj corresponding to the current value is not the first encrypted byte block in the encrypted byte stream, and then locate the encrypted byte block Fj in the encrypted byte stream based on the corresponding data in the position index data. For example, when j is 2, the encrypted byte block F2 is located in the encrypted byte stream according to [x2+s1-r, x2+s1-r+s2] in the position index data. Similarly, when j is n, the encrypted byte block Fn is located in the encrypted byte stream according to [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r] in the position index data.

[0159] (12) Decrypting each encrypted byte block based on the decrypted encrypted data to restore the target byte block corresponding to each encrypted byte block.

[0160] In this embodiment, if Figure 5 As shown, in ascending order, the value of j is selected from the value interval [1, n], and the following process is performed: Determine whether the current value of j is 1; if it is 1, it means that the encrypted byte block Fj corresponding to the current value is the first encrypted byte block in the encrypted byte stream, and the initial key key1 is used to perform AES decryption on the encrypted byte block Fj to restore the target byte block G1 corresponding to the encrypted byte block F1. If j is not 1, it means that the encrypted byte block Fj corresponding to the current value is not the first encrypted byte block in the encrypted byte stream, and the first 16 bits of the encrypted byte block G(j-1) are used as the key keyj corresponding to the encrypted byte block Fj, and the key keyj is used to perform AES decryption on the encrypted byte block Fj to restore the target byte block Gj corresponding to the encrypted byte block Fj.

[0161] (13) Each target byte block in the encrypted byte stream is replaced with a corresponding target byte block to obtain a target byte stream corresponding to the target model. In this embodiment, based on the starting index position [x1, x2, ..., xn] of each target byte block in the encrypted data in the target byte stream and the length [S1, S2, ..., Sn] of the encrypted byte block corresponding to each target byte block, each target byte block in the encrypted byte stream is replaced with a corresponding target byte block to obtain a target byte stream corresponding to the model to be encrypted. Figure 5 As shown, replace F1 in the encrypted byte stream with G1, and the index position of G1 after replacement is [x1, x1+s1]. Replace F2 in the encrypted byte stream with G2, and the index position of G2 after replacement is [x2, x2+s2]. Similarly, replace Fn in the encrypted byte stream with Gn, and the index position of Gn after replacement is [xn, xn+sn]. Finally, the target byte stream corresponding to the target model is obtained.

[0162] (14) Perform model conversion processing on the target byte stream to obtain the target model.

[0163] (15) If the target model is called for business reasoning, each time a target network layer in the target model is applied, the parameter obfuscation data corresponding to the target network layer included in the model encryption data is decrypted, and the original parameters of the target network layer before the parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer performs business reasoning based on the original parameters of the target network layer. In this example, when the model performs reasoning, each time a target network layer in the target model is applied, if the target network layer is determined to be a network layer that has been parameter obfuscated, the inverse operation of the parameter obfuscation processing in the above-mentioned model encryption method is used to restore the original parameters of the target network layer before the parameter obfuscation processing, that is, the weights in this embodiment, so that the target network layer performs business reasoning based on the original weights of the target network layer.

[0164] Furthermore, an embodiment of the present application also provides a model encryption device, such as Figure 6 As shown, the model encryption device provided in this embodiment may at least include:

[0165] A first processing module 31 is configured to perform parameter obfuscation processing on original parameters of at least one target network layer in the to-be-encrypted model to obtain a model and parameter obfuscation data after the parameter obfuscation processing, wherein the parameter obfuscation data is used to restore the original parameters of the target network layer before the parameter obfuscation processing;

[0166] An interception module 32 is configured to intercept at least one target byte block from the target byte stream corresponding to the model after the parameter obfuscation processing by the first processing module 31;

[0167] A second processing module 33 is configured to encrypt each target byte block intercepted by the interception module 32 to obtain an encrypted byte block and encrypted data corresponding to each target byte block, wherein the encrypted data is used to restore the target byte block corresponding to the encrypted byte block;

[0168] a first replacing module 34, configured to replace each target byte block in the target byte stream with a corresponding encrypted byte block obtained by the second processing module 33, to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate a position of the encrypted byte block in the encrypted byte stream;

[0169] The integration module 35 is used to integrate the encrypted byte stream obtained by the first replacement module 34 and the parameter obfuscation data obtained by the first processing module 31 after encryption, the encrypted data obtained by the second processing module 33, and the position index data obtained by the first replacement module 34 to obtain the model encryption data of the model to be encrypted.

