Processing method of model, data processing method based on model and related device

Abstract

A processing method of a model is applied to the field of artificial intelligence (AI) technology. In the method, a new confusion calculation node is added on the basis of the original calculation logic of the AI model, and an expression is used to determine the execution relationship between the original calculation node and the confusion node. Only when the output of the expression is correct can the correct calculation node be executed. In this way, the execution order and dependency relationship of the operators in the original model can be blurred through the newly added confusion node, the model structure is scrambled, and only the newly added expression needs to be encrypted and protected, thereby protecting the normal execution process of the entire AI model, reducing the additional performance overhead caused by model protection, and facilitating the popularization and application of the AI model.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence (AI) technology, and in particular to a method for processing a model and related apparatus. Background Technology

[0002] With continuous breakthroughs in AI theory and hardware computing power, AI technology has experienced rapid development. In fields such as computer vision, natural language processing, and speech recognition, AI systems have been deployed on a large scale, and an increasing number of vendors are providing AI services. Generally, AI service providers complete model training and optimization locally before deploying the AI ​​model to third-party platforms (such as terminal devices, edge devices, and cloud servers) to provide inference services. Since the design and training of AI models require a significant investment of time, data, and computing power, preventing the theft of AI models during transmission, storage, and operation has become a primary concern for AI service providers.

[0003] To address the vulnerability of AI models to theft, several model confidentiality protection schemes have been proposed in the industry. For example, encryption-based model protection schemes encrypt the AI ​​model during transmission and storage, and decrypt it into memory before executing inference. While this approach protects the confidentiality of the AI ​​model, the computational overhead of decrypting the entire model before each inference operation is enormous, significantly increasing inference latency and severely limiting the application of AI models.

[0004] Therefore, how to achieve efficient protection of model confidentiality has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides a model processing method that can protect the normal execution process of the entire AI model and reduce the additional performance overhead caused by model protection, which is conducive to the promotion and application of AI models.

[0006] The first aspect of this application provides a method for processing a model, applicable to physical or virtual devices such as servers or terminal devices. Taking the method applied to a server as an example, the method includes: the server obtaining a first computation graph by parsing the model file of an AI model. The first computation graph is used to indicate the execution logic of the AI ​​model, and the first computation graph includes at least one operator. That is, the first computation graph can indicate the execution logic of the AI ​​model by indicating the dependencies between at least one operator. The execution logic of the AI ​​model can refer to the orderly execution of the at least one operator.

[0007] Then, based on the first computation graph, the server generates a second computation graph. The second computation graph includes at least one computation branch, at least one obfuscation branch, and a first expression. The output of the first expression indicates whether to execute a branch within the at least one computation branch or a branch within the at least one obfuscation branch. Furthermore, at least one operator in the first computation graph is included in at least one computation branch in the second computation graph, and the at least one computation branch and the at least one obfuscation branch have different computational logic. When the output of the first expression is correct, at least one computation branch in the second computation graph is executed, ensuring that the actual computational logic is the same as the computational logic of the original AI model. When the output of the first expression is incorrect, at least one obfuscation branch in the second computation graph is executed, making the actual computational logic different from the computational logic of the original AI model, thereby protecting the AI ​​model. The obfuscation branch is a branch with operators that can calculate output data from the input data. Furthermore, since the computational logic of the obfuscation branch is different from that of the computation branch—that is, the operators in the obfuscation branch are different from those in the computation branch—the obfuscation branch and the computation branch can produce different output data for the same input data.

[0008] Secondly, the server generates the executable code corresponding to the AI ​​model based on the second computation graph. The target code within this executable code is configured for encryption protection and is related to the first expression. Since the output of the first expression in the second computation graph can affect the execution of computational branches and obfuscation branches, encrypting the target code of the first expression protects the computational logic of the second computation graph. Simply put, even if an attacker steals the AI ​​model by obtaining its executable code, the encrypted target code prevents the attacker from accessing the computational logic of the first expression, thus preventing them from obtaining the correct output value and ultimately the correct execution logic of the AI ​​model.

[0009] Based on the original computational logic of the AI ​​model, a scrambling branch is added parallel to the computational branches. The execution relationship between the computational branches and the scrambling branch is determined by an expression; the correct computational branch is executed only when the expression's output is correct. In this way, the added scrambling branch obscures the explicit operator execution order and dependencies in the original model, achieving model structure scrambling. Furthermore, only the newly added expression needs to be encrypted for protection, thus protecting the entire normal execution flow of the AI ​​model. This reduces the additional performance overhead associated with model protection and facilitates the widespread application of the AI ​​model.

