Private transfer learning

Abstract

An embodiment of a method for private transfer learning is disclosed. The method includes generating a machine learning model including a training application programming interface (API) and an inference API. The method also includes encrypting the machine learning model using a predetermined encryption mechanism. The method also includes copying the encrypted machine learning model to a trusted execution environment. The method also includes executing the machine learning model in the trusted execution environment using the inference API.

Description

Technical Field

[0001] The present disclosure relates to private transfer learning, and more particularly, to secure portable DNNs for private transfer learning. Background Art

[0002] A deep neural network (DNN) is a machine learning architecture. A machine learning architecture is a computer system, such as a machine, that can learn. One thing a machine can learn is how to classify items, for example, how to distinguish images of people from images of objects. Thus, a DNN can take an image as input and output a label for the image, which indicates whether the DNN classifies the image as a person or an object. The action of classifying an object through machine learning, such as a DNN model, is referred to herein as inference or forward transfer. In contrast, backward transfer involves training a DNN model, which is a computer program that learns to perform a predetermined classification. Training a DNN model to be accurate can be complex and therefore relies on relatively large amounts of data to learn how to perform common tasks, such as distinguishing images of people from images of objects.

[0003] Therefore, there is a need in the art to address the aforementioned problems. Summary of the invention

[0004] From various aspects, the present invention provides a computer-implemented method, computer program product, and system for private transfer learning, including: generating a machine learning model including a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; and executing the machine learning model in the trusted execution environment using at least one of the inference API and the training API.

[0005] From one aspect, the present invention provides a computer-implemented method for private transfer learning, comprising: generating a machine learning model including a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; and executing the machine learning model in the trusted execution environment using the inference API.

[0006] From one aspect, the present invention provides a computer program product, which includes program instructions stored on a computer-readable storage medium, wherein the computer-readable storage medium itself is not a temporary signal, and the program instructions can be executed by a processor to enable the processor to perform a method, the method comprising: generating a machine learning model including a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; and executing the machine learning model in the trusted execution environment using the training API.

[0007] From one aspect, the present invention provides a system comprising: a computer processing circuit; and a computer-readable storage medium storing instructions, which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising: generating a machine learning model comprising a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; executing the machine learning model in the trusted execution environment using the training API; and executing the machine learning model trained by the training API using the inference API.

[0008] From one aspect, the present invention provides a system comprising: a computer processing circuit; a graphics processing circuit (GPU); and a computer-readable storage medium storing instructions, which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising: generating a machine learning model comprising a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; executing the machine learning model in the trusted execution environment by executing the training API on the GPU; and executing the machine learning model trained by the training API by executing the inference API on the GPU.

[0009] From one aspect, the present invention provides a computer-implemented method for private transfer learning, comprising: generating a machine learning model including a training application programming interface (API) and an inference API; encrypting the machine learning model using a predetermined encryption mechanism; copying the encrypted machine learning model to a trusted execution environment; and executing the machine learning model in the trusted execution environment using the training API.

[0010] Viewed from another aspect, the present invention provides a computer program product for private transfer learning, the computer program product comprising a computer-readable storage medium readable by a processing circuit and storing instructions executable by the processing circuit to perform a method for performing the steps of the present invention.

[0011] Viewed from another aspect, the invention provides a computer program stored on a computer readable medium and loadable into the internal memory of a digital computer, comprising software code portions for performing the steps of the invention when the program is run on a computer.

[0012] Embodiments of a method for private transfer learning are disclosed. The method includes generating a machine learning model including a training application programming interface (API) and an inference API. The method also includes encrypting the machine learning model using a predetermined encryption mechanism. The method also includes copying the encrypted machine learning model to a trusted execution environment. The method also includes executing the machine learning model in the trusted execution environment using the inference API.