[0170] The model encryption device provided in an embodiment of the present application, when a model to be encrypted exists, performs parameter obfuscation on the original parameters of at least one target network layer in the model to be encrypted, obtaining a model after parameter obfuscation and parameter obfuscation data for restoring the original parameters of the target network layer before parameter obfuscation. It then intercepts at least one target byte block from the target byte stream corresponding to the parameter obfuscated model and encrypts each target byte block to obtain an encrypted byte block corresponding to each target byte block and encrypted data for restoring the target byte block corresponding to the encrypted byte block. It then replaces each target byte block in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data indicating the position of the encrypted byte block in the encrypted byte stream. Finally, the encrypted byte stream, the encrypted parameter obfuscation data, the encrypted data, and the position index data are integrated to obtain model encrypted data of the model to be encrypted. Thus, the solution provided in this embodiment encrypts the model by first performing parameter obfuscation on the original parameters of at least a portion of the network layer of the model, then intercepting and encrypting the target byte blocks from the byte stream of the parameter obfuscated model, and finally replacing the intercepted target byte blocks with the encrypted encrypted byte blocks. It can be seen that the solution provided by this embodiment encrypts the model from two dimensions: parameter obfuscation and byte encryption, thereby achieving at least the following technical effects: First, since only the target byte block intercepted from the byte stream is encrypted, when the model is applied, only the target byte block needs to be decrypted to restore the byte stream of the model. In this way, decryption takes less time and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; second, since the parameters of at least part of the network layer of the model are parameter obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thereby reducing the possibility of leakage of the original parameters of the model. Third, when calling the model for reasoning based on the restored byte stream, only the parameters of the currently applied network layer are restored, while the parameters of the currently unapplied network layer are not restored. This not only ensures the smooth progress of model reasoning based on the restored original parameters, but also minimizes the possibility of leakage of model parameters.

[0171] In some embodiments of the present application, Figure 7 As shown, the first processing module 31 may include: a first determination unit 311, used to determine the corresponding confusion factor and confusion processing logic of the target network layer; a first processing unit 312, used to perform confusion processing on the original parameters of the target network layer through the confusion processing logic based on the confusion factor, and replace the original parameters of the target network layer with the parameters after confusion processing; wherein the first determination unit 311 and the first processing unit 312 are configured to be executed separately for each of the target network layers.

[0172] In some embodiments of the present application, Figure 7 As shown, the confusion factor includes at least a confusion scaling factor and a confusion offset factor, and the confusion processing logic includes at least a confusion scaling logic and a confusion offset logic. Then, the first processing unit 312 is specifically used to scale the original parameters of the target network layer based on the confusion scaling factor through the confusion scaling logic; and offset the scaled parameters based on the confusion offset factor through the confusion offset logic to obtain the obfuscated parameters of the target network layer.

[0173] In some embodiments of the present application, Figure 7 As shown, the number of target network layers of the model to be encrypted is at least two, and the first determination unit 311 sets the target network layer of the model to be encrypted to have at least one network layer corresponding target data, which is different from the target data of other target network layers, and the target data includes at least one of the following: confusion factor, confusion processing logic.

[0174] In some embodiments of the present application, Figure 7 As shown, the interception module 32 may include: a first interception unit 321, used to determine a first number of target byte blocks that need to be intercepted from the target byte stream based on the first byte length and the total byte length of the target byte stream; select a first number of first bytes from the target byte stream according to the byte order of the target byte stream; starting from each first byte, intercept each target byte block with a first byte length corresponding to each first byte; wherein, each first byte is separated from the adjacent subsequent first byte by at least bytes of the first byte length.

[0175] In some embodiments of the present application, Figure 7 As shown, the interception module 32 may include: a second interception unit 322, used to determine the corresponding second byte length of each target byte block to be intercepted from the target byte stream; select the second byte required for intercepting each target byte block from the target byte stream according to the byte order of the target byte stream; starting from each second byte, intercept each target byte block with a corresponding second byte length corresponding to the second byte; wherein, each second byte is separated from the adjacent subsequent second byte by at least bytes of the corresponding second byte length.