[0010] In one possible implementation, the second computation graph includes only one computation branch, and the output of the first expression is used to indicate which branch to execute, as well as at least one obfuscated branch. The computation branch in the second computation graph includes all operators in the first computation graph and the dependencies between them; therefore, by executing one computation branch in the second computation graph, the computational logic in the first computation graph can be implemented. Furthermore, the first expression can be connected to both a computation branch and at least one obfuscated branch, indicating which branch to execute. The computation branch in the second computation graph is executed only if the output of the first expression is a preset target value; otherwise, if the output of the first expression is not a preset target value, at least one obfuscated branch in the second computation graph is executed.

[0011] The connection between the first expression and the computation branch and at least one obfuscated branch can mean that the code defines a jump to the computation branch and at least one obfuscated branch based on the output value of the first expression. Therefore, after executing the first expression, it is possible to jump to the computation branch or at least one obfuscated branch.

[0012] In this scheme, by setting one or more obfuscated branches parallel to the computation branches in the second computation graph, the execution order and dependencies of explicit operators in the original model can be effectively obscured, thereby scrambling the model structure and improving the confidentiality protection of the model.

[0013] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression. The output of the first expression indicates the execution of one of the multiple computation branches and at least one obfuscated branch; the second expression is connected to the multiple computation branches and at least one obfuscated branch, indicating the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0014] The connection between the second expression and the computation branch and at least one obfuscation branch can mean that, in the code, execution of any one of the multiple computation branches and at least one obfuscation branch will jump to the execution of the second expression. Therefore, after executing any computation branch or obfuscation branch, it is possible to jump to the second expression, which then indicates whether to continue looping through the first expression.

[0015] In other words, multiple computational branches and at least one obfuscated branch are parallel in the second computational graph, and the first expression controls which branch needs to be executed, while the second expression controls the number of times the first expression is executed in a loop. Therefore, through the cooperation of the second and first expressions, the corresponding computational branches can be executed sequentially; and through the parallel obfuscated branch, the execution order and dependencies of explicit operators in the original model can be effectively obscured, thereby scrambling the model structure and improving the confidentiality protection of the model.

[0016] In one possible implementation, the input to the second expression is related to the branch executed in the previous iteration, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0017] During the execution of the second computation graph, based on the input value, the first expression is run to obtain its output value. Then, the branch to be executed is determined based on the output value of the first expression. After executing a branch, the second expression is executed to determine whether to continue looping through the first expression. If it is determined to continue looping through the first expression, the first expression is executed again based on the output value of the executed branch to determine the next branch to be executed. By repeatedly executing the above steps until the output value of the second expression determines the termination of the loop through the first expression, multiple computation branches are executed sequentially, making the computational logic of the second computation graph the same as that of the first computation graph.

[0018] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be cryptographically protected. For example, the first numerical value is configured to run in a trusted execution environment; or, the first numerical value is configured to be encrypted using an encryption algorithm.

[0019] In other words, the initial input of the first expression can be fixed. Only when the initial input of the first expression is a first numerical value can the first expression output a correct value, thus ensuring that the computational logic of the second computation graph is the same as that of the first computation graph. Furthermore, by configuring the first numerical value for encryption protection, the output of the first expression can be protected. Even if an attacker obtains the entire second computation graph, they will be unable to access the correct computational logic of the second computation graph because they cannot obtain the correct input value of the first expression, thereby achieving model confidentiality protection.

[0020] In one possible implementation, the target code is configured to run in a trusted execution environment (TEA), and / or the target code is configured to undergo code obfuscation. When the user's terminal device needs to run the AI ​​model, the terminal device can load the target code into the TEA and run it, thereby achieving encrypted protection of the target code based on the TEA. Alternatively, if the target code is not configured to undergo code obfuscation, the target code will be converted into functionally identical but difficult-to-read and understand code, thus protecting the target code without affecting its normal execution.

[0021] In one possible implementation, the target code is configured to be encrypted and protected using an encryption algorithm. When the user's terminal device needs to run the AI ​​model, the terminal device must first decrypt the target code using a decryption algorithm to obtain the decrypted code, and then obtain the first expression based on the decrypted code. For example, the encryption algorithm could be the Advanced Encryption Standard (AES), the Data Encryption Standard (DES), the International Data Encryption Algorithm (IDEA), or the RSA algorithm.

[0022] In one possible implementation, the method further includes: the server obtaining a third computation graph, which is used to indicate the execution logic of the AI ​​model, and the third computation graph includes a first operator. The third computation graph and the aforementioned first computation graph can be two different computation graphs in the AI ​​model; the third computation graph can also be a sub-computation graph of the first computation graph, meaning that the first operator included in the third computation graph belongs to one of multiple operators in the first computation graph.