[0013] Further aspects of the disclosure relate to systems and computer program products having functionality similar to that discussed above with respect to the computer-implemented methods.This summary is not intended to illustrate every aspect, every implementation, and / or every embodiment of each embodiment of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The accompanying drawings included in this application are incorporated into the specification and form a part of the specification. They illustrate embodiments of the present disclosure and are used to explain the principles of the present disclosure together with the specification. The accompanying drawings only illustrate certain embodiments and do not limit the present disclosure.

[0015] Figure 1 is a block diagram of a system for private transfer learning according to some embodiments of the present disclosure.

[0016] Figure 2 is a block diagram of a system for private transfer learning according to some embodiments of the present disclosure

[0017] Figure 3 is a data flow diagram of a process for private transfer learning according to an embodiment of the present disclosure.

[0018] Figure 4 is a flow chart of an example method for private transfer learning according to some embodiments of the present disclosure.

[0019] Figure 5 is a block diagram of an example classification chart digitization (CCD) manager according to some embodiments of the present disclosure.

[0020] Figure 6 A cloud computing environment according to some embodiments of the present disclosure is shown.

[0021] Figure 7 Abstract model layers according to some embodiments of the present disclosure are shown.

[0022] Although the present disclosure may be modified into various modifications and alternative forms, the details thereof have been shown by way of example in the accompanying drawings and will be described in detail. However, it should be understood that the purpose is not to limit the present disclosure to the specific embodiments described. On the contrary, the present invention will cover all modifications, equivalents and substitutes that fall within the spirit and scope of the present disclosure. DETAILED DESCRIPTION

[0023] DNN is a machine learning software architecture with multiple layers between input and output. DNN can mathematically transform input into output using the relevant parameters of the input and the associated weights that DNN learns to manipulate. During the training phase, DNN can process a relatively large number of labeled inputs and learn to manipulate the weights of various parameters to transform input into output that matches the label. These mathematical modifications can represent various types of mathematical relationships, including linear and nonlinear. In this way, DNN can generate a general DNN model.

[0024] Transfer learning is useful for developing a general DNN model into a model that performs a more specific task. For example, given a general DNN model that distinguishes images of people from objects, transfer learning can develop a model that distinguishes images of baseball games from images of cricket games. Performing transfer learning can involve a relatively small amount of training data compared to the training data for the general DNN model. For example, training a general DNN model to distinguish people from objects may involve tens of thousands of labeled inputs. In contrast, developing a general model into a transfer learning model that distinguishes images of baseball games from images of cricket games may involve less than fifty labeled inputs. In this way, transfer learning provides the advantage of reducing costs and resources compared to other machine learning techniques. Therefore, transfer learning can build valuable DNN models that perform relatively highly specific tasks from relatively highly trained general DNN models. However, having such highly trained general DNN models that can be developed to perform relatively highly specific tasks may imply security issues to prevent unauthorized users, thieves, and / or other malicious actors from using them.

[0025] A trusted execution environment can provide a secure enclave on a host computer system where sensitive or controlled programs can run without unauthorized introspection (viewing) or copying. In fact, a trusted execution environment can even protect controlled programs from privileged administrators and processes on the computer hosting the trusted execution environment.

[0026] Therefore, embodiments of the present disclosure can control the dissemination and use of highly trained general DNN models. In this way, embodiments can allow: using general DNN models for inference in an unmodified form, and developing general DNN models as transfer learning models with task-specific training. In contrast to forward transfer, the action of training a machine learning model is also referred to as reverse transfer in this article. Embodiments of the present disclosure can therefore encapsulate DNN models using encryption that cannot be opened outside a trusted execution environment. In some embodiments, the code for the architecture, weights, and biases of the DNN is encapsulated with two application programming interface (API) functions. One of the API functions performs inference on unlabeled inputs. Therefore, data is input without labels for forward transfer through the DNN. Another API function trains a general DNN model. Therefore, data is input with labels for reverse transfer through the general DNN model.

[0027] Figure 1 is a block diagram of a system 100 for private transfer learning according to some embodiments of the present disclosure. The system 100 includes a secure area 102 having a pre-trained model 104, an inference API 106-1, and a training API 106-2. The secure area 102 can be a predetermined portion of the system memory of a computer device (not shown) reserved for secure operations, i.e., a trusted execution environment (TEE).

