Model data sending method, model data integration method and device

Abstract

The present application discloses a model data sending method, a model data integration method and a device, which belong to the field of model data processing. The method includes: after the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space; before loading the target application related to the training of the target model, the application measurement value of the target application is measured, and the application measurement value is added to the trusted root protection space; in the process of model training, according to the execution order of the application module associated with the training of the target model in the target application, the module measurement value of the application module is obtained, and the module measurement value is added to the trusted root protection space; based on the remote attestation method, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value.

Description

Technical Field

[0001] The present application belongs to the technical field of model data processing, and specifically relates to a model data sending method, a model data integration method and a device. Background Art

[0002] Artificial intelligence has entered the application era and can help all walks of life complete various tasks and provide a variety of services. With the upgrade of privacy supervision by regulatory authorities and the enhancement of user privacy awareness, using user data to provide higher quality and more comprehensive AI services while doing a good job of privacy protection has become a key issue of concern in the industry. In response to this issue, the industry currently generally deploys federated learning solutions to enhance the protection of user privacy data.

[0003] Federated learning technology is a distributed training mechanism. Users use data to train models on local terminals (such as mobile phones, tablets, laptops, etc.), and the local terminals transmit the learned weight updates to the server. The server aggregates the weight updates sent by all terminals, updates the server model weights, and distributes the updated weight parameters to the terminals to update the terminal models.

[0004] In the context of federated learning, data and model poisoning attacks are very typical and can cause great damage to artificial intelligence systems. Data and model poisoning refers to adding hidden doors that are difficult for humans to perceive to the training data during the model training process, such as adding points of different colors arranged according to certain rules that are invisible to the naked eye to the image; adding a section of ultrasonic waves that meet certain rules and are inaudible to the human ear to the voice, so that when the model is trained, this part of the feature is regarded as part of the sample feature, etc., which in turn damages the cloud-integrated model. Summary of the invention

[0005] The purpose of the embodiments of the present application is to provide a model data sending method, a model data integration method and a device, which can solve the problem in the prior art that, during the model training process, hidden doors that are difficult for humans to perceive are added to the training data, resulting in damage to the cloud-integrated model.

[0006] In a first aspect, an embodiment of the present application provides a model data sending method, which is applied to a terminal, and the method includes:

[0007] After the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space;

[0008] Before loading a target application related to training of a target model, measuring an application metric value of the target application, and adding the application metric value to the trusted root protection space;

[0009] In the process of model training, according to the execution order of the application modules associated with the training of the target model in the target application, the module measurement values ​​of the application modules are obtained, and the module measurement values ​​are added to the trusted root protection space;

[0010] Based on the remote attestation method, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value.

[0011] In a second aspect, an embodiment of the present application provides a model data integration method, which is applied to a server, and the method includes:

[0012] Receiving trusted root information and model data sent by a terminal, wherein the trusted root information is determined based on a device measurement value, an application measurement value, and a module measurement value;

[0013] Determining the credibility of the model data based on the device metric value, the application metric value, and the module metric value;

[0014] Based on the credibility, the model data is integrated.

[0015] In a third aspect, an embodiment of the present application provides a model data sending device, which is applied to a terminal, and the device includes:

[0016] A device measurement value acquisition module, used for acquiring device measurement values ​​of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and adding the device measurement values ​​to the trusted root protection space;

[0017] An application metric value acquisition module, used for measuring the application metric value of the target application related to the training of the target model before loading the target application, and adding the application metric value to the trusted root protection space;

[0018] A module metric value acquisition module, used for acquiring module metric values ​​of the application modules according to the execution order of the application modules associated with the training of the target model in the target application during the model training process, and adding the module metric values ​​to the trusted root protection space;

[0019] A trusted root information sending module is used to send the trusted root information and the model data of the target model to the server based on a remote attestation method, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value.

[0020] In a fourth aspect, an embodiment of the present application provides a model data integration device, which is applied to a server, and the device includes:

[0021] A model data receiving module, used to receive the trusted root information and model data sent by the terminal, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value;

[0022] a credibility determination module, configured to determine the credibility of the model data based on the device metric value, the application metric value, and the module metric value;

[0023] The model data integration module is used to integrate the model data based on the credibility.

[0024] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the model data sending method described in the first aspect, or the steps of the model data integration method described in the second aspect.

[0025] In a sixth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the model data sending method described in the first aspect or the model data integration method described in the second aspect are implemented.

[0026] In the seventh aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run a program or instruction to implement the model data sending method described in the first aspect, or the model data integration method described in the second aspect.