[0023] Based on the third computation graph, the server generates a fourth computation graph. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. Simply put, when the weight parameters of the second operator are modified from the weight parameters of the first operator, the output of the second operator will necessarily be different from the output of the first operator based on the same input. Therefore, a third expression is introduced to transform the output of the second operator into the same value as the output of the first operator.

[0024] Finally, the server generates the executable code corresponding to the AI ​​model based on the second and fourth computation graphs.

[0025] In this solution, by scrambling the weight parameters of the operators in the AI ​​model, the explicit operators in the AI ​​model can be effectively obfuscated, thus preventing attackers from stealing the AI ​​model by misusing the operators and protecting the confidentiality of the AI ​​model.

[0026] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0027] In cases where the input to the third expression is incorrect, the third expression cannot convert the output of the second operator into the output of the first operator. Therefore, by encrypting the first value, the computational logic in the fourth computational graph can be protected, thereby protecting the normal execution flow of the entire AI model and reducing the additional performance overhead caused by model protection.

[0028] A second aspect of this application provides a model-based data processing method applicable to devices deploying AI models, such as physical or virtual devices like servers or terminal devices. Taking the application of this method to a terminal device as an example, the method includes: executing code based on the AI ​​model; the terminal device acquiring a second computation graph, the second computation graph including at least one computation branch, at least one obfuscated branch, and a first expression; the output of the first expression being used to instruct the execution of a branch in the at least one computation branch or a branch in the at least one obfuscated branch; the at least one computation branch including at least one operator of the AI ​​model; the at least one computation branch having different computational logic from the at least one obfuscated branch; the target code in the executing code being configured for encryption protection; the target code being code related to the first expression; the terminal device acquiring input data of the AI ​​model; and the terminal device processing the input data based on the second computation graph to obtain output data of the AI ​​model.

[0029] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0030] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and at least one obfuscated branch; the second expression is connected to the multiple computation branches and at least one obfuscated branch, and the second expression is used to indicate the number of times the first expression is executed in a loop.

[0031] In one possible implementation, the input to the second expression is related to the branch executed in the previous execution, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0032] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0033] In one possible implementation, the target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

[0034] In one possible implementation, the target code is configured to be encrypted using an encryption algorithm. The terminal device can decrypt the target code in the executable code to obtain the decrypted code; and the terminal device executes the decrypted code to obtain the first expression.

[0035] In one possible implementation, the method further includes: obtaining a fourth computation graph based on the execution code of the AI ​​model, the fourth computation graph including a second operator and a third expression, the second operator being obtained by modifying the weight parameters of the first operator in the AI ​​model, the input of the third expression including the output of the second operator, and the output of the third expression being the same as the output of the first operator when using the same input as the second operator; and processing the input data based on the second computation graph, including: processing the input data based on the second computation graph and the fourth computation graph.

[0036] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0037] A third aspect of this application provides a model processing apparatus, comprising: an acquisition module for acquiring a first computation graph, the first computation graph indicating the execution logic of an artificial intelligence (AI) model, the first computation graph including at least one operator; a processing module for generating a second computation graph based on the first computation graph, the second computation graph including at least one computation branch, at least one obfuscation branch, and a first expression, the output of the first expression indicating the execution of a branch in the at least one computation branch or a branch in the at least one obfuscation branch, the at least one operator being included in the at least one computation branch, the at least one computation branch having different computation logic from the at least one obfuscation branch; and a processing module for generating execution code corresponding to the AI ​​model according to the second computation graph, wherein the target code related to the first expression in the execution code is configured to be encrypted and protected.

[0038] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0039] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and the at least one obfuscated branch; the second expression is connected to the multiple computation branches and the at least one obfuscated branch, the second expression is used to indicate the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0040] In one possible implementation, the input of the second expression is related to the previously executed branch, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0041] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0042] In one possible implementation, the target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

[0043] In one possible implementation, the target code is configured to be encrypted and protected using an encryption algorithm.

[0044] In one possible implementation, the acquisition module is further configured to acquire a third computational graph, which is used to indicate the execution logic of the AI ​​model, and the third computational graph includes a first operator; the processing module is further configured to: generate a fourth computational graph based on the third computational graph, the fourth computational graph including a second operator and a third expression, wherein the second operator is obtained by modifying the weight parameters of the first operator, the input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator; and generate the execution code corresponding to the AI ​​model according to the second computational graph and the fourth computational graph.