[0028] According to some embodiments, the system 100 can be used to control the propagation and use of a trained deep neural network model, i.e., a pre-trained model 104. The system 100 can allow the use of the pre-trained model 104 for inference in an unmodified form, and allow the pre-trained model 104 to be customized through task-specific training. In addition, the system 100 can provide these advantages while maintaining control over how the pre-trained model 104 is used and / or propagated. In the system 100, the pre-trained model 104 can be suitable for training by one or more users, which can use private input from one or more parties to provide training or refinement.

[0029] The secure area 102 may include a key (not shown) that is restricted to use within the secure area 102. Secure operations may be performed by a computer application running in the secure area 102. To make these operations secure, the instructions of the computer application are encrypted with the key and written to memory locations in the secure area 102. Additionally, the instructions are read from these memory locations and decrypted with the key before being executed by a processor (not shown). Thus, a malicious actor, such as a hacker, attempting to read the instructions of the secure operation from the secure area 102 is restricted to reading the encrypted instructions. Without the key, the malicious actor cannot determine the actual instructions, and thus the operation may be secure.

[0030] For example, the pre-trained model 104 may be a computer application running in the secure area 102. According to some embodiments, the pre-trained model 104 may be a DNN model trained to perform a general purpose task. In addition, the pre-trained model 104 may be encrypted before being copied to the secure area 102. This involves an additional level of encryption to the key encryption described above with respect to the secure area 102. In some embodiments, the manufacturer of the pre-trained model may encrypt the code for the architecture, weights, and biases of the pre-trained model 104 in an encrypted distribution blob with two API functions, the two API functions being the inference API 106-1 and the training API 106-2. The data introduced with labels may be input to the inference API 106-1 for back propagation through the pre-trained model 104. The data without the introduction of labels may be input to the training API 106-2 for forward propagation through the pre-trained model 104. In this way, the system 100 can provide a deep neural network for use with encryption that is restricted to be opened inside the TEE.

[0031] By exposing only two APIs outside of the secure area 102, the pre-trained model 104 can be used as intended and customized for user-specific tasks and data sets. However, the pre-trained model 104 cannot be copied outside the secure area 102 for uncontrolled dissemination to unlicensed users, modified in a manner beyond a predetermined scope, or used after a predetermined shelf life, after which the user can be incentivized to download an updated version of the pre-trained model 104.

[0032] As will be appreciated by one of ordinary skill in the art, a deep neural network may operate more efficiently on a graphics processing unit (GPU) than on a central processing unit (CPU). However, a trusted execution environment may not include a GPU inside the secure area 102. Thus, data may be sent to the GPU outside the secure area 102 for training and / or inference (in the case of a relatively large pre-trained model 104). Thus, in some embodiments, the secure area 102 may include one or more GPUs. Additionally, the pre-trained model 104 may be configured to prohibit operation in a virtualized GPU environment (where the GPU memory may be introspected by malicious actors outside the TEE). It may also be helpful to include a random reordering of batch computations in the pre-trained model 104 to make it more difficult for malicious actors to infer model parameters from the GPU memory.

[0033] Figure 22 is a block diagram of a system 200 for private transfer learning according to some embodiments of the present disclosure. The system 200 includes a TEE 202 and an execution environment 204. As previously described, a secure area may be referred to as a TEE. Additionally, the term TEE may refer to a larger group of dedicated memory elements, such as TEE 202. In the system 200, the TEE 202 includes a secure area 206, which may be similar to the TEE described with respect to FIG. Figure 1 As depicted with secure enclave 102 , TEE 202 may also include additional memory elements, such as cryptographic keys (not shown) for secure enclave 206 .

