A model encryption method and device based on structural confusion, equipment and medium

Abstract

The application discloses a model encryption method and device based on structure confusion, equipment and medium, obtains a neural network model to be encrypted, determines a structure layer to be confused in the neural network model; generates a confusion layer corresponding to the structure layer, randomly generates a confusion matrix of the confusion layer; the parameter matrix of the structure layer is confused and operated by using the confusion matrix, an encrypted parameter matrix is obtained, and a structure file and a parameter file of the neural network model are saved, wherein the structure file comprises the structure layer and the confusion layer, and the parameter file comprises the encrypted parameter matrix and the confusion matrix. The purpose of hiding the structure and parameters of the original neural network model is achieved, so that an external user cannot directly use the model file in plaintext even through various means, thereby enhancing the security of the neural network model.

Description

Technical Field

[0001] This application relates to the field of model encryption technology, and in particular to a model encryption method, apparatus, device and medium based on structural obfuscation. Background Technology

[0002] In recent years, thanks to the continuous development of artificial intelligence (AI) technology, various AI products have been widely used in areas such as payment, risk control, security, and autonomous driving. With the popularization of AI applications, a more convenient and efficient user experience has become a pursuit. Therefore, based on traditional cloud services, AI is increasingly being directly applied to the edge, completing all model loading and inference calculations directly on terminal devices. However, this has also brought a series of risks and challenges, among which how to protect the security of edge models is one of the issues of great concern.

[0003] Unlike cloud service models, terminal devices are more open and easier to debug and analyze. Especially in user-facing scenarios, any user can download models to their local device via an app, which means that effective encryption protection of model information is essential to prevent leakage. Regarding model encryption protection schemes, existing schemes are generally extensions of traditional cryptography, treating model information as files and encrypting it with a key, then decrypting it only when needed on the terminal device.

[0004] In key-based model encryption schemes, the encryption key is susceptible to theft. Encrypted model files require decryption by the terminal device during use, inevitably necessitating the use of the decryption key. Malicious actors could attempt to crack and steal the key using decompilation, debugging, or other methods, ultimately obtaining the plaintext model file. Therefore, existing model encryption schemes still suffer from relatively poor security. Summary of the Invention

[0005] This application provides a model encryption method, apparatus, device, and medium based on structural obfuscation to address the problem of poor security in existing model encryption schemes.

[0006] This application provides a model encryption method based on structural obfuscation, the method comprising:

[0007] Obtain the neural network model to be encrypted, and determine the structural layers to be obfuscated in the neural network model;

[0008] Generate a confusion layer corresponding to the structure layer, and randomly generate a confusion matrix for the confusion layer;

[0009] The parameter matrix of the structural layer is obfuscated using the obfuscation matrix to obtain an encrypted parameter matrix. The structure file and parameter file of the neural network model are then saved. The structure file includes the structural layer and the obfuscated layer, and the parameter file includes the encrypted parameter matrix and the obfuscation matrix.

[0010] Further, the step of generating a confusion layer corresponding to the structural layer, and randomly generating the confusion matrix of the confusion layer, includes:

[0011] A confusion layer with the same scale as the structural layer is generated, a confusion matrix of the confusion layer is randomly generated, and the parameter matrix of the structural layer and the confusion matrix are concatenated.

[0012] Further, the step of performing a confusion operation on the parameter matrix of the structural layer using the confusion matrix to obtain the encryption parameter matrix includes:

[0013] The XOR operation is used as the obfuscation operation of the obfuscation matrix. The obfuscation matrix is ​​then used to perform an XOR operation on the parameter matrix of the structural layer to obtain the encryption parameter matrix.

[0014] Furthermore, during the training phase of the neural network model, the confusion matrix is ​​not involved in the computation, and iterative updates are not performed on the confusion matrix.

[0015] Furthermore, the structure file and parameter file for saving the neural network model include:

[0016] The binary streams of the structural layer and the obfuscation layer of the neural network model are encrypted and saved to a structure file. The encryption parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer are encrypted and saved to a parameter file.

[0017] Furthermore, the method also includes:

[0018] During the loading phase of the neural network model, the structure file and parameter file are decrypted to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; the obfuscation matrix is ​​used to perform an inverse obfuscation operation on the encryption parameter matrix to obtain the parameter matrix of the structure layer.