[0027] In an embodiment of the present application, after the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space. Before loading the target application related to the training of the target model, the application measurement value of the target application is measured, and the application measurement value is added to the trusted root protection space. In the process of model training, according to the execution order of the application module associated with the training of the target model in the target application, the module measurement value of the application module is obtained, and the module measurement value is added to the trusted root protection space. Based on the remote attestation method, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value. In the embodiment of the present application, in the process from the terminal startup to the application being loaded, before being loaded, the measurement value of all loaded software modules is measured by the measurement module in the software module before it, and the measurement value is placed in the protected storage space of the trusted root. This method can prevent the loaded software module (such as after being maliciously modified) from tampering with its own measurement value, and reduce the possibility of the cloud being attacked by data and model poisoning when integrating model parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of a method for sending model data provided in an embodiment of the present application;

[0029] Figure 2 A schematic diagram of establishing a trusted chain provided in an embodiment of the present application;

[0030] Figure 3 A flowchart of a model data integration method provided in an embodiment of the present application;

[0031] Figure 4 A schematic diagram of the structure of a model data sending device provided in an embodiment of the present application;

[0032] Figure 5 A schematic diagram of the structure of a data integration device provided in an embodiment of the present application;

[0033] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the structure of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.

[0036] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0037] The model data sending method provided in the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0038] Reference Figure 1 , shows a flow chart of the steps of a model data sending method provided by an embodiment of the present application, and the model data sending method can be applied to a terminal, such as Figure 1 As shown, the model data sending method may include the following steps:

[0039] Step 101: After the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space.

[0040] The embodiments of the present application can be applied to a scenario where all loaded software modules are measured by a measurement module in a previous software module before being loaded, so as to prevent the loaded software modules from tampering with their own measurement values.

[0041] The device measurement value refers to the measurement value obtained by measuring each terminal module in the terminal before execution, and the measurement value can be used to indicate the probability of the terminal module being maliciously tampered with.

[0042] In this embodiment, after the terminal is started, the device measurement value of each terminal module can be obtained according to the execution order of each terminal module in the terminal, and the device measurement value is added to the trusted root protection space. In this example, the terminal module may include: BIOS (Basic Input Output System), boot loader, system kernel, system service module. When obtaining the device measurement value, the measurement value of the terminal module loaded later can be measured by the terminal module loaded earlier according to the execution order of the terminal modules loaded later. Specifically, it can be combined with Figure 2 The specific implementation is described in detail below.

[0043] In a specific implementation of the present application, the above step 101 may include:

[0044] Sub-step A1: After the terminal is started, based on a basic input and output system BIOS, a first device measurement value of the BIOS is added to the trusted root protection space.

[0045] In this embodiment, the first device measurement value refers to a measurement value of the BIOS of the terminal, and the first device measurement value can be used to indicate the probability that the BIOS is maliciously tampered with.

[0046] After the terminal is started, the first device measurement value of the terminal itself can be added to the trusted root protection space based on the BIOS.

[0047] After the first device measurement value of the BIOS is added to the trusted root protection space through the basic input and output system, sub-step A2 is performed.

[0048] Sub-step A2: Based on the BIOS, measure and obtain a second device measurement value of the boot loader of the terminal, and add the second device measurement value to the trusted root protection space.

[0049] The second device measurement value refers to a measurement value of the boot loader measured by the BIOS, and the second device measurement value can be used to indicate the probability that the boot loader has been maliciously tampered with.

[0050] After the BIOS adds its own first device measurement value to the trusted root protection space, the second device measurement value of the terminal's boot loader can be measured based on the BIOS's measurement module, and the second device measurement value of the boot loader can be added to the trusted root protection space through the BIOS's measurement module.

[0051] After the second device measurement value is added to the trusted root protection space through BIOS, sub-step A3 is performed.

[0052] Sub-step A3: Based on the boot loader, measure and obtain a third device measurement value of the system kernel of the terminal, and add the third device measurement value to the trusted root protection space.

[0053] The third device measurement value refers to a measurement value of a system kernel of the terminal, and the third device measurement value can be used to indicate the probability that the system kernel has been maliciously tampered with.

[0054] After the second device measurement value is added to the trusted root protection space through BIOS, the third device measurement value of the system kernel of the terminal can be measured based on the measurement module of the boot loader, and then the third device measurement value can be added to the trusted root protection space through the measurement module of the boot loader.

[0055] After the third device metric value is added to the trusted root protection space by the boot loader, sub-step A4 is performed.

[0056] Sub-step A4: Based on the system kernel, measure and obtain a fourth device measurement value of the system service module of the terminal, and add the fourth device measurement value to the trusted root protection space.

[0057] The fourth device measurement value refers to a measurement value of a system service module of the terminal, and the fourth device measurement value may be used to indicate a probability that the system service module is maliciously tampered with.

[0058] After the third device measurement value is added to the trusted root protection space through the boot loader, the fourth device measurement value of the terminal's system service module can be obtained based on the measurement module of the system kernel, and the fourth device measurement value can be added to the trusted root protection space through the measurement module of the system kernel.

[0059] The device measurement value acquisition scheme provided in the embodiment of the present application measures the next loaded terminal device by the previously loaded terminal device, thereby preventing the next loaded terminal device from tampering with its own measurement value, resulting in a break in the trusted chain, and reducing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0060] After obtaining the device measurement value of each terminal module according to the execution order of each terminal module in the terminal and adding the device measurement value to the trusted root protection space, step 102 is executed.