[0034] The execution environment 204 may be a dedicated group of memory elements that store computer processor instructions. In contrast to the trusted execution environment 202 and the secure enclave 206, the execution environment 204 may be open, meaning that memory locations may be read by malicious users, etc. The execution environment 204 may include a programming environment 210, which may be a portion of the execution environment 204, in which the DNN codec platform may execute. The DNN codec platform may refer to a computer software architecture in which data scientists, for example, may build, test, and run models such as the DNN model 208. Thus, the programming environment 210 may include computer applications that invoke execution of the DNN model 208 in the secure enclave 206 of the trusted execution environment 202 by making calls to the forward pass (inference) API 212-1 and the backward pass (training) API 212-2.

[0035] The security zone 206 may include a DNN model 208, which may be similar to the Figure 1 The described pre-trained model 104. Return to reference Figure 2 , DNN model 208 can be, for example, a relatively large convolutional DNN model that is trained for object recognition of relatively small objects within a relatively large image. Such DNN models are useful in hyperspectral satellite photography, where a relatively large range of the electromagnetic spectrum is captured in images of the earth from satellites. Thousands of GPU hours may be spent training these models to achieve relatively high levels of accuracy. Training such models can also consume considerable financial expenses. In addition, the architecture of DNN model 208 may use valuable advanced proprietary technologies that are not widely known, and therefore may imply security constraints to prevent corporate or other types of espionage.

[0036] In another example, the DNN model 208 may be a relatively large language model trained for predictive text generation. Predictive text generation refers to a technique in which a key or button can represent multiple characters, such as on a numeric keypad of a mobile computing device. In this way, each selection of a key can result in a prediction of the word the user is typing. Therefore, the user can select a predicted word based on a few key selections, rather than typing the entire word. Predictive text generation may also incorporate proprietary architecture techniques and may take thousands of processing hours to train. Such a DNN model 208 may be further trained with relatively little training time to perform more complex tasks, such as question answering, grammatical analysis, text summarization, and report generation on a relatively wide range of topics. In addition, through additional training, the range of topics may be made even wider in a specific field. Such a DNN model 208 may provide relatively large financial value, which may be destroyed if the DNN model 208 is leaked into a public space where the DNN model 208 can be copied without providing any compensation to the generator of the DNN model 208. Therefore, embodiments of the present disclosure may protect the DNN model 208 from such a situation.

[0037] Because the forward pass API 212-1 and the reverse pass API 212-2 are executed within the secure area 206 of the trusted execution environment 202, any call to execute these APIs 212 from the unsecure execution environment 204 is verified as having the permission to call the API call to avoid the DNN model 208 from being executed by malicious actors. Therefore, the API includes authentication and authorization based on certificates programmed into the encrypted executable file of the DNN model 208. This allows fine-grained control over how the DNN model 208 is used, by whom, how much, and in what specific way. Therefore, the API 212 can include access controls that allow for limiting the training and inference use of the DNN model 208. In addition, these access controls can provide telemetry that can provide audit and performance metrics about the DNN model 208 back to the provider of the DNN model 208. In this way, the DNN model 208 can be suitable for distribution to other parties without the risk of the model being introspected (absent state-sponsored attacks). In some embodiments, the DNN model 208 can be licensed according to different sets of usage permissions. Therefore, the use of the API can be limited according to these permissions. For example, the use can be limited to executing the reverse transfer API 212-2 or allowed for both APIs 212. The use can also be allowed for a predetermined period of time.

[0038] In some embodiments, use of the DNN model 208 may also include hyperparameter tuning. With hyperparameter tuning, the forward pass API 212-1 may allow a DNN model user to define a selection of parameters that configure the manner in which the DNN model 208 learns. Hyperparameters may include optimization algorithms, such as ADAM and single cycle, learning rate, number of training epochs, layer locking, and the like.