[0019] Furthermore, the decryption of the structure file and parameter file respectively includes:

[0020] If the decryption key is stored in a distributed manner, the distributed key segments are restored to obtain the decryption key, and the decryption key is used to decrypt the structure file and parameter file respectively.

[0021] On the other hand, this application provides a model encryption device based on structural obfuscation, the device comprising:

[0022] The acquisition module is used to acquire the neural network model to be encrypted and determine the structural layers to be obfuscated in the neural network model;

[0023] A generation module is used to generate a confusion layer corresponding to the structural layer and to randomly generate a confusion matrix for the confusion layer.

[0024] An encryption module is used to perform an obfuscation operation on the parameter matrix of the structural layer using the obfuscation matrix to obtain an encrypted parameter matrix, and to save the structure file and parameter file of the neural network model, wherein the structure file includes the structural layer and the obfuscation layer, and the parameter file includes the encrypted parameter matrix and the obfuscation matrix.

[0025] Furthermore, the generation module is specifically used to generate a confusion layer with the same scale as the structural layer, randomly generate a confusion matrix of the confusion layer, and concatenate the parameter matrix of the structural layer and the confusion matrix.

[0026] Furthermore, the encryption device is specifically used to perform an XOR operation as the obfuscation operation of the obfuscation matrix, and to perform an XOR operation on the parameter matrix of the structural layer using the obfuscation matrix to obtain the encryption parameter matrix.

[0027] Furthermore, the encryption module is specifically used to encrypt the binary streams of the structural layer and the obfuscation layer of the neural network model and save them to a structure file, and to encrypt the encryption parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer and save them to a parameter file.

[0028] Furthermore, the device also includes:

[0029] The loading module is used to decrypt the structure file and parameter file respectively during the loading stage of the neural network model to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; and to perform an inverse obfuscation operation on the encryption parameter matrix using the obfuscation matrix to obtain the parameter matrix of the structure layer.

[0030] Furthermore, the loading module is specifically used to restore the scattered key segments if the decryption key is stored in a distributed manner, to obtain the decryption key, and to decrypt the structure file and parameter file respectively using the decryption key.

[0031] In another aspect, this application provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0032] Memory, used to store computer programs;

[0033] When a processor executes a program stored in memory, it implements the steps of the method described in any of the preceding statements.

[0034] In another aspect, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in any of the above claims.

[0035] This application provides a model encryption method, apparatus, device, and medium based on structural obfuscation. The method includes: acquiring a neural network model to be encrypted and determining the structural layers to be obfuscated in the neural network model; generating an obfuscation layer corresponding to the structural layer and randomly generating an obfuscation matrix of the obfuscation layer; performing obfuscation operations on the parameter matrix of the structural layer using the obfuscation matrix to obtain an encrypted parameter matrix; and saving the structure file and parameter file of the neural network model, wherein the structure file includes the structural layer and the obfuscation layer, and the parameter file includes the encrypted parameter matrix and the obfuscation matrix.

[0036] The above technical solution has the following advantages or beneficial effects:

[0037] This application obfuscates the structure of a neural network model, including adding obfuscation layers and randomly generating obfuscation matrices for these layers. The obfuscation matrices are then used to obfuscate the parameter matrices of the structural layers. This achieves the goal of hiding the original structure and parameters of the neural network model, making it impossible for external users to directly use the plaintext model file even if they obtain it through various means, thus enhancing the security of the neural network model. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A schematic diagram of the encryption process based on structural obfuscation provided in this application;

[0040] Figure 2 A schematic diagram of the model saving process provided in this application;

[0041] Figure 3 A schematic diagram of the loading model process provided in this application;

[0042] Figure 4 A schematic diagram of the structure of the model encryption device based on structural obfuscation provided in this application;

[0043] Figure 5 A schematic diagram of the electronic device structure provided in this application. Detailed Implementation

[0044] To make the objectives and implementation methods of this application clearer, the exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings of the exemplary embodiments of this application. Obviously, the exemplary embodiments described are only some embodiments of this application, and not all embodiments.