[0045] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on a second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0046] A fourth aspect of this application provides a model-based data processing apparatus, comprising: an acquisition module, configured to acquire a second computation graph based on executable code of an AI model, the second computation graph including at least one computation branch, at least one obfuscated branch, and a first expression, wherein the output of the first expression is used to instruct the execution of a branch in the at least one computation branch or a branch in the at least one obfuscated branch, the at least one computation branch including at least one operator of the AI ​​model, the at least one computation branch having different computational logic from the at least one obfuscated branch, and the target code related to the first expression in the executable code being configured for encryption protection; the acquisition module is further configured to acquire input data of the AI ​​model; and the processing module is further configured to process the input data based on the second computation graph to obtain output data of the AI ​​model.

[0047] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0048] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and the at least one obfuscated branch; the second expression is connected to the multiple computation branches and the at least one obfuscated branch, the second expression is used to indicate the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0049] In one possible implementation, the input of the second expression is related to the previously executed branch, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0050] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0051] In one possible implementation, the target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

[0052] In one possible implementation, the target code is configured to be encrypted and protected using an encryption algorithm; the processing module is further configured to decrypt the target code in the execution code to obtain decrypted code; and execute the decrypted code to obtain the first expression.

[0053] In one possible implementation, the acquisition module is further configured to acquire a fourth computation graph based on the execution code of the AI ​​model. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator in the AI ​​model. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. The processing module is further configured to process the input data based on the second computation graph and the fourth computation graph.

[0054] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on a second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0055] A fifth aspect of this application provides an electronic device comprising: a memory and a processor; the memory storing code, and the processor being configured to execute the code, wherein when the code is executed, the electronic device performs a method as described in any of the implementations of the first aspect.

[0056] A sixth aspect of this application provides an electronic device comprising: a memory and a processor; the memory storing code, and the processor being configured to execute the code, wherein when the code is executed, the electronic device performs a method as described in any of the implementations of the second aspect.

[0057] The seventh aspect of this application provides an AI system comprising: a model processing apparatus as described in any implementation of the third aspect and a model-based data processing apparatus as described in any implementation of the fourth aspect.

[0058] The eighth aspect of this application provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform a method as implemented in either the first or second aspect.

[0059] The ninth aspect of this application provides a computer program product that, when run on a computer, causes the computer to perform a method as implemented in either the first or second aspect.

[0060] The tenth aspect of this application provides a chip including one or more processors. Part or all of the processors are configured to read and execute a computer program stored in a memory to perform the method in any implementation of the first or second aspect described above.

[0061] Optionally, the chip includes a memory, which is connected to the processor via a circuit or wire. Optionally, the chip also includes a communication interface, to which the processor is connected. The communication interface is used to receive data and / or information that needs to be processed. The processor obtains the data and / or information from the communication interface, processes the data and / or information, and outputs the processing result through the communication interface. The communication interface can be an input / output interface. The method provided in this application can be implemented by a single chip or by multiple chips working together.

[0062] The technical effects of any of the design methods in aspects two through ten can be found in the technical effects of different implementation methods in aspect one above, and will not be repeated here. Attached Figure Description

[0063] Figure 1 A schematic diagram illustrating a plaintext deployment of a model file, provided as an embodiment of this application;

[0064] Figure 2 A schematic diagram illustrating the encrypted deployment of a model file, provided as an embodiment of this application;

[0065] Figure 3 A schematic diagram illustrating an application scenario of a model processing method provided in an embodiment of this application;

[0066] Figure 4 A flowchart illustrating a model processing method provided in an embodiment of this application;

[0067] Figure 5A A schematic diagram of a structure for generating a second computation graph based on a first computation graph, provided in an embodiment of this application;

[0068] Figure 5B This application provides another schematic diagram of a structure for generating a second computation graph based on a first computation graph, as provided in an embodiment of the present application.

[0069] Figure 6A This application provides another schematic diagram of a structure for generating a second computation graph based on a first computation graph.

[0070] Figure 6B A schematic diagram of the operation of a second computation graph provided in an embodiment of this application;

[0071] Figure 7A This application provides another schematic diagram of a structure for generating a second computation graph based on a first computation graph, as provided in an embodiment of the present application.

[0072] Figure 7B This application provides a schematic diagram of an execution of a second computation graph.

[0073] Figure 8This application provides another schematic diagram of a structure for generating a second computation graph based on a first computation graph, as provided in an embodiment of the present application.

[0074] Figure 9 A schematic diagram illustrating the generation of a fourth computation graph based on a third computation graph, provided as an embodiment of this application;

[0075] Figure 10 A flowchart illustrating a model-based data processing method provided in an embodiment of this application;

[0076] Figure 11 This application provides a processing model and a flowchart illustrating data processing based on the model.