[0061] Step 102: Before loading a target application related to training of a target model, measure an application metric value of the target application, and add the application metric value to the trusted root protection space.

[0062] The target model refers to a model trained locally on the terminal. In this example, the target model may be a text recognition model, a location recognition model, etc. Specifically, the specific type of the target model may be determined according to business requirements, and this embodiment does not impose any restrictions on this.

[0063] The target application refers to a model related to the training of the target model, that is, the training of the target model is completed through the target application. In this example, the target application can be one application or multiple applications. Specifically, the number of target applications can be determined according to business needs, and this embodiment does not limit this.

[0064] The application metric value refers to the metric value of the target application for training the target model, and the application metric value can be used to indicate the probability that the target application is maliciously tampered with.

[0065] Before loading the target application related to the training of the target model, the measurement value of the target application, that is, the application measurement value, can be measured based on the measurement module in the last loaded system service module in each terminal module in the terminal.

[0066] After obtaining the application measurement value of the target application program through the measurement module in the system service module, the application measurement value can be added to the trusted root protection space through the measurement module.

[0067] By measuring the measurement value of the target application through the previously loaded system service module before loading the target application, the embodiment of the present application can avoid the target application modifying its own measurement value after loading the target application, causing a break in the trust chain and increasing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0068] After measuring the application measurement value of the target application and adding the application measurement value to the trusted root protection space, step 103 is performed.

[0069] Step 103: During the model training process, according to the execution order of the application modules associated with the training of the target model in the target application, the module measurement value of the application module is obtained, and the module measurement value is added to the trusted root protection space.

[0070] The application module refers to the module used in the process of training the target application. In this example, the application modules in the target application may include: a data acquisition module, a data training module, and a data upload module. The data acquisition module may be used to collect sample data for target model training, and the data training module may be used as a module used in the process of training the target model. The data upload module refers to a module that uploads the model data of the target model to the server after the training of the target model is completed in the target application.

[0071] The module metric value refers to the metric value of each application module in the target application program, and the module metric value can be used to indicate the probability that the application module has been maliciously tampered with.

[0072] In the process of model training, the module measurement value of the application module can be obtained according to the execution order of the application module associated with the training of the target model in the target application, and the module measurement value is added to the trusted root protection space. Specifically, it can be described in detail in combination with the following specific implementation method.

[0073] In another specific implementation of the present application, the above step 103 may include:

[0074] Sub-step B1: During the model training process, based on the measurement module of the target application, measure the first module measurement value of the data acquisition module of the target application, and add the first module measurement value to the trusted root protection space.

[0075] In this embodiment, the data collection module refers to a module within the target application program that collects model training samples when training the target model.

[0076] The first module metric value refers to the metric value of the data collection module in the target application program, and the first module metric value can be used to indicate the probability that the data collection module has been maliciously modified.

[0077] During the model training process, the data acquisition module in the target application is executed first. Before loading the data acquisition module, the module measurement value of the data acquisition module, that is, the first module measurement value, can be obtained based on the measurement module in the target application.

[0078] After the first module measurement value of the data acquisition module is obtained through measurement, the first module measurement value can be added to the trusted root protection space through the measurement module of the target application.

[0079] After the first module measurement value is added to the trusted root protection space by the measurement module of the target application, sub-step B2 is performed.

[0080] Sub-step B2: Based on the data acquisition module, measure and obtain a second module measurement value of the model training module of the target application, and add the second module measurement value to the trusted root protection space.

[0081] A model training module refers to a module within a target application that is used to train a target model.

[0082] The second module metric value refers to the metric value of the model training module within the target application, and the second module metric value can be used to indicate the probability that the metric value of the model training module has been maliciously modified.

[0083] After the first module measurement value is added to the trusted root protection space through the measurement module of the target application, the measurement value of the model training module, that is, the second module measurement value, can be obtained through the data acquisition module before the model training module in the target application is loaded.

[0084] After obtaining the second module measurement value of the model training module through the data acquisition module, the second module measurement value can be added to the trusted root protection space through the data acquisition module.

[0085] After the second module measurement value is added to the trusted root protection space through the data acquisition module, sub-step B3 is executed.

[0086] Sub-step B3: Based on the model training module, measure the third module measurement value of the model data upload module of the target application, and add the third module measurement value to the trusted root protection space.

[0087] The model data upload module refers to a module within the target application program that is used to upload the model data of the target model to the server.

[0088] The third module metric value refers to the metric value of the model data upload module, and the third module metric value can be used to indicate the probability that the model data upload module has been maliciously modified.

[0089] After the second module measurement value is added to the trusted root protection space through the data acquisition module, before the model data upload module is loaded, the measurement value of the model data upload module in the target application can be measured through the model training module, that is, the third module measurement value. Furthermore, the third module measurement value can be added to the trusted root protection space through the model training module.

