An end-side large model architecture analysis method and system based on an electromagnetic side channel

Abstract

The application discloses an end-side large model architecture analysis method and system based on an electromagnetic side channel, and belongs to the technical field of artificial intelligence security. Firstly, electromagnetic radiation signals generated when a target end-side device runs a large model are collected and converted into digitized samples, and the samples are preprocessed to extract time-domain amplitude data reflecting changes in hardware computing load; then, based on the periodic repetition mode in the time-domain amplitude data, a target time-domain feature segment corresponding to the operation of a single Transformer Block is segmented; finally, the feature segment is input into an architecture analysis model to identify the execution time length features of each computing operator inside the segment, and the architecture hyperparameters of the large model to be analyzed are predicted based on the execution time length features. The application utilizes the physical mapping relationship between hardware electromagnetic features and operator time length, breaks through the software black box limitation, realizes non-intrusive and high-precision model architecture analysis, and effectively solves the large model infringement evidence collection problem.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of artificial intelligence security and hardware side-channel analysis, specifically involving a non-intrusive analysis method and system for an end-side generative large language model architecture based on electromagnetic side-channel. Background Technology

[0002] In recent years, generative large language model (LLM) technology has rapidly iterated and been applied. With the improvement of edge computing hardware computing power, a large number of commercial large models have been deployed in edge devices such as smart terminals, industrial edge gateways, and vehicle computing platforms. The model's topology architecture, core hyperparameters, and exclusive fine-tuning features have become the core intellectual property and commercial assets of large model developers.

[0003] With the industry trend of closing open-source models, providing model APIs as services, and commercializing "shelled" models, the need for compliance testing throughout the entire lifecycle of large models is becoming increasingly urgent. Whether it's the supply chain conducting compliance verification of purchased third-party large models, vendors taking inventory of their massive deployed edge models, or large model developers providing evidence of infringement or misappropriation, the core premise is to verify the architectural consistency of the large models running as a black box on the edge to determine whether there are any non-compliant behaviors such as unauthorized use, plagiarism, or misappropriation. However, current mainstream technical solutions all have obvious limitations, mainly facing the following two challenges: First, there are black-box limitations at the software level: large commercial models are usually deployed in the form of encrypted binary files, which traditional reverse engineering cannot crack to obtain internal architecture information and cannot detect black-box models from unknown sources; in addition, although there are software tracing technologies such as model watermarking in the existing technology, model watermarking requires embedding redundant features during the model training or inference stage, which will inevitably reduce the model inference performance and increase the computational overhead. Large commercially deployed models usually do not actively deploy watermarking schemes, and watermark features are easily eliminated by attackers through fine-tuning, model pruning, quantization and other operations, which cannot cope with malicious evasion scenarios.

[0004] Second, hardware-side channel solutions have intrusive limitations: Besides software-level solutions, hardware-side channel analysis is a common technique for identifying internal features of black-box systems. A representative example is power-side channel analysis, which involves soldering test leads to the power supply pins of the target device's circuit board to collect power consumption changes during operation and deduce relevant internal computational information. However, this type of solution cannot be applied to compliance testing in uncontrolled scenarios: First, it is a contact-based measurement, requiring damage to the target device's casing and soldering test leads, which not only damages the target device but also renders the acquired measurement data ineffective for compliance verification due to the compromised device integrity. Second, power measurement signals are easily interfered with by environmental electromagnetic noise, power fluctuations, and other factors, requiring extremely stringent measurement environments, making it difficult to implement in uncontrolled scenarios such as industrial sites.