[0039] In some embodiments, the use of the DNN model 208 may allow for the selection of more than one possible architectural variant of the DNN model 208. For example, the body of the DNN model 208 may be used together with another DNN model head for multi-category or single-category classification. The body of the DNN model 208 may refer to a portion of the model logic. The model logic may be arranged in layers, wherein the first layer includes the initial logic of the DNN model 208, and the last layer includes the final logic. Therefore, the head of the DNN model may refer to the last layer or the last few layers of the DNN model logic. In some embodiments, the architectural variant may involve re-planning the DNN model 208 from a generated DNN to a classifier. A generated DNN refers to a DNN model that generates labeled inputs for a classified DNN. A classified DNN refers to a DNN model that labels (e.g., classifies) inputs. In some embodiments, these and other potential architectural variants may be selectable within the forward pass API 212-1 and the reverse pass API 212-2.

[0040] In some embodiments, the system 200 can be integrated with existing DNN codec platforms (e.g., PyTorch and Tensorflow). In this way, the system 200 can allow the DNN model 208 to be more easily packaged into encrypted distribution blocks. In addition, integrating the system 200 with existing DNN codec platforms can also enable data scientists to perform inference and training on the DNN model 208 more efficiently by using the same codec environment and commands they are already accustomed to.

[0041] Figure 3 304. The present disclosure provides a data flow diagram of a process 300 for private transfer learning according to an embodiment of the present disclosure. In process 300, a model owner development environment 302 is used to generate a machine learning (ML) model 304. Model owner development environment 302 can be a private, secure computer hardware and software architecture configured to enable data scientists and software engineers to build and train machine learning models, such as machine learning model 304. Machine learning model 304 can be one of various types of machine learning models, ranging from relatively simple algorithms to DNN models, such as those related to Figure 2 Described DNN model 208.

[0042] Return to reference Figure 3, the model owner can use encryption to generate a crypto blob 306 from the machine learning model 304. The crypto blob 306 can be signed and managed according to the Opal standard. The Opal standard refers to a group of security-related specifications for electronic storage devices such as disk drives. For example, these specifications can define encryption methods for stored data that prevent unauthorized users from controlling the device or viewing the data stored thereon. Encryption can be provided by a public-private key infrastructure (PKI), attestation, etc. In a PKI, a public key shared between two users can be used with an encrypted private key to ensure that authorized users can access secure files, such as the machine learning model 304. Attestation can involve the use of public hashtags and clearinghouse signatures to confirm the integrity of computer applications (such as the machine learning model 304, etc.). Attestation can be used as a workaround for potentially maliciously encoded computer instructions within a secure area (such as the secure area 206).

[0043] Return to reference Figure 3 , the model owner can store the confidentiality block 306 in a cloud storage system 308, which can host a library of machine learning models that are encrypted into a plurality of confidentiality blocks 306. In addition, to obtain access to machine learning models from the library, the customer can subscribe to a selected model, such as machine learning model 304. From the cloud storage system 308, the confidentiality block 306 can be copied to a data owner development environment 310. The data owner development environment 310 can be a trusted execution environment such as TEE 202. The data owner development environment 310 can include a secure area 312 and an API 314. The secure area 312 can be similar to the secure area 312 described with respect to Figure 2 The security area 206 described, API 314 may be similar to the Figure 2 As described in the API 212, the secure area 312 may include the machine learning model 304 and the loader with the private key 316. Therefore, the secure area 312 has the key required to decrypt the security block 306. In an embodiment of the present disclosure, the loader with the private key 316 can decrypt the security block 306 to generate the machine learning model 304 and the API 314. In addition, the secure area 312 can use its own key (not shown) to encrypt the instructions of the machine learning model 304 and the API 314 before writing them to the memory location of the secure area 312.

[0044] When running in the secure enclave 312, the machine learning model 304 is still stored in encrypted memory, which is not readable by privileged users such as administrators and root users. The secure enclave 312 also prevents memory bus probing attacks because only encrypted data is passed along the bus from the secure enclave 312. In this way, exposing only the API 314 to users can ensure that the machine learning model 304 cannot be misused or distributed without authorization.