[0090] In the embodiment of the present application, by having the application module associated with the target model training in the target application program measured by the previously loaded module before loading, it is possible to prevent the loaded application module from modifying its own measurement value, causing a break in the trust chain and increasing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0091] The above steps complete the establishment of the trusted chain. During the process from device startup to application loading, all loaded software modules have their measurement values ​​measured by the measurement module in the previous software module before being loaded, and the measurement values ​​are placed in the protected storage space of the trusted root. This prevents the loaded software module (such as after being maliciously modified) from tampering with its own measurement value, which may cause the trusted chain to break.

[0092] The data collection service, local training service, and model parameter data upload service of the federated learning on the terminal side are generally deployed in the user-side device in the form of upper-layer applications. In the process of establishing the trusted chain of the terminal-side device, the terminal-side device application is measured by the system service, and the measurement value is stored in the protected storage space of the trusted root. When the trusted chain of the device is established, the data in the trusted root can be shown in Table 1 below:

[0093] Table 1:

[0094]

[0095] It can be seen from Table 1 above that the protected storage space in the trusted root contains the names and corresponding measurement values ​​of all software modules loaded by the end-side device when the device is started.

[0096] After obtaining module metrics of application modules according to the execution order of application modules associated with the training of the target model in the target application program and adding the module metrics to the trusted root protection space, step 104 is performed.

[0097] Step 104: Based on the remote attestation method, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value.

[0098] After establishing the above-mentioned trusted chain, the trusted chain can be sent to the server based on the remote attestation method, that is, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is based on the device measurement value, application measurement value and module measurement value of the above-mentioned measurement. After the server receives the trusted root information and model data sent by the terminal, the server can determine the credibility of the model data based on the device measurement value, application measurement value and module measurement value, and integrate the model data based on the credibility. Specifically, the trusted root information and model data can be encrypted based on the public and private keys issued by the server to obtain encrypted information, and the encrypted information is sent to the server.

[0099] The above process can be described in detail in combination with the following steps.

[0100] 1. The user installs an application that uses federated learning to train the model and sends the certificate in the trusted root identity information to the cloud;

[0101] 2. The cloud generates a random number, encrypts it using the public key in the certificate in step 1, and sends it to the user's terminal device;

[0102] 3. After receiving the random number encrypted by the public key, the terminal device decrypts the random number and returns it to the cloud along with the data signature in the protected storage space of the trusted root;

[0103] 4. After the cloud receives the random number for confirmation, it puts the certificate received in step 1 into its own database, and stores the corresponding software modules and measurement values ​​loaded on the device in the database, including federated learning data collection, local training, and data upload modules;

[0104] 5. The cloud encrypts the latest version of the integration model using the public key in the certificate and sends the encrypted data to the user’s terminal device;

[0105] 6. After receiving the encrypted data from the cloud, the user uses his own private key to decrypt it and loads the decrypted integrated model into the AI ​​business;

[0106] 7. When the user uses the AI ​​service, the corresponding privacy data is generated. The federated learning collection module collects the privacy data and sends it to the local training module to update the integrated model and generate model update parameters. The model update parameters are sent to the federated learning data upload module.

[0107] The model data sending method provided in the embodiment of the present application obtains the device measurement value of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and adds the device measurement value to the trusted root protection space; before loading the target application related to the training of the target model, measures the application measurement value of the target application, and adds the application measurement value to the trusted root protection space; during the model training process, obtains the module measurement value of the application module according to the execution order of the application module associated with the training of the target model in the target application, and adds the module measurement value to the trusted root protection space; based on the remote attestation method, sends the trusted root information and the model data of the target model to the server, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value. In the embodiment of the present application, during the process from terminal startup to application loading, all software modules that are loaded have their measurement values ​​measured by the measurement modules in the previous software modules before they are loaded, and the measurement values ​​are placed in the protected storage space of the trusted root. This method can prevent the loaded software modules (such as those that have been maliciously modified) from tampering with their own measurement values, thereby reducing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0108] Reference Figure 3 , shows a flow chart of the steps of a model data integration method provided by an embodiment of the present application, and the model data integration method can be applied to a server, such as Figure 3 As shown, the model data integration method may include the following steps:

[0109] Step 301: receiving trusted root information and model data sent by a terminal, wherein the trusted root information is determined based on device measurement values, application measurement values, and module measurement values.

[0110] The embodiments of the present application can be applied to scenarios where the credibility of model data is determined in combination with trusted root information, and the model data is integrated and processed according to the credibility.

[0111] After the terminal establishes a trusted chain through the above embodiment and sends the trusted chain to the server, the server can obtain corresponding trusted root information and model data according to the trusted chain, wherein the trusted root information is determined based on device measurement values, application measurement values ​​and module measurement values.

[0112] The device measurement value refers to the measurement value obtained by measuring each terminal module in the terminal before execution, and the measurement value can be used to indicate the probability of the terminal module being maliciously tampered with.

[0113] The application metric value refers to the metric value of the target application for training the target model, and the application metric value can be used to indicate the probability that the target application is maliciously tampered with.

[0114] The module metric value refers to the metric value of each application module related to model training within the target application (such as data acquisition module, model training module, model data upload module, etc.). The module metric value can be used to indicate the probability of the application module being maliciously tampered with.