[0005] In summary, there is currently no technical solution that can accurately identify the architecture of a large black-box model on the edge without intrusion or obtaining model code and internal permissions, and therefore cannot meet the actual needs of compliance testing of large edge models throughout their entire lifecycle. Summary of the Invention

[0006] To address the problems existing in the aforementioned background technologies, this invention proposes an end-side large model architecture analysis method and system based on electromagnetic side-channel. By constructing a non-intrusive hardware load feature extraction mechanism, an operator boundary segmentation method based on hierarchical periodic patterns, and a two-stage deep learning reconstruction model that maps physical consumption time, this invention solves the core technical problems of software-level black-box large models being unable to reverse engineer their internal architecture, watermark embedding damaging model inference performance, and traditional hardware side-channel analysis requiring contact with and damage to equipment, making it difficult to adapt to uncontrolled scenarios. This invention achieves non-intrusive, high-precision identification and analysis of end-side black-box large model architecture.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: An end-side large-scale model architecture analysis method based on electromagnetic side channels includes the following steps: S1. Collect the electromagnetic radiation signals generated during the operation of the target end-side equipment in the large model to be analyzed, and convert the electromagnetic radiation signals into digital signal samples; S2. Preprocess the digital signal samples to extract time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device. S3. Based on the periodic repetition pattern in the temporal amplitude data, segment the target temporal feature segment corresponding to the operation of a single Transformer Block; S4. Input the target temporal feature segment into the pre-trained architecture analysis model. The architecture analysis model identifies the execution time characteristics of each computation operator within the target temporal feature segment. Based on the execution time characteristics, it predicts the architecture hyperparameters of the large model to be analyzed and outputs the architecture analysis results of the large model to be analyzed.

[0008] Specifically, step S1 includes: S11. Place the near-field probe of the radio frequency signal receiving device at a non-contact position at a predetermined distance from the target device, and align it with the radiation area of ​​the voltage regulation module of the target device; the radio frequency signal receiving device includes a near-field probe and a software-defined wireless device; S12. Collect the electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment through the radio frequency signal receiving device, and convert the electromagnetic radiation signals into IQ samples as digital signal samples.

[0009] Specifically, step S2 includes: S21. Perform amplitude modulation and demodulation on the digital signal sample to convert the complex digital signal sample into an initial time-domain amplitude signal; S22. Denoise the initial time-domain amplitude signal to obtain a denoised time-domain signal; wherein, the denoising process adopts any one of total variation denoising, moving average filtering, or sliding window peak enhancement method. S23. Perform Z-score normalization on the denoised time-domain signal to obtain a normalized time-domain signal; S24. The standardized time-domain signal is downsampled using step sampling or maximum value sampling. While preserving the core execution characteristics, the signal sampling frequency is reduced, and the final output is time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device.

[0010] Specifically, step S3 includes: S31. Set an amplitude threshold for the time-domain amplitude data, and identify all the characteristic electromagnetic peaks corresponding to the high-load matrix operations through binarization or peak extraction processing to form a characteristic electromagnetic peak sequence. S32. Perform token-level coarse segmentation on the characteristic electromagnetic peak sequence: identify continuous pulse groups in the electromagnetic peak sequence, use the low amplitude gaps between continuous pulse groups as token boundaries, and obtain the time-domain signal segment corresponding to a single token. S33. Perform Block-level fine segmentation on the time domain signal segment corresponding to each single Token: identify the periodically repeating sub-pulse groups in the time domain signal segment of a single Token, and take the boundary of two adjacent sub-pulse groups with a feature matching degree higher than a preset threshold as the execution boundary of the Transformer Block. S34. Divide the temporal amplitude data according to the execution boundary of the Transformer Block to obtain the target temporal feature segment corresponding to the operation of a single Transformer Block.

[0011] Specifically, the architecture analysis model includes a cascaded first-stage model and a second-stage model; step S4 includes: S41. Input the target time-domain feature segment into the first-stage model. The first-stage model identifies the model family classification to which the large model to be analyzed belongs and outputs the operator segmentation mask of the computational operator to which each time point in the target time-domain feature segment belongs. S42. Based on the operator segmentation mask, calculate the proportional relationship of the execution time of each computation operator in the target temporal feature segment, and construct the duration proportion feature vector. S43. Input the duration ratio feature vector into the second-stage model, and the second-stage model will predict and output the architecture hyperparameters of the large model to be analyzed. S44. Integrate the model family classification results and architecture hyperparameters into the architecture analysis results of the large model to be analyzed.