[0077] Figure 12 A schematic diagram of the structure of a model processing device provided in an embodiment of this application;

[0078] Figure 13 A schematic diagram of the structure of a model-based data processing device provided in this application embodiment;

[0079] Figure 14 A schematic diagram of the structure of the execution device provided in the embodiments of this application;

[0080] Figure 15 A schematic diagram of the structure of a chip provided in an embodiment of this application;

[0081] Figure 16 This is a schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of this application. Detailed Implementation

[0082] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application are described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some, and not all, of the embodiments of this application. Those skilled in the art will understand that, with the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0083] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such descriptions can be used interchangeably where appropriate to allow embodiments to be implemented in a sequence other than that illustrated or described in this application. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules is not necessarily limited to those explicitly listed, but may include other steps or modules not explicitly listed or inherent to such processes, methods, products, or devices. The naming or numbering of steps appearing in this application does not imply that the steps in the method flow must be performed in the chronological / logical order indicated by the naming or numbering. The execution order of named or numbered process steps can be changed according to the desired technical purpose, as long as the same or similar technical effect is achieved. The division of units in this application is a logical division. In practical applications, there may be other division methods. For example, multiple units may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the shown or discussed mutual coupling, direct coupling, or communication connection may be through some interface, and the indirect coupling or communication connection between units may be electrical or other similar forms, none of which are limited in this application. Furthermore, the units or sub-units described as separate components may or may not be physically separated, may or may not be physical units, or may be distributed among multiple circuit units. Some or all of the units can be selected to achieve the purpose of the solution in this application according to actual needs.

[0084] For ease of understanding, the technical terms involved in the embodiments of this application will be introduced below.

[0085] (1) AI

[0086] AI (Artificial Intelligence) is a theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0087] (2) AI Model

[0088] An AI model is a technical means within AI technology used to handle specific tasks. Generally, an AI model can be a neural network composed of neural units. Typically, AI models are trained on the model owner's device or platform (such as a server, virtual machine, or container), and the trained AI model is stored as a model file. When the model user's device (such as a terminal device, server or edge device, VM, or container) needs to use the AI ​​model, the user's device can either actively load the model file, or the model owner's device can actively send the model file to the user's device, enabling the user's device to load and execute the model file.

[0089] A server is a physical machine. A VM or container can be a virtualized device created by virtualizing the hardware resources of a physical machine.

[0090] A terminal device (also known as user equipment, UE) is a device with wireless transceiver capabilities. It can be deployed on land, including indoors or outdoors, handheld or vehicle-mounted; on water (such as on ships); and in the air (such as on airplanes, balloons, and satellites). Examples of terminal devices include smartphones, tablets, computers with wireless transceiver capabilities, IoT devices, virtual reality (VR) terminals, augmented reality (AR) terminals, wireless terminals in industrial control, wireless terminals in self-driving vehicles, wireless terminals in remote medical care, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, and wireless terminals in smart homes.

[0091] (3) Calculation graph

[0092] A computational graph is a way to represent mathematical functions using graph theory, that is, to graphically represent the computation process. Generally, a computational graph is defined as a directed graph consisting of nodes and edges. In a computational graph, input values ​​and computation functions appear as nodes, while the relationships between the outputs of nodes are represented by directed line segments (i.e., edges between nodes).

[0093] (4) Expression

[0094] An expression is a combination of numbers, operators, number grouping symbols (parentheses), free variables, and bound variables arranged in a meaningful way that yields a numerical value. Simply put, an expression is a formula composed of operands and operators; it is a computer instruction with complete meaning. For example, the expression could be (x+6)*3*COS(1) / 2*8+7.

[0095] (5) Opaque predicates

[0096] An opaque predicate is an expression. The value of an opaque predicate is known to the writer of the predicate at a certain point in the execution process, but the compiler or static analyzer cannot infer this value; the value of the opaque predicate can only be determined when the predicate is executed.

[0097] (6) Trusted Execution Environment (TEE)

[0098] A Trusted Execution Environment (TEE) is a secure area built within a central processing unit (CPU) using hardware and software methods to ensure the confidentiality and integrity of programs and data loaded within it. Simply put, a TEE is a secure area within the CPU where the CPU ensures the confidentiality and integrity of code and data; that is, code and data running within a TEE are confidential and cannot be tampered with.

[0099] (7) Obfuscated code

[0100] Code obfuscation, also known as junk code, is the process of transforming computer program code into a functionally equivalent but difficult-to-read and understand form. Code obfuscation can be applied to program source code or intermediate code compiled from the program. A program that performs code obfuscation is called a code obfuscator.