[0115] After receiving the trusted root information and model data sent by the terminal, step 302 is executed.

[0116] Step 302: Determine the credibility of the model data based on the device metric value, the application metric value and the module metric value.

[0117] After receiving the trusted root information and model data sent by the terminal, the trusted root information can be parsed to obtain device measurement values, application measurement values ​​and module measurement values, and the credibility of the model data can be determined based on the device measurement values, application measurement values ​​and module measurement values. Specifically, it can be described in detail in combination with the following specific implementation method.

[0118] In a specific implementation of the present application, the above step 302 may include:

[0119] Sub-step D1: Determine whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range.

[0120] The first preset range refers to a preset numerical range corresponding to the device measurement value. In this example, the first preset range can be multiple numerical ranges, corresponding to a preset range corresponding to the BIOS, a preset range corresponding to the boot loader, a preset range corresponding to the system kernel, and a preset range corresponding to the system service module.

[0121] The second preset range refers to the preset numerical range corresponding to the application metric value. In this example, the second preset range can be one numerical range or multiple numerical ranges, specifically, it can be determined according to the number of applications for training the target model. This embodiment does not limit the number of the second preset ranges.

[0122] The third preset range refers to the preset numerical range corresponding to the module metric value. The third preset range can be multiple numerical ranges, corresponding to the preset range corresponding to the data acquisition module, the preset range corresponding to the model training module, and the preset range corresponding to the model data upload module.

[0123] After parsing the trusted root information to obtain the device measurement value, application measurement value and module measurement value, it can be determined whether the device measurement value is within the first preset range, whether the application measurement value is within the second preset range, and whether the module measurement value is within the third preset range to obtain the corresponding measurement value determination result.

[0124] Sub-step D2: Determine the credibility of the model data according to the determination results of the device measurement value, the application measurement value and the module measurement value.

[0125] The determination result of the device measurement value refers to whether the device measurement value is within the first preset range.

[0126] The determination result of the application metric value refers to the result of whether the application metric value is within the second preset range.

[0127] The determination result of the module metric value refers to whether the module metric value is within a third preset range.

[0128] After obtaining the determination results of the device measurement value, the determination results of the application measurement value and the determination results of the module measurement value, the credibility of the model data can be determined according to the device measurement value determination results, the application measurement value determination results and the module measurement value determination results, that is, when the device measurement value determination result indicates that the device measurement value is within a first preset range, the application measurement value determination result indicates that the application measurement value is within a second preset range, and the module measurement value determination result indicates that the module measurement value is within a third preset range, then the credibility of the model data is determined to be the highest; conversely, when the device measurement value determination result indicates that the device measurement value is not within the first preset range, the application measurement value determination result indicates that the application measurement value is not within the second preset range, and the module measurement value determination result indicates that the module measurement value is not within the third preset range, then the credibility of the model data is determined to be the lowest, etc.

[0129] Of course, in a specific implementation, the method for determining the credibility is not limited to the above method. In actual applications, other methods can also be used to determine the credibility of the model data. For example, the credibility of the model data can be determined based on the completeness of the device measurement value, the application measurement value and the module measurement value. Specifically, it can be determined whether the device measurement value includes the measurement value of the BIOS, the measurement value of the boot loader, the measurement value of the system kernel and the measurement value of the system service module, whether the application measurement value includes the measurement values ​​of all application programs of the training target model, and whether the module measurement value includes the measurement values ​​of all application modules in the target application program of the training target model, etc., so as to determine the credibility of the model data. The method for determining the credibility of the model data can be determined according to business needs, and this is not limited in this embodiment.

[0130] Step 303: Based on the credibility, the model data is integrated.

[0131] After determining the credibility of the model data, the model data can be integrated based on the credibility. Specifically, when the credibility of the model data is low, the model data can be discarded, or the weight of the model data in the integrated model can be reduced, so as to reduce the risk of malicious model data having a negative impact on the integrated model and reduce the possibility of poisoning the integrated model.

[0132] The model data integration method provided in the embodiment of the present application receives the trusted root information and model data sent by the terminal, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value, determines the credibility of the model data based on the device measurement value, the application measurement value and the module measurement value, and integrates the model data based on the credibility. The embodiment of the present application discards the model update parameters with low credibility, or reduces the weight of the model update parameters when integrating the model, so as to reduce the risk of negative impact on the integrated model caused by malicious model update parameters and reduce the possibility of poisoning the integrated model.

[0133] It should be noted that the execution subject of the model data sending or model data integration method provided in the embodiment of the present application may be a model data sending device or a model data integration device, or a control module in the model data sending device or the model data integration device for executing the model data sending method or the model data integration method. In the embodiment of the present application, the execution of the model data integration method by the model data sending device or the data integration device is taken as an example to illustrate the model data sending device and the model data integration device provided in the embodiment of the present application.