[0012] Specifically, the structure of the first-stage model is a U-Net structure that integrates a Transformer encoder, including a one-dimensional convolutional downsampling module, a one-dimensional convolutional upsampling module, and a bottleneck layer connecting the downsampling module and the upsampling module, wherein a Transformer encoder is introduced in the bottleneck layer. The training process of the first stage of the model includes: using the temporal feature samples of the Transformer Block labeled with model family tags and operator boundary tags as the training set, extracting local temporal features through the one-dimensional convolutional downsampling module and upsampling module of the U-Net structure, capturing the long-range dependencies of the temporal sequence through the Transformer encoder introduced in the bottleneck layer, and iteratively training with model family classification loss and operator segmentation mask loss as joint training objectives until the model converges.

[0013] Specifically, step S42 includes: (1) Based on the operator segmentation mask, the execution time of the four linear projection operators of the self-attention mechanism and the three linear transformation operators of the feedforward neural network in the target temporal feature segment, as well as the gap time between self-attention and feedforward neural network and the gap time between the beginning and end of the Transformer Block, are statistically analyzed, for a total of nine time dimensions. (2) Divide the values ​​of the nine time dimensions by the total execution time of a single Transformer Block to obtain the normalized time ratio values ​​of the nine dimensions, and then concatenate them to form a normalized time ratio feature vector.

[0014] Specifically, the second-stage model is a multilayer perceptron network, which includes several independent output heads. Different output heads are used to independently predict different architecture hyperparameters of the large model to be analyzed. The training process of the second stage model is as follows: the training set is the feature vector samples of duration ratio labeled with corresponding hyperparameter labels. Each output head outputs the prediction result of a class of architecture hyperparameters. The training objective is to minimize the cross-entropy loss between the prediction result and the actual hyperparameter label. The training is carried out iteratively until the model converges.

[0015] An end-side large-scale model architecture analysis system based on electromagnetic side channels, applying the end-side large-scale model architecture analysis method based on electromagnetic side channels as described above, includes the following modules: The electromagnetic signal acquisition module is used to non-contactly acquire electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment, and convert the electromagnetic radiation signals into digital signal samples. The signal preprocessing module is used to preprocess digital signal samples and extract time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device. The Transformer Block segmentation module is used to segment the target temporal feature segments corresponding to a single Transformer Block operation based on the periodic repetition patterns in the temporal amplitude data. The architecture analysis module is used to identify the execution time characteristics of each computational operator within the target temporal feature segment through the architecture analysis model, predict the architecture hyperparameters of the large model to be analyzed based on the execution time characteristics, and output the architecture analysis results of the large model to be analyzed.

[0016] In summary, the beneficial technical effects of the present invention are as follows: 1. Achieves non-invasive detection of large end-side models, adapting to compliance requirements across all scenarios: This invention adopts a near-field non-contact electromagnetic signal acquisition scheme, which does not require physical contact with the target end-side device, disassembly of the device casing, or acquisition of model encryption code or internal access permissions. It does not damage the integrity of the target device, and the acquired detection results meet compliance and evidence collection requirements. It can be adapted to various uncontrolled scenarios, solving the core pain points of traditional contact-based side-channel methods, such as invalid evidence collection and limited applicable scenarios.

[0017] 2. Achieve no modification or loss to the large-scale model on the end side: This invention achieves architecture recognition entirely from the hardware physical layer signal characteristics, without requiring any prior modifications to the target large-scale model, such as embedding watermarks or other redundant features. It will not have any negative impact on the inference performance or running effect of the original model. It is suitable for offline detection of commercially deployed models, and developers do not need to do additional adaptation during the model deployment stage. It solves the defects of software-level watermark technology that damages model performance and cannot be adapted to commercially deployed models.

[0018] 3. Strong cross-device generalization: This invention uses the normalized operator duration ratio as the core analysis feature, rather than relying on the absolute computation time, thus eliminating the impact of differences in computing power of different edge chips, acquisition device gain, and placement distance on the recognition results. The same model can achieve stable recognition when running on edge devices with different performance, demonstrating high generalization and adaptability. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method framework of the present invention; Figure 2 This is a schematic diagram of the data processing of the present invention; Figure 3 This is a schematic diagram of the family prediction confusion matrix in a test result of an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the accuracy of hyperparameter analysis in a test result of an embodiment of the present invention. Detailed Implementation

[0020] To make the technical means, creative features, objectives and effects of this invention clearer and easier to understand, the invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

[0021] Example This embodiment uses an edge computing device equipped with an NVIDIA Jetson Orin Nano edge AI chip as the detection object, and the large model to be analyzed is a generative large language model deployed on this device, combined with the attached... Figure 1-3 The implementation process of the present invention will be described in detail. The technical solution described in this embodiment can be directly transferred to other smart terminals, vehicle computing platforms, industrial edge gateways and other devices equipped with edge AI chips.