[0176] In some embodiments of the present application, Figure 7 As shown, the second processing module 33 includes:

[0177] A first selection unit 331 is configured to select at least one first byte block for a current target byte block from the at least one target byte block;

[0178] A setting unit 332 is configured to set a key corresponding to a current target byte block based on at least part of the bytes included in the at least one first byte block;

[0179] The encryption unit 333 is configured to perform encryption processing on the current target byte block based on the key to obtain an encrypted byte block corresponding to the current target byte block;

[0180] The first selection unit 331 , the setting unit 332 and the encryption unit 333 are configured to be executed separately for each target byte block.

[0181] In some embodiments of the present application, Figure 7 As shown, the second processing module 33 may include: a second determining unit 334, used to determine the order of appearance of the at least one target byte block in the target byte stream; then, a first selecting unit 331, specifically used to select the first number of target byte blocks adjacent to the current target byte block or the target byte blocks located at the first second number of positions in the reverse order of the appearance order as the first byte block of the current target byte block if the current target byte block is located at the first position of the appearance order; if the current target byte block is not located at the first position of the appearance order, then select the first third number of target byte blocks adjacent to the current target byte block as the first byte block of the current target byte block.

[0182] In some embodiments of the present application, Figure 7 As shown, the first selection unit 331 is further used to determine whether an initial key is set for the first target byte block if it is determined that the current target byte block is at the first position in the appearance order. If so, the setting unit 332 is triggered to set the initial key to the key corresponding to the current target byte block. If not, the step of selecting at least one first byte block for the current target byte block is executed from the at least one target byte block.

[0183] In some embodiments of the present application, Figure 7 As shown, the model encryption device provided by this embodiment may further include: a first selection module 36, for selecting a key network layer in the model to be encrypted as a target network layer, wherein the key network layer is a network layer that affects model reasoning.

[0184] In some embodiments of the present application, Figure 7As shown, the model encryption device provided by this embodiment may also include: a second selection module 37, which is used to select a first target number of network layers suitable for the total number of network layers of the model to be encrypted based on the correspondence between at least one preset interval of the total number of network layers and the target number; select the first target number of target network layers from the network layers of the model to be encrypted; wherein the selected target network layers have any of the following characteristics: the first target number of target network layers are network layers that exist continuously in the model to be encrypted; or, there is at least one pair of first network layers in the first target number of target network layers, and the two first network layers in each pair of first network layers are adjacent in the target network layer, and the two first network layers are separated by at least one network layer in the model to be encrypted; or, any two adjacent target network layers in the second target number of target network layers are separated by at least one network layer in the model to be encrypted, and there are at least two pairs of adjacent target network layers with different numbers of network layers separated.

[0185] In some embodiments of the present application, Figure 7 As shown, the model encryption device provided by this embodiment may also include: a third selection module 38, which is used to select a target layer sequence number set suitable for the total number of network layers of the model to be encrypted based on the correspondence between at least one preset total number interval of network layers and a layer sequence number set; and select the network layer in the model to be encrypted whose layer sequence number is included in the target layer sequence number set as the target network layer.

[0186] In some embodiments of the present application, Figure 7 As shown, the model encryption device provided in this embodiment may also include: an encapsulation module 39, which is used to obfuscate and compile the auxiliary code of the model to be encrypted, and the auxiliary code is used to support the loading and deployment of the model; and encapsulate the obfuscated compiled auxiliary code and the encrypted data into a model application package.

[0187] In the model encryption device provided in the embodiment of the present application, the detailed explanations used during the operation of each functional module can be found in the corresponding detailed explanations of the above-mentioned model encryption method embodiment, which will not be repeated here.

[0188] Furthermore, an embodiment of the present application also provides a model decryption device, such as Figure 8 As shown, the model decryption device provided in this embodiment may at least include:

[0189] An acquisition module 41 is used to acquire model encryption data of a model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted by the above-mentioned model encryption device;

[0190] a processing module 42, configured to load the encrypted byte stream included in the model encrypted data, and decrypt the encrypted data and position index data included in the model encrypted data;

[0191] A positioning module 43, configured to locate the encrypted byte block in the encrypted byte stream based on the position index data decrypted by the processing module 42;

[0192] A restoration module 44 is configured to decrypt each encrypted byte block located by the positioning module 43 based on the encrypted data decrypted by the processing module 42, and restore the target byte block corresponding to each encrypted byte block;

[0193] A second replacement module 45 is configured to replace each target byte block in the encrypted byte stream obtained by the restoration module 44 with a corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted;

[0194] The conversion module 46 is used to perform model conversion processing on the target byte stream obtained by the second replacement module 45 to obtain a model to be decrypted;

[0195] The calling module 47 is used to decrypt the parameter obfuscation data corresponding to the target network layer included in the model encryption data each time the decryption model obtained by the conversion module 46 is applied to a target network layer in the model to be decrypted, and restore the original parameters of the target network layer before the parameter obfuscation processing based on the decrypted parameter obfuscation data, so that the target network layer performs business inference based on the original parameters.