[0045] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0046] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0047] The terms “comprising” and “having”, and any variations thereof, are intended to cover but not exclude inclusion, for example, a product or device that includes a range of components is not necessarily limited to all of the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0048] The term "module" refers to any known or subsequently developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functions associated with that element.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0050] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the principles and practical applications, thereby enabling those skilled in the art to better utilize the described embodiments and various different variations of embodiments suitable for specific use considerations.

[0051] Figure 1 The schematic diagram of the encryption process based on structural obfuscation provided in this application includes the following steps:

[0052] S101: Obtain the neural network model to be encrypted, and determine the structural layers to be obfuscated in the neural network model.

[0053] S102: Generate a confusion layer corresponding to the structural layer, and randomly generate a confusion matrix for the confusion layer.

[0054] S103: The parameter matrix of the structural layer is confused using the confusion matrix to obtain an encrypted parameter matrix. The structure file and parameter file of the neural network model are then saved. The structure file includes the structural layer and the confusion layer, and the parameter file includes the encrypted parameter matrix and the confusion matrix.

[0055] The structural obfuscation-based model encryption method provided in this application is applied to electronic devices, which may be PCs, computers, or servers.

[0056] The electronic device acquires a neural network model to be encrypted. This application does not limit the type of neural network model; it can be any type of neural network model. All structural layers in the neural network model can be determined as the structural layers to be obfuscated, or one or more structural layers in the neural network model can be randomly selected as the structural layers to be obfuscated. The structural layers to be obfuscated include convolutional layers.

[0057] After the electronic device identifies the structural layers to be obfuscated, it generates a corresponding obfuscation layer for each layer and randomly generates an obfuscation matrix for that layer. The parameter matrix of the structural layer to be obfuscated has the same dimensions as the obfuscation matrix of the corresponding obfuscation layer. Then, the obfuscation matrix is ​​used to obfuscate the parameter matrix of the corresponding structural layer to obtain an encrypted parameter matrix. The structure file of the neural network model is saved, containing all structural layers and the obfuscation layer corresponding to the structural layer to be obfuscated. The parameter file of the neural network model is also saved, containing the encrypted parameter matrix and the obfuscation matrix. Furthermore, for structural layers without a corresponding obfuscation layer, neither an encrypted parameter matrix nor an obfuscation matrix exists; therefore, the parameter file also includes the parameter matrix of the structural layer without a corresponding obfuscation layer.

[0058] This application obfuscates the structure of a neural network model, including adding obfuscation layers and randomly generating obfuscation matrices for these layers. The obfuscation matrices are then used to obfuscate the parameter matrices of the structural layers. This achieves the goal of hiding the original structure and parameters of the neural network model, making it impossible for external users to directly use the plaintext model file even if they obtain it through various means, thus enhancing the security of the neural network model.

[0059] The step of generating a confusion layer corresponding to the structural layer, and randomly generating a confusion matrix for the confusion layer, includes:

[0060] A confusion layer with the same scale as the structural layer is generated, a confusion matrix of the confusion layer is randomly generated, and the parameter matrix of the structural layer and the confusion matrix are concatenated.

[0061] To facilitate the obfuscation of the structural layer's parameter matrix using a confusion matrix to obtain an encrypted parameter matrix, this application generates a confusion layer with the same scale as the structural layer and randomly generates a confusion matrix for the confusion layer. To further enhance the security of the neural network model, this application concatenates the structural layer's parameter matrix and the confusion matrix. The concatenated confusion matrix appears as part of the parameter matrix, making it more deceptive and thus strengthening the security of the neural network model.

[0062] In this application, the step of performing an obfuscation operation on the parameter matrix of the structural layer using the obfuscation matrix to obtain an encrypted parameter matrix includes:

[0063] The XOR operation is used as the obfuscation operation of the obfuscation matrix. The obfuscation matrix is ​​then used to perform an XOR operation on the parameter matrix of the structural layer to obtain the encryption parameter matrix.

[0064] The electronic device generates a confusion layer corresponding to the structural layer. After randomly generating a confusion matrix for the confusion layer, it performs an XOR operation on the parameter matrix of the corresponding structural layer using the confusion matrix to obtain the encryption parameter matrix. It should be noted that the XOR operation is only an example of a confusion operation, and this application does not limit the specific algorithm of the confusion operation.