[0022] In this embodiment, the radio frequency signal acquisition device consists of a near-field magnetic field probe and a USRP B200 software-defined radio (SDR) device, which is used for non-contact acquisition of electromagnetic signals. like Figure 1 As shown, the present invention provides an end-side large model architecture analysis method based on electromagnetic side channels, comprising the following steps: S1. Acquire electromagnetic radiation signals and convert them into digital samples. The specific operation process includes: S11. Trigger the large model to be analyzed on the target device to enter continuous inference state, input the continuously generated Prompt class, so that the large model continuously outputs text tokens to avoid collecting invalid noise in the idle state of the device; place the near-field probe at a non-contact position 1cm away from the Jetson Orin Nano chip. If the exact location of the device voltage regulation module (VRM) is unknown, the probe can be moved within 1cm around the chip to find the position with the largest signal amplitude and fix it there; set the sampling rate of SDR to 8MHz and the center frequency to 306MHz to match the oscillation frequency range of the VRM in the hundreds of megahertz range.

[0023] S12. Electromagnetic radiation signals are continuously acquired for 10 seconds using SDR. The acquired signals are converted into complex IQ samples, which contain in-phase component I and quadrature component Q. These samples are stored as digital signal samples in the host computer.

[0024] Step S1 enables the acquisition of amplitude-modulated electromagnetic signals generated by the VRM during large model inference in a non-contact manner, without disassembling the device or obtaining internal device permissions, thus ensuring the non-invasiveness of the detection process.

[0025] S2. Preprocess the digitized signal samples to obtain time-domain amplitude data. The specific operation process includes: S21. Amplitude modulation (AM) demodulation is performed on the digitized IQ samples to extract only the amplitude change features of the signal. The complex IQ samples are converted into an initial time-domain amplitude signal containing only amplitude information. Since the higher the computational load of the large model, the larger the VRM output current and the higher the electromagnetic signal amplitude, the amplitude change can directly reflect the computational load change of the GPU. There is no need to retain phase information, which can greatly reduce the complexity of subsequent processing.

[0026] S22. To denoise the initial time-domain amplitude signal, any of the following methods can be selected: Total Variation Noise Reduction: Filters out environmental electromagnetic noise and power supply fluctuation noise while preserving the characteristics of high load spikes; Moving average filtering: suitable for scenarios with low noise. Sliding window peak enhancement method: can further highlight the peak characteristics corresponding to high-load matrix operations.

[0027] S23. Perform Z-score standardization on the denoised time-domain signal, adjust the mean of the signal to 0 and the standard deviation to 1, eliminate the overall amplitude deviation of the signal caused by probe placement distance deviation and SDR gain setting difference, and obtain a standardized time-domain signal.

[0028] S24. The standardized time-domain signal is downsampled to reduce the sampling rate from 8MHz to 1MHz. Step sampling or maximum value sampling can be selected. Maximum value sampling takes the maximum value of every 8 original sampling points as the sampled value after downsampling, avoiding the loss of peak characteristics. Step sampling takes the first point of every 8 original sampling points as the sampled value, which is suitable for scenarios with good signal quality and extremely low noise. In this embodiment, the maximum value sampling method is preferred. The signal obtained after downsampling is the time-domain amplitude data reflecting the changes in GPU computing load. The data volume is only 1 / 8 of the original acquisition volume, which can greatly improve the subsequent processing speed.

[0029] like Figure 2 As shown, after processing in step S2, the digitized signal samples have irrelevant interference removed from the signal, the signal benchmark is unified, and the amount of data is reduced while retaining the core computational features, providing high-quality input data for subsequent segmentation and analysis.