[0196] The model decryption device provided by the embodiment of the present application can at least achieve the following technical effects: First, since only the target byte block intercepted from the byte stream is encrypted, when the model is applied, only the target byte block needs to be decrypted to restore the byte stream of the model. In this way, decryption takes less time and the model reasoning can be quickly started based on the restored byte stream, thereby reducing the model reasoning delay caused by model encryption; Second, since the parameters of at least part of the network layer of the model are parameter obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thereby reducing the possibility of leakage of the original parameters of the model. Third, when calling the model for reasoning based on the restored byte stream, only the parameters of the currently applied network layer are restored, while the parameters of the currently unapplied network layer are not restored. This not only ensures the smooth progress of model reasoning based on the restored original parameters, but also minimizes the possibility of leakage of model parameters.

[0197] In some embodiments of the present application, Figure 8As shown, the encrypted byte stream is loaded into a first secure isolation environment for supporting decryption of the model to be applied, and the first secure isolation environment has a corresponding model calling interface. Then, the calling module 47 may include: a monitoring unit 471, which is used to determine that the model to be decrypted is called for business reasoning if it monitors that the model calling interface receives a model calling instruction.

[0198] In some embodiments of the present application, Figure 8 As shown, the encrypted parameter obfuscation data included in the model encryption data is stored in a second secure isolation environment, and the second secure isolation environment has a data calling interface. Then, the calling module 47 may include: a calling unit 472, used to call the decryption tool to decrypt the parameter obfuscation data corresponding to the target network layer in the second secure isolation environment; call the parameter obfuscation data corresponding to the target network layer from the data calling interface, and restore the parameters of the target network layer before the parameter obfuscation processing.

[0199] In the model decryption device provided in the embodiment of the present application, the detailed explanations used during the operation of each functional module can be found in the corresponding detailed explanations of the above-mentioned model decryption method embodiment, which will not be repeated here.

[0200] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned model encryption method and / or execute the above-mentioned model decryption method.

[0201] Furthermore, an embodiment of the present application also provides an electronic device, comprising: a memory for storing a program; a processor, coupled to the memory, for running the program to execute the above-mentioned model encryption method, and / or, execute the above-mentioned model decryption method.

[0202] Furthermore, an embodiment of the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the above-mentioned model encryption method and / or executes the above-mentioned model decryption method.

[0203] In the above embodiments, the descriptions of each embodiment have different emphases. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. It is understandable that the relevant features in the above methods and devices can refer to each other. In addition, the "first", "second", etc. in the above embodiments are used to distinguish between the various embodiments, and do not represent the advantages and disadvantages of each embodiment. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0204] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to implement the content of the application described herein, and the above description of specific languages ​​is for the purpose of disclosing the preferred embodiment of the application.

[0205] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0206] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0207] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data cutover device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data cutover device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0208] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data switching device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0209] These computer program instructions can also be loaded onto a computer or other programmable data switching device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0210] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0211] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0212] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0213] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A model encryption method, characterized in that: The method comprises: Performing parameter obfuscation processing on original parameters of at least one target network layer in the to-be-encrypted model to obtain a model after parameter obfuscation processing and parameter obfuscation data, wherein the parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation processing; Intercept at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing; Performing encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block, wherein the encrypted data is used to restore the target byte block corresponding to the encrypted byte block; replacing each target byte block in the target byte stream with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate a position of the encrypted byte block in the encrypted byte stream; The encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data are integrated to obtain model encryption data of the model to be encrypted.

2. The method according to claim 1, characterized in that Performing parameter obfuscation processing on original parameters of at least one target network layer in the encryption model, including: For each target network layer, respectively, the following steps are performed: determining the obfuscation factor and obfuscation processing logic corresponding to the target network layer; performing obfuscation processing on the original parameters of the target network layer through the obfuscation processing logic based on the obfuscation factor; and replacing the original parameters of the target network layer with the obfuscated parameters.