[0045] Figure 4 is a flow chart of an exemplary method 400 for private transfer learning according to some embodiments of the present disclosure. At block 402, a machine learning model may be generated, such as Figure 3 The machine learning model 304 described herein may include a training application programming interface (API) and an inference API. The model owner may generate the machine learning model 304 in a model owner development environment, such as a reference Figure 3 A model owner development environment 302 is described.

[0046] Return to reference Figure 4 At block 404, a predetermined encryption mechanism may be used to encrypt the machine learning model 304. For example, the encryption mechanism may include a public-private key infrastructure or a certificate.

[0047] At block 406, the encrypted machine learning model may be copied to a reference Figure 2 In a trusted execution environment such as the trusted execution environment 202 described above, the encrypted machine learning model may be a reference Figure 3 A security block such as the security block 306 described above.

[0048] Return to reference Figure 4 At block 408, the machine learning model may be executed in the trusted execution environment using an inference API or a training API. As previously described, the inference API may be used to classify objects input to the machine learning model. Additionally, the training API may be used to further refine the training of the machine learning model to a more specific task than the general task for which the model owner has trained the machine learning model.

[0049] Reference now Figure 5 , a block diagram of an example private transfer learning manager 500 according to some embodiments of the present disclosure is shown. In various embodiments, the private transfer learning manager 500 is similar to the private transfer learning manager 214 and can execute Figure 4 The methods described in and / or Figure 1-3In some embodiments, the private transfer learning manager 500 provides instructions for the aforementioned methods and / or functionality to the client so that the client machine can perform the method or a portion of the method based on the instructions provided by the private transfer learning manager 500. In some embodiments, the private transfer learning manager 500 includes software executed on hardware incorporated into multiple devices.

[0050] Private transfer learning manager 500 includes memory 525 , storage 530 , interconnect (eg, bus) 520 , one or more CPUs 505 (also referred to herein as processors 505 ), I / O device interface 510 , I / O device 512 , and network interface 515 .

[0051] Each CPU 505 retrieves and executes programming instructions stored in memory 525 or storage device 530. Interconnect 520 is used to move data, such as programming instructions, between CPU 505, I / O device interface 510, storage device 530, network interface 515 and memory 525. Interconnect 520 can be implemented using one or more buses. In various embodiments, CPU 505 can be a single CPU, multiple CPUs, or a single CPU with multiple processing cores. In some embodiments, CPU 505 can be a digital signal processor (DSP). In some embodiments, CPU 505 includes one or more 3D integrated circuits (3DIC) (e.g., 3D wafer level packaging (3DWLP), 3D interposer-based integration, 3D stacked IC (3D-SIC), monolithic 3D IC, 3D heterogeneous integration, 3D system-level packaging (3DSiP) and / or package-on-package (PoP) CPU configuration). Memory 525 is generally included to represent random access memory (e.g., static random access memory (SRAM), dynamic random access memory (DRAM) or flash memory). Memory 530 is generally included to represent non-volatile memory, such as a hard drive, a solid-state device (SSD), a removable memory card, an optical memory, and / or a flash memory device. Additionally, storage 530 may include a storage area network (SAN) device, a cloud, or other device connected to private transfer learning manager 500 via I / O device interface 510 or to network 550 via network interface 515.

[0052] In some embodiments, memory 525 stores instructions 560. However, in various embodiments, instructions 560 are stored partially in memory 525 and partially in storage 530, or instructions 560 are stored entirely in memory 525, or instructions 560 are stored entirely in storage 530, or instructions 560 are accessed over network 550 via network interface 515.

[0053] Instruction 560 may be used to execute Figure 4 Any method and / or Figure 1-3 Processor executable instructions that may include any or all of the functionality discussed in .

[0054] In various embodiments, the I / O device 512 includes an interface capable of presenting information and receiving input. For example, the I / O device 512 can present information to a listener interacting with the private transfer learning manager 500 and receive input from the listener.

[0055] The private transfer learning manager 500 is connected to a network 550 via a network interface 515. The network 550 may include a physical, wireless, cellular, or different network.