[0030] S3. Based on the periodic repetition pattern in the time-domain amplitude data, segment the target time-domain feature segment corresponding to the operation of a single Transformer Block; the execution process specifically includes: S31. Set an amplitude threshold for the time domain amplitude data. Signals below the threshold are determined to be in the device idle state, and signals above the threshold are determined to be characteristic electromagnetic peaks corresponding to high load matrix operations. Then, through binarization processing or peak extraction processing, all characteristic electromagnetic peaks corresponding to high load matrix operations are identified and a characteristic electromagnetic peak sequence is formed. Among them, time-domain amplitude data ( The amplitude threshold is specifically set using the 3σ criterion (number of sampling points). : ; In the formula The mean of the time-domain amplitude data. This represents the standard deviation of the time-domain amplitude data.

[0031] S32, Token-level coarse segmentation: Since the large model executes all layers of TransformerBlock completely for each Token generated, it can identify and divide the continuous pulse groups in the characteristic electromagnetic peak sequence, and then use the low amplitude gap between two continuous pulse groups as the Token boundary to segment the time domain signal segment corresponding to each Token. S33, Block-level fine segmentation: For the time-domain signal segment of a single token, repeating sub-pulse groups are identified through peak finding or pattern matching. Specifically, within the time-domain signal segment corresponding to a single token, seven consecutive electromagnetic peaks are sequentially searched and fused into electromagnetic leakage data corresponding to a Transformer Block operation. Furthermore, adjacent sub-pulse groups represent the signals corresponding to repeated Transformer Block operations, and the boundary between two adjacent sub-pulse groups is the execution boundary of the Transformer Block. Taking Qwen3-1.7B as an example, 28 repeating sub-pulse groups can be obtained from a single token signal segment, perfectly corresponding to the inherent structure of the 28 Transformer Block layers in this model. S34. Divide the temporal amplitude data according to the execution boundary of the Transformer Block to obtain the target temporal feature segment corresponding to the operation of a single Transformer Block.

[0032] Step S3 utilizes the cyclical characteristics of the three-level nested "Token-Block-Operator" structure of the large model to accurately segment the data layer by layer to obtain the smallest analysis unit. This avoids signal interference across tokens and blocks, effectively improving the accuracy of subsequent analysis.

[0033] S4. Input the target temporal feature segment into the pre-trained architecture analysis model, which includes a cascaded first-stage model and a second-stage model. The architecture analysis model identifies the execution time characteristics of each computational operator within the target temporal feature segment and predicts the architecture hyperparameters of the large model to be analyzed based on these execution time characteristics, outputting the architecture analysis results of the large model to be analyzed. The specific execution process includes: S41. Input the target time-domain feature segment into the first-stage model. The first-stage model identifies the model family classification to which the large model to be analyzed belongs, such as Llama, Qwen2 or Phi3, and outputs the operator segmentation mask of the computational operator to which each time point in the target time-domain feature segment belongs. The first-stage model is a U-Net structure that integrates a Transformer encoder, including a one-dimensional convolutional downsampling module, a one-dimensional convolutional upsampling module, and a bottleneck layer connecting the downsampling module and the upsampling module. A Transformer encoder is introduced into the bottleneck layer. Specifically, the upsampling and downsampling modules contain three one-dimensional convolutional blocks with (32, 64, 128) channels, (10, 3, 3) kernel widths, and (5, 2, 2) strides, achieving an overall reduction factor of 20x. Skip connections bridge the corresponding modules to minimize detail loss due to downprojection. The bottleneck layer integrates learnable positional encoding and two Transformer layers, each with 128 model dimensions and four attention heads, to capture long-range dependencies throughout the execution trajectory.

[0034] The training process of the first stage of the model includes: using the temporal feature samples of the Transformer Block labeled with model family tags and operator boundary tags as the training set, extracting local temporal features through the one-dimensional convolutional downsampling module and upsampling module of the U-Net structure, capturing the long-range dependencies of the temporal sequence through the Transformer encoder introduced in the bottleneck layer, and iteratively training with model family classification loss and operator segmentation mask loss as joint training objectives until the model converges.