[0101] In simple terms, code obfuscation can refer to rewriting the names of various elements in code (such as variables, functions, and classes) into meaningless names. For example, rewriting elements in code as single letters, short, meaningless combinations of letters, or even symbols like "__", making it impossible for the reader to guess their purpose from the name. Code obfuscation can also involve rewriting parts of the logic in code, transforming them into functionally equivalent but more difficult-to-understand forms. For example, rewriting a for loop into a while loop, rewriting a loop into recursion, simplifying intermediate variables, etc. Code obfuscation can also involve disrupting the format of the code. For example, removing spaces, squeezing multiple lines of code into one line, or breaking one line of code into multiple lines, etc.

[0102] Currently, AI service providers typically train and optimize AI models in their local training environments, obtaining the corresponding model files. These model files are then deployed to the user's deployment environment (e.g., a terminal device). When the AI ​​model files are deployed in plaintext, they are vulnerable to theft by malicious actors. For an example, please refer to [link to relevant documentation]. Figure 1 , Figure 1 This is a schematic diagram illustrating a plaintext deployment of a model file, provided as an embodiment of this application. For example... Figure 1 As shown, the AI ​​service provider trains an AI model in a model training environment and generates a model file for the AI ​​model. Then, the AI ​​service provider deploys the plaintext model file to a model deployment environment, enabling the AI ​​computing framework in the deployment environment to execute the AI ​​model by importing the model file. However, because the model file is deployed in plaintext form, malicious actors can attack the deployment environment to directly steal the model file and obtain the stolen model.

[0103] To address the issue of AI models being easily stolen, several model confidentiality protection schemes have been proposed in the industry. For example, please refer to... Figure 2 , Figure 2 This is a schematic diagram illustrating an encrypted deployment of a model file, as provided in an embodiment of this application. Figure 2 As shown, the AI ​​service provider trains the AI ​​model in the model training environment and generates the model file. Then, the AI ​​service provider encrypts the model file using an encryption algorithm and deploys the encrypted model file to the model user's deployment environment. When the model user needs to use the AI ​​model, the application triggers the decryption of the model file, which is then stored in memory, allowing the AI ​​model to be executed in memory.

[0104] Figure 2 While the example scheme can protect the confidentiality of the AI ​​model, it requires decrypting the entire AI model before each inference operation, resulting in huge computational overhead. This significantly increases the inference latency of the AI ​​model and severely limits its application.

[0105] Based on this, this application provides a model processing method. On the basis of the original computational logic of the AI ​​model, a scrambling branch is added parallel to the computational branches in the AI ​​model. The execution relationship between the computational branches and the scrambling branch is determined by an expression; the correct computational branch is only executed when the expression's output is correct. In this way, the newly added scrambling branch obscures the explicit operator execution order and dependencies in the original model, achieving model structure scrambling. Furthermore, only the newly added expression needs to be encrypted for protection, thus protecting the entire normal execution flow of the AI ​​model. This reduces the additional performance overhead associated with model protection and facilitates the widespread application of AI models.

[0106] Please see Figure 3 , Figure 3 This is a schematic diagram illustrating an application scenario of a model processing method provided in an embodiment of this application. For example... Figure 3 As shown, in the model obfuscation stage, the computation graph corresponding to the original model file is obtained by parsing the original model file. Then, the obtained computation graph is processed using the model processing method provided in this embodiment, and an obfuscated model file is generated based on the processed computation graph. The obfuscated model file can be deployed in the model user's environment. Thus, in the model inference stage, the AI ​​application can obtain the obfuscated model file and inference data, and load the obfuscated model. By executing the model-based data processing method provided in this embodiment, inference can be performed based on the obfuscated model to obtain inference results.

[0107] Specifically, the model processing method and the model-based data processing method provided in the embodiments of this application can be applied to electronic devices or virtualization devices, such as the servers and terminal devices mentioned above; and the virtualization devices such as the virtual machines and containers mentioned above.

[0108] For ease of understanding, the methods provided in this application embodiment will be described below from the perspectives of the model processing stage and the model usage stage. Furthermore, for ease of description, the method provided in this application embodiment will be described using the example of the model processing stage being executed on a server and the model usage stage being executed on a terminal device. In practical applications, the model processing stage is not limited to execution on a server, nor is the model usage stage limited to execution on a terminal device.

[0109] Please see Figure 4 , Figure 4 This is a flowchart illustrating a model processing method provided in an embodiment of this application. Figure 4 As shown, the processing method of this model includes the following steps 401-403.

[0110] Step 401: Obtain a first computation graph. The first computation graph is used to indicate the execution logic of the AI ​​model. The first computation graph includes at least one operator.

[0111] In this embodiment, the server can obtain the first computation graph by parsing the model file of the AI ​​model. The first computation graph can be a partial execution logic indicating the AI ​​model, or it can be the complete execution logic indicating the entire AI model.