[0065] During the training phase of the neural network model, the confusion matrix is ​​not involved in the calculations and is not iteratively updated. This ensures the prediction accuracy of the neural network model.

[0066] To ensure the security of the data in the structure file and parameter file, in this application, the structure file and parameter file for storing the neural network model include:

[0067] The binary streams of the structural layer and the obfuscation layer of the neural network model are encrypted and saved to a structure file. The encryption parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer are encrypted and saved to a parameter file.

[0068] The binary streams of the structure layer and obfuscation layer are encrypted and then saved to the structure file. Similarly, the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer are encrypted and then saved to the parameter file. Encryption ensures the security of the data in the structure file and parameter file, further guaranteeing the security of the neural network model.

[0069] The method further includes:

[0070] During the loading phase of the neural network model, the structure file and parameter file are decrypted to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; the obfuscation matrix is ​​used to perform an inverse obfuscation operation on the encryption parameter matrix to obtain the parameter matrix of the structure layer.

[0071] If the decryption key is stored in a distributed manner, the distributed key segments are restored to obtain the decryption key, and the decryption key is used to decrypt the structure file and parameter file respectively.

[0072] In this application, during the loading phase of the neural network model, the structure file and parameter file are decrypted separately. Specifically, the data in the structure file and parameter file is decrypted to obtain the structural layers and obfuscation layers of the neural network model, as well as the encrypted parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer. Since the encrypted parameter matrix is ​​obtained by obfuscating the obfuscation matrix and the parameter matrix, the obfuscation matrix is ​​used to perform the inverse obfuscation operation on the encrypted parameter matrix to obtain the parameter matrix of the structural layer. Based on the obtained structural layer and parameter matrix of the structural layer, the prediction task of the neural network model is completed. It should be noted that the obfuscation matrix of the obfuscation layer is not involved in the calculation of the prediction task.

[0073] To further ensure the security of the neural network model, the decryption key can be stored in a distributed manner. During the loading phase of the neural network model, the distributed key segments are first restored to obtain the decryption key, and then the data in the structure file and parameter file are decrypted using the decryption key.

[0074] This application provides an encryption scheme for an artificial intelligence algorithm model based on structural obfuscation, including the following steps:

[0075] During the model building phase, a confusion layer is added to the network structure.

[0076] A confusion matrix is ​​randomly generated for each confusion layer. The dimensions of the confusion matrix are the same as those of the parameter matrix of the corresponding structural layer, and the number of channels is N. The confusion matrix and the parameter matrix are then concatenated.

[0077] During model training, the confusion matrix is ​​not involved in the computation during forward propagation, and similarly, it is not iteratively updated. A custom operator `conf_conv` containing the confusion matrix is ​​defined. In its implementation, `conf_conv` specifies that a portion of the confusion matrix is ​​excluded from computation. Assuming the traditional convolutional layer operator is `tra_conv`, the network structure can be `conf_conv, tra_conv, conf_conv`, meaning the first convolutional layer contains the confusion matrix, the second convolutional layer is a traditional convolutional layer, and the third convolutional layer contains the confusion matrix. This definition ensures that the confusion matrix is ​​neither involved in computation nor iteratively updated.

[0078] When model training is complete and model parameters are saved, a confusion matrix is ​​used to perform a confusion operation on the parameter matrix of the corresponding structural layer to obtain an encrypted parameter matrix. The confusion operation is, for example, an XOR operation. The model parameter file stores both the confusion matrix and the encrypted parameter matrix. Externally, the confusion matrix appears to be part of the confusion layer parameter matrix.

[0079] The model structure file and the model parameter file are encrypted separately.

[0080] During the model loading phase, the model structure file and model parameter file are first decrypted. When loading the model parameters, the encrypted parameter matrix of each obfuscation layer is restored using the obfuscation matrix.

[0081] During the model inference phase, similar to the forward propagation during the training phase, the confusion matrix of the confusion layer does not participate in the calculation of that layer.