[0035] Specifically, the bottleneck features, which integrate local temporal features and global long-range dependencies, are divided into two parallel prediction streams: (1) Model identification: The bottleneck features are aggregated by global average pooling and then processed by the dedicated classification head FamilyNet to map the signals to five model families (Llama, Qwen2, Qwen3, Phi-3 and Gemma-3) and minimize the model family classification cross-entropy loss. (2) Layer segmentation: The features output by the upsampling module generate the segmentation mask for each time step. Assign one of nine operator operation labels to each time step: , , , , , , , as well as During training, minimize the operator segmentation mask cross-entropy loss. The first phase involved weighted joint losses. Perform end-to-end training, in this formula Used to balance auxiliary classification tasks with the main segmentation objective.

[0036] S42. Based on the operator segmentation mask, calculate the proportional relationship of the execution time of each computation operator within the target temporal feature segment, and construct a duration proportion feature vector; the specific execution process includes: (1) Based on the operator segmentation mask, the execution time of the four linear projection operators of the self-attention mechanism and the three linear transformation operators of the feedforward neural network in the target temporal feature segment, as well as the gap time between self-attention and feedforward neural network and the gap time between the beginning and end of the Transformer Block, are statistically analyzed, for a total of nine time dimensions. (2) Divide the values ​​of the nine time dimensions by the total execution time of a single Transformer Block to obtain the normalized time ratio values ​​of the nine dimensions. Concatenate them to form a normalized time ratio feature vector, which is used to characterize the self-attention mechanism of the large model to be analyzed and the computational load distribution between the layers of the feedforward neural network.

[0037] This step uses proportional features instead of absolute duration, which can eliminate the impact of differences in computing power between different chips on the analysis results and ensure the model's cross-device generalization ability.

[0038] S43. Input the duration ratio feature vector into the second-stage model, and the second-stage model predicts and outputs the architecture hyperparameters of the large model to be analyzed; wherein, the second-stage model is a multilayer perceptron network, including several independent output heads, and different output heads are used to independently predict different architecture hyperparameters of the large model to be analyzed. Specifically, the duration-proportional feature vector is input into HyperNet, the second-stage model, which is a multi-head MLP with a shared backbone and independent linear heads. Each head predicts a unique hyperparameter class through cross-entropy classification, including hidden layer size, intermediate layer size, number of query attention heads, number of key-value heads, and head dimension. The total loss is the sum of the losses of each head to handle the complexity of the combined configuration.

[0039] The training process of the second stage model is as follows: the training set is the feature vector samples of duration ratio labeled with corresponding hyperparameter labels. Each output head outputs the prediction result of a class of architecture hyperparameters. The training objective is to minimize the cross-entropy loss between the prediction result and the actual hyperparameter label. The training is carried out iteratively until the model converges.

[0040] S44. Integrate the model family classification results and architecture hyperparameters into the architecture analysis results of the large model to be analyzed.

[0041] Regarding the aforementioned end-side large model architecture analysis method based on electromagnetic side channels, this invention provides an end-side large model architecture analysis system based on electromagnetic side channels, comprising the following modules: The electromagnetic signal acquisition module is used to non-contactly acquire electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment, and convert the electromagnetic radiation signals into digital signal samples. The signal preprocessing module is used to preprocess digital signal samples and extract time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device. The Transformer Block segmentation module is used to segment the target temporal feature segments corresponding to a single Transformer Block operation based on the periodic repetition patterns in the temporal amplitude data. The architecture analysis module is used to identify the execution time characteristics of each computational operator within the target temporal feature segment through the architecture analysis model, predict the architecture hyperparameters of the large model to be analyzed based on the execution time characteristics, and output the architecture analysis results of the large model to be analyzed.

[0042] like Figure 3 , Figure 4 As shown, this invention was tested on various open-source models on the Jetson Orin Nano platform. Experimental results show that this invention achieved an accuracy of 99.12% in model family classification; in terms of specific hyperparameter estimation, the prediction accuracy for hidden layer size reached 98.14%, the accuracy for intermediate layer size reached 98.24%, and the average hyperparameter recognition accuracy exceeded 96%. Tests show that even for structurally similar models, such as Qwen2 and Llama, the subtle differences in operator graphs captured by this method (such as the normalized head unique to Qwen3) can still be accurately distinguished.