3. The method according to claim 2, characterized in that The obfuscation factor includes at least an obfuscation scaling factor and an obfuscation offset factor, and the obfuscation processing logic includes at least an obfuscation scaling logic and an obfuscation offset logic. Then, performing obfuscation processing on the original parameters of the target network layer by the obfuscation processing logic based on the obfuscation factor includes: scaling the original parameters of the target network layer by the obfuscation scaling logic based on the obfuscation scaling factor; offsetting the scaled parameters by the obfuscation offset logic based on the obfuscation offset factor, to obtain the obfuscated parameters of the target network layer; and / or, The number of target network layers of the model to be encrypted is at least two, and there is target data corresponding to at least one network layer in the target network layer of the model to be encrypted, which is different from the target data of other target network layers, and the target data includes at least one of the following: an obfuscation factor and an obfuscation processing logic.

4. The method according to claim 1, wherein Intercepting at least one target byte block from a target byte stream corresponding to the model after parameter obfuscation processing, including: determining a first number of target byte blocks to be intercepted from the target byte stream based on a first byte length and a total byte length of the target byte stream; selecting a first number of first bytes from the target byte stream according to a byte order of the target byte stream; and starting with each first byte, intercepting a target byte block having a first byte length corresponding to each first byte; wherein each first byte is separated from an adjacent subsequent first byte by at least bytes of the first byte length; or, At least one target byte block is intercepted from a target byte stream corresponding to a model after parameter obfuscation processing, including: determining a corresponding second byte length of each target byte block to be intercepted from the target byte stream; selecting a second byte required for intercepting each target byte block from the target byte stream according to the byte order of the target byte stream; starting with each second byte, intercepting a target byte block having a corresponding second byte length corresponding to each second byte; wherein each second byte is separated from an adjacent subsequent second byte by at least bytes of the corresponding second byte length.

5. The method according to claim 1, wherein Performing encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block includes: For each target byte block, the following steps are performed: selecting at least one first byte block for the current target byte block from the at least one target byte block; setting a key corresponding to the current target byte block based on at least part of the bytes included in the at least one first byte block; and encrypting the current target byte block based on the key to obtain an encrypted byte block corresponding to the current target byte block.

6. The method according to claim 5, characterized in that The method further comprises: determining an order of appearance of the at least one target byte block in the target byte stream; Then, selecting at least one first byte block for the current target byte block from the at least one target byte block includes: if the current target byte block is located at the first position in the appearance order, selecting the target byte blocks that are adjacent to the current target byte block and are located at the second first position in the reverse order of the appearance order as the first byte block of the current target byte block; if the current target byte block is not located at the first position in the appearance order, selecting the target byte blocks that are adjacent to the current target byte block and are located at the third first position in the reverse order of the appearance order as the first byte block of the current target byte block; and / or, The method further includes: if it is determined that the current target byte block is at the first position in the appearance order, determining whether an initial key is set for the first target byte block; if so, setting the initial key to the key corresponding to the current target byte block; if not, executing the step of selecting at least one first byte block for the current target byte block from the at least one target byte block.

7. The method according to any one of claims 1 to 6, characterized in that The method further includes: selecting a key network layer in the model to be encrypted as a target network layer, the key network layer being a network layer that affects model reasoning; and / or, The method also includes: based on the correspondence between at least one preset interval of the total number of network layers and the target number, selecting a first target number of the total number of network layers applicable to the model to be encrypted; selecting the first target number of target network layers from the network layers of the model to be encrypted; wherein the selected target network layers have any of the following characteristics: the first target number of target network layers are network layers that exist continuously in the model to be encrypted; or, there is at least one pair of first network layers in the first target number of target network layers, and the two first network layers in each pair of first network layers are adjacent in the target network layer, and the two first network layers are separated by at least one network layer in the model to be encrypted; or, any two adjacent target network layers in the second target number of target network layers are separated by at least one network layer in the model to be encrypted, and there are at least two pairs of adjacent target network layers with different numbers of network layers separated by different numbers; and / or, The method further includes: selecting a target layer sequence number set suitable for the total number of network layers of the model to be encrypted based on a correspondence between at least one preset interval of the total number of network layers and a set of layer sequence numbers; selecting a network layer in the model to be encrypted whose layer sequence number is included in the target layer sequence number set as a target network layer; and / or, The method may further include: performing obfuscation compilation on the auxiliary code of the model to be encrypted, the auxiliary code being used to support loading and deployment of the model; and encapsulating the obfuscated compiled auxiliary code and the encrypted data into a model application package.