[0056] In some embodiments, the private transfer learning manager 500 can be a multi-user mainframe computer system, a single-user system, or a server computer or similar device with little or no direct user interface but receives requests from other computer systems (clients). In addition, in some embodiments, the private transfer learning manager 500 can be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a phone, a smart phone, a network switch or router, or any other suitable type of electronic device.

[0057] Notice, Figure 5 The following is intended to depict representative major components of an exemplary private transfer learning manager 500. However, in some embodiments, the various components may have more Figure 5 The greater or lesser complexity represented in , may exist different from Figure 5 Components may be those shown in or in addition to those shown in, and the number, type, and configuration of these components may vary.

[0058] Although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings set forth herein is not limited to a cloud computing environment. Instead, the embodiments of the present disclosure can be implemented in conjunction with any other type of computing environment now known or later developed.

[0059] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the provider of the service. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0060] Features are as follows:

[0061] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring manual interaction with the provider of the service. Wide area network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0062] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is a sense of location independence, as consumers typically do not control or know the exact location of the provided resources, but are able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0063] Rapid elasticity: In some cases, the ability to scale out quickly and in quickly can be provisioned quickly and elastically. To the consumer, the capacity available for provisioning often appears to be unlimited and can be purchased in any quantity at any time.

[0064] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0065] The service model is as follows:

[0066] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on the cloud infrastructure. The applications are accessible from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0067] Platform as a Service (PaaS): The capability provided to consumers is to deploy consumer-created or acquired applications onto cloud infrastructure, where the applications are created using programming languages ​​and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possible configuration of the application hosting environment.

[0068] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0069] The deployment model is as follows:

[0070] Private Cloud: The cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0071] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0072] Public cloud: Cloud infrastructure is available to the general public or large industrial groups and is owned by an organization that sells cloud services.

[0073] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community or public) that remain a unique entity but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0074] The cloud computing environment is service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure consisting of a network of interconnected nodes.

[0075] Reference now Figure 6 , which depicts a cloud computing environment 610 according to some embodiments of the present disclosure. As shown in the figure, the cloud computing environment 610 includes one or more cloud computing nodes 600. The cloud computing node 600 can execute Figure 4 The methods described in and / or Figure 1-3 . In addition, cloud computing nodes 600 can communicate with local computing devices used by cloud consumers, such as personal digital assistants (PDAs) or cellular phones 600A, desktop computers 600B, laptop computers 600C, and / or automotive computer systems 600N. In addition, cloud computing nodes 600 can communicate with each other. Cloud computing nodes 600 can also be physically or virtually grouped (not shown) in one or more networks, such as the private clouds, community clouds, public clouds, or hybrid clouds described above, or combinations thereof. This allows cloud computing environment 610 to provide infrastructure, platforms, and / or software as a service for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 6 The types of computing devices 600A-N shown in are intended for illustration only, and computing node 600 and cloud computing environment 610 may communicate with any type of computing device over any type of network and / or network addressable connection (eg, using a web browser).

[0076] Reference now Figure 7 , showing a cloud computing environment 610 ( Figure 6 ) provides a set of functional abstract model layers. It should be understood in advance that Figure 7 The components, layers and functions shown in are intended to be illustrative only, and the embodiments of the present disclosure are not limited thereto. As described below, the following layers and corresponding functions are provided.

[0077] The hardware and software layer 700 includes hardware and software components. Examples of hardware components include: host 702; server 704 based on RISC (Reduced Instruction Set Computer) architecture; server 706; blade server 708; storage device 710; and network and networking components 712. In some embodiments, software components include network application server software 714 and database software 716.

[0078] Virtualization layer 720 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 722 ; virtual storage 724 ; virtual networks 726 , including virtual private networks; virtual applications and operating systems 728 ; and virtual clients 730 .