[0043] Therefore, this invention provides a method and system for analyzing large-scale end-side model architectures based on electromagnetic side channels. By employing a non-intrusive hardware load feature extraction mechanism, a three-level boundary segmentation method based on the Transformer architecture's nested cycle (Token-Block-Operator), and ultimately constructing a two-stage deep learning architecture reconstruction model based on operator duration ratio mapping, this invention achieves a non-intrusive black-box large-scale model architecture identification process encompassing signal acquisition, hierarchical feature segmentation, and physical feature mapping reconstruction. This solves the core pain points of existing end-side large-scale model architecture identification technologies, such as the inability to reverse engineer software-level black-box models, watermark embedding damaging model inference performance, and the need for physical contact with and damage to equipment in traditional hardware side-channel analysis, making it difficult to adapt to uncontrolled scenarios. This significantly improves the accuracy and compliance of black-box large-scale model architecture identification, avoids physical damage to target devices and performance degradation of the original model during the detection process, and reduces the impact of differences in computing power and acquisition operation deviations between different end-side chips on the identification results. It provides a non-intrusive, high-precision, and easily deployable technical solution for end-side large-scale model full lifecycle management scenarios.

[0044] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An end-side large model architecture analysis method based on an electromagnetic side channel, characterized by, Includes the following steps: S1. Collect the electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment, and convert the electromagnetic radiation signals into digital signal samples; S2. Preprocess the digital signal samples to extract time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device. S3. Based on the periodic repetition pattern in the temporal amplitude data, segment the target temporal feature segment corresponding to the operation of a single Transformer Block; S4. Input the target temporal feature segment into the pre-trained architecture analysis model. The architecture analysis model identifies the execution time characteristics of each computation operator within the target temporal feature segment. Based on the execution time characteristics, it predicts the architecture hyperparameters of the large model to be analyzed and outputs the architecture analysis results of the large model to be analyzed.

2. The method of claim 1, wherein the method is based on an electromagnetic side-channel end-side large model architecture analysis. Step S1 specifically includes: S11. Place the near-field probe of the radio frequency signal receiving device at a non-contact position at a predetermined distance from the target device, and align it with the radiation area of ​​the voltage regulation module of the target device; the radio frequency signal receiving device includes a near-field probe and a software-defined wireless device; S12. Collect the electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment through the radio frequency signal receiving device, and convert the electromagnetic radiation signals into IQ samples as digital signal samples.

3. The method of claim 1, wherein the method is based on an electromagnetic side-channel end-side large model architecture analysis. Step S2 specifically includes: S21. Perform amplitude modulation and demodulation on the digital signal sample to convert the complex digital signal sample into an initial time-domain amplitude signal; S22. Denoise the initial time-domain amplitude signal to obtain a denoised time-domain signal; wherein, the denoising process adopts any one of total variation denoising, moving average filtering, or sliding window peak enhancement method. S23. Perform Z-score normalization on the denoised time-domain signal to obtain a normalized time-domain signal; S24. The standardized time-domain signal is downsampled using step sampling or maximum value sampling. While preserving the core execution characteristics, the signal sampling frequency is reduced, and the final output is time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device.

4. The method of claim 1, wherein the method is characterized by, Step S3 specifically includes: S31. Set an amplitude threshold for the time-domain amplitude data, and identify all the characteristic electromagnetic peaks corresponding to the high-load matrix operations through binarization or peak extraction processing to form a characteristic electromagnetic peak sequence. S32. Perform token-level coarse segmentation on the characteristic electromagnetic peak sequence: identify continuous pulse groups in the electromagnetic peak sequence, use the low amplitude gaps between continuous pulse groups as token boundaries, and obtain the time-domain signal segment corresponding to a single token. S33. Perform Block-level fine segmentation on the time domain signal segment corresponding to each single Token: identify the periodically repeating sub-pulse groups in the time domain signal segment of a single Token, and take the boundary of two adjacent sub-pulse groups with a feature matching degree higher than a preset threshold as the execution boundary of the Transformer Block. S34. Divide the temporal amplitude data according to the execution boundary of the Transformer Block to obtain the target temporal feature segment corresponding to the operation of a single Transformer Block.