[0134] Reference Figure 4 , shows a schematic diagram of the structure of a model data sending device provided in an embodiment of the present application, which can be applied to a terminal, such as Figure 4 As shown, the model data sending device 400 may include:

[0135] The device measurement value acquisition module 410 is used to acquire the device measurement value of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and add the device measurement value to the trusted root protection space;

[0136] An application metric value acquisition module 420, used to measure the application metric value of the target application related to the training of the target model before loading the target application, and add the application metric value to the trusted root protection space;

[0137] A module metric value acquisition module 430 is used to acquire module metric values ​​of the application modules according to the execution order of the application modules associated with the training of the target model in the target application during the model training process, and add the module metric values ​​to the trusted root protection space;

[0138] The trusted root information sending module 440 is used to send the trusted root information and the model data of the target model to the server based on the remote attestation method, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value.

[0139] Optionally, the device measurement value acquisition module includes:

[0140] A first device measurement value adding unit, configured to add a first device measurement value of a basic input and output system BIOS to the trusted root protection space based on the basic input and output system BIOS after the terminal is started;

[0141] A second device measurement value adding unit, configured to measure and obtain a second device measurement value of a boot loader of the terminal based on the BIOS, and add the second device measurement value to the trusted root protection space;

[0142] A third device measurement value adding unit, configured to measure and obtain a third device measurement value of a system kernel of the terminal based on the boot loader, and add the third device measurement value to the trusted root protection space;

[0143] The fourth device measurement value adding unit is used to measure and obtain a fourth device measurement value of the system service module of the terminal based on the system kernel, and add the fourth device measurement value to the trusted root protection space.

[0144] Optionally, the module metric value acquisition module includes:

[0145] A first module measurement value acquisition unit is used to measure and obtain a first module measurement value of a data acquisition module of the target application based on the measurement module of the target application during the model training process, and add the first module measurement value to the trusted root protection space;

[0146] A second module measurement value acquisition unit, configured to measure and obtain a second module measurement value of the model training module of the target application based on the data acquisition module, and add the second module measurement value to the trusted root protection space;

[0147] The third module measurement value acquisition unit is used to measure the third module measurement value of the model data upload module of the target application based on the model training module, and add the third module measurement value to the trusted root protection space.

[0148] Optionally, the trusted root information sending module includes:

[0149] An encryption information acquisition unit, used to encrypt the trusted root information and the model data based on the public and private keys issued by the server to obtain encrypted information;

[0150] The encrypted information sending unit is used to send the encrypted information to the server.

[0151] The model data sending device provided in the embodiment of the present application obtains the device measurement value of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and adds the device measurement value to the trusted root protection space; before loading the target application related to the training of the target model, measures the application measurement value of the target application, and adds the application measurement value to the trusted root protection space; during the model training process, obtains the module measurement value of the application module according to the execution order of the application modules associated with the training of the target model in the target application, and adds the module measurement value to the trusted root protection space; based on the remote attestation method, sends the trusted root information and the model data of the target model to the server, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value. In the embodiment of the present application, during the process from terminal startup to application loading, all software modules that are loaded have their measurement values ​​measured by the measurement modules in the previous software modules before they are loaded, and the measurement values ​​are placed in the protected storage space of the trusted root. This method can prevent the loaded software modules (such as those that have been maliciously modified) from tampering with their own measurement values, thereby reducing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0152] Reference Figure 5 , shows a schematic diagram of the structure of a model data integration device provided in an embodiment of the present application, the model data integration device can be applied to a server, such as Figure 5 As shown, the model data integration device 500 may include the following modules:

[0153] A model data receiving module 510, configured to receive trusted root information and model data sent by a terminal, wherein the trusted root information is determined based on device measurement values, application measurement values, and module measurement values;

[0154] A credibility determination module 520, configured to determine the credibility of the model data based on the device metric value, the application metric value, and the module metric value;

[0155] The model data integration module 530 is used to integrate the model data based on the credibility.

[0156] Optionally, the credibility determination module includes:

[0157] a metric value determination unit, configured to determine whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range;

[0158] The second credibility determination unit is used to determine the credibility of the model data according to the device measurement value determination result, the application measurement value determination result and the module measurement value determination result.

[0159] Optionally, the model data integration module includes:

[0160] A model data integration unit, configured to reduce the weight of the model data when the credibility is lower than a credibility threshold, and integrate the model data after the weight reduction;

[0161] The model data discarding unit is used to discard the model data when the credibility is lower than the credibility threshold.

[0162] The model data integration device provided in the embodiment of the present application receives the trusted root information and model data sent by the terminal, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value, determines the credibility of the model data based on the device measurement value, the application measurement value and the module measurement value, and integrates the model data based on the credibility. The embodiment of the present application discards the model update parameters with low credibility, or reduces the weight of the model update parameters when integrating the model, so as to reduce the risk of negative impact on the integrated model caused by malicious model update parameters and reduce the possibility of poisoning the integrated model.

[0163] The model data sending device or data integration device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a palmtop computer, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA), etc., and the non-mobile electronic device can be a server, a network attached storage (Network Attached Storage, NAS), a personal computer (personal computer, PC), a television (television, TV), a teller machine or a self-service machine, etc., and the embodiment of the present application is not specifically limited.