[0112] Generally, an AI model includes multiple computational units, such as convolutional units, pooling units, or addition units, which are various types of units used to perform corresponding calculations. Each computational unit can be called an operator. The execution logic of an AI model is the order in which each computational unit is executed and the dependencies between them. Therefore, when a computational graph is used to represent the computational units in an AI model and the input or output relationships between them, the first computational graph mentioned above can indicate the execution logic of the AI ​​model.

[0113] Optionally, the first computation graph may include all or some operators in the AI ​​model. Furthermore, the operators in the first computation graph can be of one or more types, and there can be one or more operators of the same type. The type of operator typically represents the computational attribute of the operator, such as: convolution type, pooling type, addition type, batch normalization type, or linear correction type, etc. Specifically, a convolution type operator refers to an operator used for convolution operations, a pooling type operator refers to an operator used for pooling operations, an addition type operator refers to an operator used for addition operations, a batch normalization type operator refers to an operator used for batch normalization, and a linear correction type operator refers to an operator used for linear correction. In addition, each operator in the first computation graph will have a unique identifier or a unique name, such as: convolution operator 1, convolution operator 2, pooling operator 1, or addition operator 1, etc.

[0114] Optionally, before the server executes the method provided in this application embodiment, the user can specify the operators in the AI ​​model that need obfuscation protection. For example, the user can specify one or more operators in the AI ​​model that need obfuscation protection; or, the user can specify one or more types of operators in the AI ​​model that need obfuscation protection. In this way, when the server parses the model file of the AI ​​model, it can determine a first computation graph based on the operators that need obfuscation protection specified by the user, and the first computation graph includes the operators that need obfuscation protection.

[0115] Step 402: Based on the first computation graph, generate a second computation graph. The second computation graph includes at least one computation branch, at least one obfuscated branch, and a first expression. The output of the first expression is used to indicate the execution of at least one computation branch or a branch in at least one obfuscated branch. At least one operator is contained in at least one computation branch. At least one computation branch and at least one obfuscated branch have different computation logic.

[0116] In this embodiment, in the second computation graph, the first expression can be connected to at least one computation branch and at least one obfuscation branch. Furthermore, during the execution of the second computation graph, the first expression is executed first, and a branch from at least one computation branch or at least one obfuscation branch is selected for execution based on the output of the first expression. The at least one computation branch is executed only if the output of the first expression is a preset target value; otherwise, the at least one obfuscation branch is executed. The preset target value can include one or more values.

[0117] Specifically, at least one operator in the first computation graph is included in at least one computation branch in the second computation graph. Therefore, when the output of the first expression is a preset target value, at least one computation branch in the second computation graph is executed, thereby ensuring that the actual computation logic is the same as the computation logic of the original AI model; when the output of the first expression is not a preset target value, at least one obfuscation branch in the second computation graph is executed, making the actual computation logic different from the computation logic of the original AI model, thereby protecting the AI ​​model.

[0118] Step 403: Generate the execution code corresponding to the AI ​​model based on the second computation graph. The target code in the execution code is configured to be encrypted and protected. The target code is the code related to the first expression.

[0119] After obtaining the second computation graph, the server can generate executable code corresponding to the AI ​​model based on the computational logic of the second computation graph, so as to deploy the AI ​​model to other devices. Specifically, in the executable code generated by the server, the target code related to the first expression is configured to be encrypted, while other parts of the executable code can be left unencrypted.

[0120] Since the output of the first expression in the second computation graph can affect the execution of computational branches and obfuscation branches, encrypting the target code of the first expression can protect the computational logic of the second computation graph. Simply put, even if an attacker steals the AI ​​model by intercepting its execution code, the encrypted target code of the first expression prevents the attacker from accessing its computational logic, thus preventing them from obtaining the correct output value and ultimately the correct execution logic of the AI ​​model.

[0121] In this embodiment, an obfuscated branch is added parallel to the computational branches in the AI ​​model, based on the original computational logic. The execution relationship between the computational branches and the obfuscated branch is determined by an expression; the correct computational branch is executed only when the expression's output is correct. This new obfuscated branch blurs the explicit operator execution order and dependencies in the original model, effectively scrambling the model structure. Furthermore, only the newly added expression needs to be encrypted for protection, thus protecting the entire normal execution flow of the AI ​​model. This reduces the additional performance overhead associated with model protection and facilitates the widespread application of the AI ​​model.

[0122] Optionally, there are several ways to configure the target code associated with the first expression for cryptographic protection.