[0082] Constructing a confusion layer:

[0083] Taking a convolutional neural network as an example, let's select a convolutional layer as the confusion layer, and assume that the kernel size of this convolutional layer is k. w ×k w If the channel is ×, then the parameter matrix size of the convolutional layer is also k. w ×k w ×channel. The confusion matrix has the same dimensions as the parameter matrix, and the number of channels is N, therefore the size of the confusion matrix is ​​k. w ×k w ×N. Concatenate the parameter matrix and the confusion matrix along the channel dimension to obtain k. w ×k w A matrix of ×(channel+N). The first channel 1s are used as parameter matrices in neuron computation, and the last N channels are used as a confusion matrix to obfuscate the parameter matrices of the first channel 1s when saving parameters.

[0084] Obfuscation layer parameter saving:

[0085] Assume the parameter matrix of the current confusion layer is W k The confusion matrix is ​​W c The matrix saved to the model parameter file is W. s , Let be the obfuscation operator, and let concat be the operation that concatenates two matrices along their channel dimensions. Then:

[0086]

[0087] Even if the attacker obtains the plaintext model parameter file, they will still mistakenly interpret the confusion layer as having a convolutional kernel size of k. w ×k w He couldn't guess that in a normal convolutional layer with ×(channel+N), only the first channel were the actual convolutional kernel parameters, and that these parameters were obfuscated by the confusion matrix.

[0088] Model loading:

[0089] When loading the model, the parameter matrix of the confusion layer is restored using the confusion matrix. Let's assume the parameter matrix of the current confusion layer is W. k The confusion matrix is ​​W cThe parameter matrix after the confusion matrix is ​​W. k ′ ,but:

[0090]

[0091] In this application, the model is constructed as follows:

[0092] When building the model, a confusion layer is added. Each confusion layer randomly generates a confusion matrix, which is then concatenated to the parameter matrix of the confusion layer.

[0093] Training the model:

[0094] During model training, the confusion matrix of the confusion layer does not participate in neuron computation and parameter update iteration. The role of the confusion matrix is ​​only to perform confusion operations on the parameter matrix of the corresponding structural layer when saving model parameters, and to save it as part of the parameter matrix in the model parameter file to achieve a misleading effect.

[0095] Save the model:

[0096] When saving model parameters, the parameter matrix of the corresponding structural layer is first obfuscated using a confusion matrix. This application uses XOR operation as the obfuscation operation for the confusion matrix. After obfuscation, the confusion matrix and the obfuscated encrypted parameter matrix are stored together in the model parameters. The model structure and model parameters are encrypted using an AES key and saved to the model structure file and model parameter file respectively. The AES key is segmented and stored in the code. For example, a 128-bit key is divided into 16 segments of 8 bits each and stored in 16 variables. When needed, the 128-bit key is reassembled.

[0097] Figure 2 The schematic diagram of the model saving process provided for this application includes the following steps:

[0098] S201: When saving model parameters, first use the confusion matrix to perform confusion operation on the parameter matrix of the corresponding structural layer to obtain the encrypted parameter matrix.

[0099] S202: After obfuscation, store the obfuscation matrix together with the obfuscated encryption parameter matrix in the model parameters.

[0100] S203: When saving the model structure, save the structure layer and obfuscation layer in the structure file.

[0101] S204: Randomly generate an AES symmetric key.

[0102] S205: Encrypt the binary streams of the structural layer and the obfuscation layer of the neural network model and save them to a structure file; encrypt the encryption parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer and save them to a parameter file.

[0103] S206: Store the AES symmetric key in segments.

[0104] Loading the model:

[0105] When loading the model, the shuffled AES key is first restored. Then, the model structure file and model parameter file are read as a binary stream. Specifically, the model file is decrypted using the AES key to obtain the plaintext model's byte array, which is then read using the deep learning framework. The restored AES key is then used to decrypt the model structure and model parameters. When loading model parameters, the obfuscation layer uses its obfuscation matrix to restore the encrypted parameter matrix.

[0106] Figure 3 The schematic diagram of the loading model process provided in this application includes the following steps:

[0107] S301: Restore the shattered AES key.

[0108] S302: Reads the model structure file and model parameter file in binary stream mode.

[0109] S303: Decrypt the model structure and model parameters using the restored AES key.