[0164] The model data sending device or data integration device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0165] The model data sending device or model data integration device provided in the embodiment of the present application can achieve Figure 1 or Figure 3 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0166] Alternatively, if Figure 6 As shown, an embodiment of the present application also provides an electronic device 600, including a processor 601, a memory 602, and a program or instruction stored in the memory 602 and executable on the processor 601. When the program or instruction is executed by the processor 601, each process of the above-mentioned model data sending device or model data integration method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0167] It should be noted that the electronic devices in the embodiments of the present application include the mobile electronic devices and non-mobile electronic devices mentioned above.

[0168] Figure 7 A schematic diagram of the hardware structure of an electronic device to implement an embodiment of the present application.

[0169] The electronic device 700 includes but is not limited to: a radio frequency unit 701, a network module 702, an audio output unit 703, an input unit 704, a sensor 705, a display unit 706, a user input unit 707, an interface unit 708, a memory 709, and a processor 710.

[0170] Those skilled in the art will appreciate that the electronic device 700 may also include a power source (such as a battery) for supplying power to each component, and the power source may be logically connected to the processor 710 through a power management system, thereby implementing functions such as managing charging, discharging, and power consumption management through the power management system. Figure 7 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be described in detail here.

[0171] Among them, the processor 710 is used to obtain the device measurement value of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and add the device measurement value to the trusted root protection space; before loading the target application related to the training of the target model, measure the application measurement value of the target application, and add the application measurement value to the trusted root protection space; during the model training process, according to the execution order of the application modules associated with the training of the target model in the target application, obtain the module measurement value of the application module, and add the module measurement value to the trusted root protection space; based on the remote attestation method, send the trusted root information and the model data of the target model to the server, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value.

[0172] In the embodiment of the present application, during the process from terminal startup to application loading, all software modules loaded have their measurement values ​​measured by the measurement modules in the previous software modules before being loaded, and the measurement values ​​are placed in the protected storage space of the trusted root. This method prevents the loaded software modules (such as those modified maliciously) from tampering with their own measurement values, thereby reducing the possibility of data and model poisoning attacks on the cloud when integrating model parameters.

[0173] Optionally, the processor 710 is further used to, after the terminal is started, add a first device measurement value of the basic input and output system BIOS to the trusted root protection space based on the BIOS; measure a second device measurement value of the boot loader of the terminal based on the BIOS, and add the second device measurement value to the trusted root protection space; measure a third device measurement value of the system kernel of the terminal based on the boot loader, and add the third device measurement value to the trusted root protection space; measure a fourth device measurement value of the system service module of the terminal based on the system kernel, and add the fourth device measurement value to the trusted root protection space.

[0174] Optionally, the processor 710 is also used to, during the model training process, measure a first module measurement value of the data acquisition module of the target application based on the measurement module of the target application, and add the first module measurement value to the trusted root protection space; measure a second module measurement value of the model training module of the target application based on the data acquisition module, and add the second module measurement value to the trusted root protection space; measure a third module measurement value of the model data upload module of the target application based on the model training module, and add the third module measurement value to the trusted root protection space.

[0175] Optionally, the processor 710 is further configured to encrypt the trusted root information and the model data based on the public and private keys issued by the server to obtain encrypted information; and send the encrypted information to the server.

[0176] The embodiment of the present application encrypts the trusted root information based on the public and private keys issued by the server, thereby avoiding the risk of tampering during the model data transmission process, and further reducing the possibility of the cloud being attacked by data and model poisoning when integrating model parameters.

[0177] Optionally, the processor 710 is also used to receive trusted root information and model data sent by the terminal, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value; based on the device measurement value, the application measurement value and the module measurement value, the credibility of the model data is determined; based on the credibility, the model data is integrated and processed.

[0178] Optionally, the processor 710 is also used to determine whether the device measurement value is within a first preset range, whether the application measurement value is within a second preset range, and whether the module measurement value is within a third preset range; and determine the credibility of the model data based on the measurement value determination result.

[0179] Optionally, the processor 710 is further configured to, when the credibility is lower than a credibility threshold, reduce the weight of the model data and integrate the model data after the reduced weight; or, when the credibility is lower than a credibility threshold, discard the model data.

[0180] The embodiment of the present application discards the model update parameter or reduces the weight of the model update parameter when integrating the model, thereby reducing the risk of a malicious model update parameter having a negative impact on the integrated model and reducing the possibility of poisoning the integrated model.

[0181] It should be understood that in the embodiment of the present application, the input unit 704 may include a graphics processor (Graphics Processing Unit, GPU) 7041 and a microphone 7042, and the graphics processor 7041 processes the image data of the static picture or video obtained by the image capture device (such as a camera) in the video capture mode or the image capture mode. The display unit 706 may include a display panel 7061, and the display panel 7061 may be configured in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit 707 includes a touch panel 7071 and other input devices 7072. The touch panel 7071 is also called a touch screen. The touch panel 7071 may include two parts: a touch detection device and a touch controller. Other input devices 7072 may include but are not limited to a physical keyboard, a function key (such as a volume control button, a switch button, etc.), a trackball, a mouse, and a joystick, which will not be repeated here. The memory 709 can be used to store software programs and various data, including but not limited to applications and operating systems. The processor 710 can integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and applications, etc., and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 710.