[0079] In one example, the management layer 740 may provide the functionality described below. Resource provisioning 742 provides dynamic procurement of computing resources and other resources that are utilized to perform tasks within a cloud computing environment. Metering and pricing 744 provides cost tracking when utilizing resources within a cloud computing environment, as well as billing or valuation for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 746 provides access to the cloud computing environment for consumers and system administrators. Service level management 748 provides cloud computing resource allocation and management so that the required service levels are met. Service level management 748 can allocate appropriate processing power and memory to process static sensor data. Service level agreement (SLA) planning and fulfillment 750 provides pre-arrangement and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0080] Workload layer 760 provides examples of functionality that can take advantage of a cloud computing environment. Examples of workloads and functionality that can be provided from this layer include: mapping and navigation 762; software development and lifecycle management 764; virtual classroom education delivery 766; data analytics processing 768; transaction processing 770; and private transport learning manager 772.

[0081] The present disclosure may be a system, method and / or computer program product at any possible level of technical detail integration. A computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform aspects of the present disclosure.

[0082] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0083] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0084] The computer-readable program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform aspects of the present disclosure.

[0085] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart and / or block diagram and the combination of blocks in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0086] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0087] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0088] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure.In this regard, each frame in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, the two frames shown in succession can actually be implemented as a step, and are performed simultaneously, substantially simultaneously, in a partially or entirely time-overlapping manner, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of each frame of the block diagram and / or flow chart illustration and the frame in the block diagram and / or flow chart illustration can be implemented by a dedicated hardware-based system that performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

Claims

1. A computer-implemented method for private transfer learning, comprising: Generate machine learning models including training API and inference API; encrypting the machine learning model using a predetermined encryption mechanism; Copying the encrypted machine learning model to a trusted execution environment; and executing the machine learning model in the trusted execution environment using at least one of the training API and the inference API, Among them, the training API and the inference API include authentication and authorization based on certificates programmed into the encrypted executable file of the machine learning model to allow control over how the machine learning model is used, by whom, how much, and in what specific way, and the certificate is used to authenticate calls to the training API and the inference API from an untrusted execution environment.

2. The method according to claim 1, wherein: The machine learning model includes a deep neural network DNN model.

3. The method according to claim 2, wherein: The DNN model is trained to perform general tasks.

4. The method according to claim 3, wherein: The training API trains the DNN model to perform a task that refines the general task into a task that is more specific than the general task.

5. The method according to any one of the preceding claims, further comprising: A combination of a body of the machine learning model and a header of an additional machine learning model is generated in the trusted execution environment. The method of claim 5 , further comprising executing an inference API on the combination. The method of claim 5 , further comprising executing the training API on the combination.

8. A system for private transfer learning, the system comprising: Computer processing circuits; as well as A computer-readable storage medium storing instructions which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising: Generate machine learning models including training API and inference API; encrypting the machine learning model using a predetermined encryption mechanism; Copying the encrypted machine learning model to a trusted execution environment; executing the machine learning model in the trusted execution environment using the training API; and Execute the machine learning model trained by the training API using the inference API, Among them, the training API and the inference API include authentication and authorization based on certificates programmed into the encrypted executable file of the machine learning model to allow control over how the machine learning model is used, by whom, how much, and in what specific way, and the certificate is used to authenticate calls to the training API and the inference API from an untrusted execution environment.

9. The system according to claim 8, wherein: The machine learning model includes a deep neural network DNN model.

10. The system according to claim 9, wherein: The DNN model is trained to perform general tasks.

11. The system according to claim 10, wherein: The training API trains the DNN model to perform a task that refines the general task into a task that is more specific than the general task.

12. The system according to any one of claims 8 to 11, the method further comprising: A combination of a body of the machine learning model and a header of an additional machine learning model is generated in the trusted execution environment.

13. The system of claim 12, the method further comprising executing the inference API on the combination.

14. The system of claim 12, the method further comprising executing the training API on the combination.

15. A system according to any one of claims 8 to 11, wherein: Executing the machine learning model in the trusted execution environment using the training API includes executing the training API on a graphics processing circuit (GPU); as well as Executing the machine learning model trained by the training API using the inference API includes executing the inference API on the GPU.

Images