8. A model decryption method, characterized in that: The method comprises: Obtaining model encryption data of the model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted using the model encryption method according to any one of claims 1 to 7; Loading the encrypted byte stream included in the model encrypted data, and decrypting the encrypted data and position index data included in the model encrypted data; Locating the encrypted byte block in the encrypted byte stream based on the decrypted position index data; Decrypting each encrypted byte block based on the decrypted encrypted data to restore the target byte block corresponding to each encrypted byte block; Replacing each target byte block in the encrypted byte stream with a corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted; Performing model conversion processing on the target byte stream to obtain a model to be decrypted; If the model to be decrypted is called for business reasoning, each time it is applied to a target network layer in the model to be decrypted, the parameter obfuscation data corresponding to the target network layer included in the model encryption data is decrypted, and the original parameters of the target network layer before the parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer performs business reasoning based on the original parameters.

9. The method according to claim 8, characterized in that The encrypted byte stream is loaded into a first secure isolation environment for supporting decryption of a model to be applied, and the first secure isolation environment has a corresponding model calling interface. Then, the method further includes: if it is monitored that the model calling interface receives a model calling instruction, determining that the model to be decrypted is called for business reasoning; and / or, The encrypted parameter obfuscation data included in the model encrypted data is stored in a second secure isolation environment, and the second secure isolation environment has a data call interface. Then, decrypting the parameter obfuscation data corresponding to the network layer included in the model encrypted data, and restoring the parameters of the network layer before the parameter obfuscation processing based on the decrypted parameter obfuscation data, includes: Invoking a decryption tool to decrypt the obfuscated parameter data corresponding to the target network layer in the second secure isolation environment; The parameter obfuscation data corresponding to the target network layer is called from the data calling interface to restore the parameters of the target network layer before the parameter obfuscation processing.

10. A model encryption device, characterized in that: The device comprises: A first processing module is configured to perform parameter obfuscation processing on original parameters of at least one target network layer in the to-be-encrypted model to obtain a model and parameter obfuscation data after the parameter obfuscation processing, wherein the parameter obfuscation data is used to restore the original parameters of the target network layer before the parameter obfuscation processing; An interception module, configured to intercept at least one target byte block from a target byte stream corresponding to the model after parameter obfuscation processing; a second processing module, configured to perform encryption processing on each target byte block to obtain an encrypted byte block and encrypted data corresponding to each target byte block, wherein the encrypted data is used to restore the target byte block corresponding to the encrypted byte block; a first replacing module, configured to replace each target byte block in the target byte stream with a corresponding encrypted byte block, to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate a position of the encrypted byte block in the encrypted byte stream; An integration module is used to integrate the encrypted byte stream and the parameter obfuscation data, encrypted data, and position index data after encryption to obtain the model encryption data of the model to be encrypted.

11. A model decryption device, characterized in that: The device comprises: an acquisition module, configured to acquire model encryption data of a model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted using the model encryption method according to any one of claims 1 to 7; a processing module, configured to load the encrypted byte stream included in the model encrypted data, and decrypt the encrypted data and position index data included in the model encrypted data; a positioning module, configured to locate an encrypted byte block in the encrypted byte stream based on the decrypted position index data; A restoration module, configured to perform decryption processing on each encrypted byte block based on the decrypted encrypted data, and restore a target byte block corresponding to each encrypted byte block; A second replacement module is used to replace each target byte block in the encrypted byte stream with a corresponding target byte block to obtain a target byte stream corresponding to the model to be decrypted; A conversion module, configured to perform model conversion processing on the target byte stream to obtain a model to be decrypted; A calling module is used to decrypt the parameter obfuscation data corresponding to the target network layer included in the model encryption data if the model to be decrypted is called for business reasoning, and restore the original parameters of the target network layer before the parameter obfuscation processing based on the decrypted parameter obfuscation data, so that the target network layer performs business reasoning based on the original parameters.

12. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein, when the program is running, the device where the storage medium is located is controlled to execute the model encryption method described in any one of claims 1 to claim 7, and / or execute the model decryption method described in any one of claims 8 to claim 9.

13. An electronic device, characterized in that: The electronic device comprises: Memory, used to store programs; A processor, coupled to the memory, configured to run the program to execute the model encryption method according to any one of claims 1 to 7, and / or to execute the model decryption method according to any one of claims 8 to 9.

Images