[0182] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, each process of the above-mentioned model data sending method or model data integration method embodiment is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0183] The processor is a processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0184] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned model data sending method or model data integration method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0185] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0186] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0187] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0188] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A model data sending method, applied to a terminal, characterized in that: include: After the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space; Before loading a target application related to training of a target model, measuring an application metric value of the target application, and adding the application metric value to the trusted root protection space; In the process of model training, according to the execution order of the application modules associated with the training of the target model in the target application, the module measurement values ​​of the application modules are obtained, and the module measurement values ​​are added to the trusted root protection space; Based on the remote attestation method, the trusted root information and the model data of the target model are sent to the server, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value.

2. The method according to claim 1, characterized in that After the terminal is started, according to the execution order of each terminal module in the terminal, the device measurement value of each terminal module is obtained, and the device measurement value is added to the trusted root protection space, including: After the terminal is started, based on a basic input and output system BIOS, adding a first device measurement value of the BIOS to the trusted root protection space; Based on the BIOS, measure and obtain a second device measurement value of the boot loader of the terminal, and add the second device measurement value to the trusted root protection space; Based on the boot loader, measure and obtain a third device measurement value of the system kernel of the terminal, and add the third device measurement value to the trusted root protection space; Based on the system kernel, a fourth device measurement value of the system service module of the terminal is measured and obtained, and the fourth device measurement value is added to the trusted root protection space.

3. The method according to claim 1, characterized in that The method of acquiring module metrics of the application modules according to the execution order of the application modules associated with the training of the target model in the target application program during the model training, and adding the module metrics to the trusted root protection space includes: In the process of model training, based on the measurement module of the target application, a first module measurement value of the data acquisition module of the target application is measured, and the first module measurement value is added to the trusted root protection space; Based on the data acquisition module, measure and obtain a second module measurement value of the model training module of the target application, and add the second module measurement value to the trusted root protection space; Based on the model training module, a third module measurement value of the model data upload module of the target application is measured, and the third module measurement value is added to the trusted root protection space.

4. The method according to claim 1, characterized in that: The method of sending the trusted root information and the model data of the target model to the server based on the remote attestation method includes: Encrypting the trusted root information and the model data based on the public and private keys issued by the server to obtain encrypted information; The encrypted information is sent to the server.

5. A model data integration method, applied to a server, characterized in that: include: Receiving trusted root information and model data sent by a terminal, wherein the trusted root information is determined based on a device measurement value, an application measurement value, and a module measurement value; Determining the credibility of the model data based on the device metric value, the application metric value, and the module metric value; Based on the credibility, the model data is integrated.

6. The method according to claim 5, characterized in that The determining the credibility of the model data based on the device metric value, the application metric value and the module metric value comprises: Determining whether the device metric value is within a first preset range, whether the application metric value is within a second preset range, and whether the module metric value is within a third preset range; The credibility of the model data is determined according to the determination results of the device measurement value, the determination results of the application measurement value and the determination results of the module measurement value.

7. The method according to claim 5, characterized in that The integrating process of the model data based on the credibility includes: When the credibility is lower than the credibility threshold, reducing the weight of the model data, and integrating the model data after the reduced weight; or When the confidence level is lower than a confidence threshold, the model data is discarded.

8. A model data sending device, applied to a terminal, characterized in that: include: A device measurement value acquisition module, used for acquiring device measurement values ​​of each terminal module according to the execution order of each terminal module in the terminal after the terminal is started, and adding the device measurement values ​​to the trusted root protection space; An application metric value acquisition module, used for measuring the application metric value of the target application related to the training of the target model before loading the target application, and adding the application metric value to the trusted root protection space; A module metric value acquisition module, used for acquiring module metric values ​​of the application modules according to the execution order of the application modules associated with the training of the target model in the target application during the model training process, and adding the module metric values ​​to the trusted root protection space; A trusted root information sending module is used to send the trusted root information and the model data of the target model to the server based on a remote attestation method, wherein the trusted root information is determined based on the device measurement value, the application measurement value and the module measurement value.

9. A model data integration device, applied to a server, characterized in that: include: A model data receiving module, used to receive the trusted root information and model data sent by the terminal, wherein the trusted root information is determined according to the device measurement value, the application measurement value and the module measurement value; a credibility determination module, configured to determine the credibility of the model data based on the device metric value, the application metric value, and the module metric value; The model data integration module is used to integrate the model data based on the credibility.

10. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the model data sending method as described in any one of claims 1 to 4, or the steps of the model data integration method as described in any one of claims 5 to 7.

11. A readable storage medium, characterized in that: The readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the steps of the model data sending method described in any one of claims 1 to 4, or the steps of the data integration method described in any one of claims 5 to 7 are implemented.

Images