5. The method of claim 1, wherein the method is based on an electromagnetic side-channel end-side large model architecture analysis. The architecture analysis model includes a cascaded first-stage model and a second-stage model; step S4 specifically includes: S41. Input the target time-domain feature segment into the first-stage model. The first-stage model identifies the model family classification to which the large model to be analyzed belongs and outputs the operator segmentation mask of the computational operator to which each time point in the target time-domain feature segment belongs. S42. Based on the operator segmentation mask, calculate the proportional relationship of the execution time of each computation operator in the target temporal feature segment, and construct the duration proportion feature vector. S43. Input the duration ratio feature vector into the second-stage model, and the second-stage model will predict and output the architecture hyperparameters of the large model to be analyzed. S44. Integrate the model family classification results and architecture hyperparameters into the architecture analysis results of the large model to be analyzed.

6. The method of claim 5, wherein the method is based on an electromagnetic side-channel end-side large model architecture analysis. The structure of the first-stage model is a U-Net structure that integrates a Transformer encoder, including a one-dimensional convolutional downsampling module, a one-dimensional convolutional upsampling module, and a bottleneck layer connecting the downsampling module and the upsampling module. A Transformer encoder is introduced in the bottleneck layer. The training process of the first stage of the model includes: using the temporal feature samples of the Transformer Block labeled with model family tags and operator boundary tags as the training set, extracting local temporal features through the one-dimensional convolutional downsampling module and upsampling module of the U-Net structure, capturing the long-range dependencies of the temporal sequence through the Transformer encoder introduced in the bottleneck layer, and iteratively training with model family classification loss and operator segmentation mask loss as joint training objectives until the model converges.

7. The end-side large-scale model architecture analysis method based on electromagnetic side channels according to claim 5, characterized in that, Step S42 specifically includes: (1) Based on the operator segmentation mask, the execution time of the four linear projection operators of the self-attention mechanism and the three linear transformation operators of the feedforward neural network in the target temporal feature segment, as well as the gap time between self-attention and feedforward neural network and the gap time between the beginning and end of the Transformer Block, are statistically analyzed, for a total of nine time dimensions. (2) Divide the values ​​of the nine time dimensions by the total execution time of a single Transformer Block to obtain the normalized time ratio values ​​of the nine dimensions, and then concatenate them to form a normalized time ratio feature vector.

8. The end-side large model architecture analysis method based on electromagnetic side channel according to claim 5, characterized in that: The second-stage model is a multilayer perceptron network, which includes several independent output heads. Different output heads are used to independently predict different architecture hyperparameters of the large model to be analyzed. The training process of the second stage model is as follows: the training set is the feature vector samples of duration ratio labeled with corresponding hyperparameter labels. Each output head outputs the prediction result of a class of architecture hyperparameters. The training objective is to minimize the cross-entropy loss between the prediction result and the actual hyperparameter label. The training is carried out iteratively until the model converges.

9. A large-scale end-side architecture analysis system based on electromagnetic side channels, employing the large-scale end-side architecture analysis method based on electromagnetic side channels as described in any one of claims 1-8, characterized in that, Includes the following modules: The electromagnetic signal acquisition module is used to non-contactly acquire electromagnetic radiation signals generated during the operation of the large model to be analyzed by the target end-side equipment, and convert the electromagnetic radiation signals into digital signal samples. The signal preprocessing module is used to preprocess digital signal samples and extract time-domain amplitude data that reflects the changes in the underlying hardware computing load of the target device. The Transformer Block segmentation module is used to segment the target temporal feature segments corresponding to a single Transformer Block operation based on the periodic repetition patterns in the temporal amplitude data. The architecture analysis module is used to identify the execution time characteristics of each computational operator within the target temporal feature segment through the architecture analysis model, predict the architecture hyperparameters of the large model to be analyzed based on the execution time characteristics, and output the architecture analysis results of the large model to be analyzed.

Images