[0110] S304: When loading model parameters, the obfuscation layer uses the obfuscation matrix of this layer to restore the encrypted parameter matrix.

[0111] Inference Model:

[0112] When using the model for inference, the confusion matrix of the confusion layer is not included in the calculation, and the rest is no different from that of a regular neural network model.

[0113] Figure 4 This is a schematic diagram of the structure of the model encryption device based on structural obfuscation provided in this application. The device includes:

[0114] The acquisition module 41 is used to acquire the neural network model to be encrypted and determine the structural layers to be obfuscated in the neural network model;

[0115] Generation module 42 is used to generate a confusion layer corresponding to the structural layer and randomly generate a confusion matrix of the confusion layer;

[0116] The encryption module 43 is used to perform an obfuscation operation on the parameter matrix of the structure layer using the obfuscation matrix to obtain an encrypted parameter matrix, and to save the structure file and parameter file of the neural network model, wherein the structure file includes the structure layer and the obfuscation layer, and the parameter file includes the encrypted parameter matrix and the obfuscation matrix.

[0117] The generation module 42 is specifically used to generate a confusion layer with the same scale as the structural layer, randomly generate a confusion matrix of the confusion layer, and concatenate the parameter matrix of the structural layer and the confusion matrix.

[0118] The encryption device 43 is specifically used to perform an XOR operation as the obfuscation operation of the obfuscation matrix, and to perform an XOR operation on the parameter matrix of the structure layer using the obfuscation matrix to obtain the encryption parameter matrix.

[0119] The encryption module 43 is specifically used to encrypt the binary streams of the structural layer and the obfuscation layer of the neural network model and save them to a structure file, and to encrypt the encryption parameter matrix corresponding to the structural layer and the obfuscation matrix of the obfuscation layer and save them to a parameter file.

[0120] The device further includes:

[0121] The loading module 44 is used to decrypt the structure file and parameter file respectively during the loading stage of the neural network model to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; and to perform obfuscation inverse operation on the encryption parameter matrix using the obfuscation matrix to obtain the parameter matrix of the structure layer.

[0122] The loading module 44 is specifically used to restore the scattered key segments if the decryption key is stored in a distributed manner, to obtain the decryption key, and to decrypt the structure file and parameter file respectively using the decryption key.

[0123] This application also provides an electronic device, such as Figure 5 As shown, it includes: processor 501, communication interface 502, memory 503 and communication bus 504, wherein processor 501, communication interface 502 and memory 503 communicate with each other through communication bus 504.

[0124] The memory 503 stores a computer program, which, when executed by the processor 501, causes the processor 501 to perform any of the above method steps.

[0125] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0126] Communication interface 502 is used for communication between the above-mentioned electronic device and other devices.

[0127] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0128] The processors mentioned above can be general-purpose processors, including central processing units, network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0129] This application also provides a computer-readable storage medium storing a computer program executable by an electronic device, which, when run on the electronic device, causes the electronic device to perform any of the above method steps.

[0130] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0131] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A model encryption method based on structural obfuscation, characterized in that, The method includes: obtaining a neural network model to be encrypted, determining the structural layer to be obfuscated in the neural network model; generating an obfuscation layer corresponding to the structural layer, and randomly generating an obfuscation matrix of the obfuscation layer; The parameter matrix of the structural layer is obfuscated using the obfuscation matrix to obtain an encrypted parameter matrix. The obfuscation matrix is ​​obfuscated using the obfuscation matrix to obtain an encrypted parameter matrix. The neural network model includes a custom operator, which is used to ensure that the confusion matrix of the confusion layer does not participate in the calculation during the training and inference phases of the model, and that the confusion matrix is ​​not iteratively updated. Save the structure file and parameter file of the neural network model. The structure file includes the structure layer and the obfuscation layer, and the parameter file includes the encryption parameter matrix and the obfuscation matrix. A convolutional layer is selected as the obfuscation layer, and the kernel size of this convolutional layer is assumed to be... The parameter matrix size of the convolutional layer is then... The confusion matrix has the same dimensions as the parameter matrix, and the number of channels is... The size of the confusion matrix is The parameter matrix and confusion matrix are concatenated along the channel dimension to obtain... The matrix; where, the first Each channel participates in neuron computation as a parameter matrix. Each channel is used as a confusion matrix to sort the previous channels when saving parameters. The parameter matrices of each channel are obfuscated. Saving the structure file and parameter file of the neural network model includes: encrypting the binary streams of the structural layer and the obfuscated layer of the neural network model using an AES key and saving them to the structure file; concatenating the encrypted parameter matrix corresponding to the structural layer and the obfuscated matrix of the obfuscated layer through the channel dimension to obtain a parameter matrix, which is used as a convolution kernel parameter of a convolutional layer, encrypted, and saved to the parameter file; wherein, the AES key is segmented and then broken down and stored in the code; During the loading phase of the neural network model, the structure file and parameter file are decrypted to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; the obfuscation matrix is ​​used to perform an inverse obfuscation operation on the encryption parameter matrix to obtain the parameter matrix of the structure layer.

2. The method as described in claim 1, characterized in that, The step of generating a confusion layer corresponding to the structural layer, and randomly generating a confusion matrix for the confusion layer, includes: A confusion layer with the same scale as the structural layer is generated, a confusion matrix of the confusion layer is randomly generated, and the parameter matrix of the structural layer and the confusion matrix are concatenated.

3. The method as described in claim 1, characterized in that, The decryption of the structure file and parameter file respectively includes: If the decryption key is stored in a distributed manner, the distributed key segments are restored to obtain the decryption key, and the decryption key is used to decrypt the structure file and parameter file respectively.

4. A model encryption device based on structural obfuscation, characterized in that, The device includes: an acquisition module, used to acquire a neural network model to be encrypted and to determine the structural layers to be obfuscated in the neural network model; A generation module is used to generate a confusion layer corresponding to the structural layer and to randomly generate a confusion matrix for the confusion layer. An encryption module is used to perform an encryption operation on the parameter matrix of the structural layer using the confusion matrix to obtain an encrypted parameter matrix. This process includes: using an XOR operation as the confusion operation for the confusion matrix; performing an XOR operation on the parameter matrix of the structural layer using the confusion matrix to obtain the encrypted parameter matrix; the neural network model includes a custom operator that prevents the confusion matrix of the confusion layer from participating in calculations during training and inference, and prevents iterative updates to the confusion matrix; and it saves the structure file and parameter file of the neural network model, wherein the structure file includes the structural layer and the confusion layer, and the parameter file includes the encrypted parameter matrix and the confusion matrix, wherein a convolutional layer is selected as the confusion layer, assuming the kernel size of this convolutional layer is... The parameter matrix size of the convolutional layer is then... The confusion matrix has the same dimensions as the parameter matrix, and the number of channels is... The size of the confusion matrix is The parameter matrix and confusion matrix are concatenated along the channel dimension to obtain... The matrix; where, the first Each channel participates in neuron computation as a parameter matrix. Each channel is used as a confusion matrix to sort the previous channels when saving parameters. The parameter matrices of each channel are obfuscated. Saving the structure file and parameter file of the neural network model includes: encrypting the binary streams of the structural layer and the obfuscated layer of the neural network model using an AES key and saving them to the structure file; concatenating the encrypted parameter matrix corresponding to the structural layer and the obfuscated matrix of the obfuscated layer through the channel dimension to obtain a parameter matrix, which is used as a convolution kernel parameter of a convolutional layer, encrypted, and saved to the parameter file; wherein, the AES key is segmented and then broken down and stored in the code; The loading module is used to decrypt the structure file and parameter file respectively during the loading stage of the neural network model to obtain the structure layer and the obfuscation layer of the neural network model, as well as the encryption parameter matrix corresponding to the structure layer and the obfuscation matrix of the obfuscation layer; and to perform an inverse obfuscation operation on the encryption parameter matrix using the obfuscation matrix to obtain the parameter matrix of the structure layer.

5. The apparatus as claimed in claim 4, characterized in that, The loading module is specifically used to restore the scattered key segments if the decryption key is stored in a distributed manner, to obtain the decryption key, and to decrypt the structure file and parameter file respectively using the decryption key.

6. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the steps of the method described in claim 1 or 2.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in claim 1 or 2.

Images