[0123] In one possible implementation, the target code associated with the first expression is configured to run in a trusted execution environment. When the user's terminal device needs to run the AI ​​model, the device loads the target code into the trusted execution environment, thereby achieving cryptographic protection for the target code based on the trusted execution environment.

[0124] Understandably, since a trusted execution environment is a secure area built in a central processing unit based on hardware and software methods, when the target code is configured to run in a trusted execution environment, the terminal device of the model user needs to support the trusted execution environment itself, that is, the terminal device that needs to load the AI ​​model has certain hardware requirements.

[0125] In another possible implementation, the target code is configured for code obfuscation. In this way, even when the target code is not configured for obfuscation, it will be transformed into functionally identical but difficult-to-read and understand code, thus protecting the target code without affecting its normal execution.

[0126] In another possible implementation, the target code is configured to be encrypted using an encryption algorithm. This encryption algorithm can be, for example, Advanced Encryption Standard (AES), Data Encryption Standard (DES), International Data Encryption Algorithm (IDEA), or RSA. This embodiment does not specifically limit the type of encryption algorithm. When the user's terminal device needs to run the AI ​​model, the terminal device must first decrypt the target code using a decryption algorithm to obtain the decrypted code, and then use the decrypted code to obtain the first expression.

[0127] In some examples, the server can also employ multiple implementation methods described above to simultaneously encrypt and protect the target code related to the first expression. Simply put, the target code is configured to run in a trusted execution environment, and simultaneously configured to be encrypted using an encryption algorithm. Thus, when the user's terminal device needs to run the AI ​​model, the terminal device can either decrypt the target code in the trusted execution environment to obtain the decrypted code, and then retrieve the first expression based on the decrypted code; or, the terminal device can decrypt the target code and run the decrypted code in the trusted execution environment to obtain the first expression.

[0128] In addition to encrypting the target code related to the first expression, the first expression itself can also be protected. For example, the first expression can be an opaque predicate, and the server uses an opaque predicate as the first expression. In this way, when the target code corresponding to the first expression is obtained, its value cannot be inferred from the target code; rather, its value can only be obtained during the execution of the target code, thus achieving the hiding and protection of the first expression.

[0129] The above describes the process of encrypting and protecting an AI model by generating a new computation graph. To facilitate understanding, the following will detail the specific process of generating a new computation graph based on the original computation graph of the AI ​​model.

[0130] In this embodiment, there are multiple ways for the server to generate the second computation graph based on the first computation graph.

[0131] Implementation method 1: The server generates a second computation graph with one computation branch, at least one obfuscated branch, and a first expression.

[0132] The computational branches in the second computational graph include at least one operator in the first computational graph, and the output of the first expression is used to indicate the execution of the computational branches and one of the at least one obfuscated branches.

[0133] In simple terms, in implementation method 1, a computational branch in the second computation graph includes all operators in the first computation graph and the dependencies between them. By executing a computational branch in the second computation graph, the computational logic in the first computation graph can be implemented. Furthermore, the first expression can be connected to one computational branch and at least one obfuscated branch, respectively, to indicate the execution of any one of these branches. A computational branch in the second computation graph will only be executed if the output of the first expression is correct; otherwise, if the output of the first expression is incorrect, one of the at least one obfuscated branch in the second computation graph will be executed.

[0134] For example, see Figure 5A , Figure 5A This is a schematic diagram illustrating a structure for generating a second computational graph based on a first computational graph, as provided in an embodiment of this application. Figure 5A As shown, the first computational graph includes three operators connected in sequence: a convolution operator, a batch normalization operator, and a linear correction operator. The input to the convolution operator is the input to the first computational graph, the input to the batch normalization operator is the output of the convolution operator, and the input to the linear correction operator is the output of the batch normalization operator. The output of the linear correction operator is the output of the first computational graph. In the second computational graph generated based on the first computational graph, the sequentially connected convolution operator, batch normalization operator, and linear correction operator form a computational branch in the second computational graph. The second computational graph also includes a confusion branch parallel to the computational branch, and both the computational branch and the confusion branch are connected to the first expression. In the second computational graph, the branch to be executed is determined based on the value of the output of the first expression. Specifically, if the value of the output of the first expression is a preset target value, the computational branch is executed, thereby implementing the computational logic shown in the first computational graph, making the output of the second computational graph the same as the output of the first computational graph; if the value of the output of the first expression is not the preset target value, the confusion branch is executed, thereby implementing a different computational logic from the first computational graph, making the output of the second computational graph different from the output of the first computational graph.

[0135] For example, see Figure 5B , Figure 5B This is another schematic diagram illustrating a structure for generating a second computational graph based on a first computational graph, as provided in an embodiment of this application. For example... Figure 5B As shown, Figure 5B The first computational graph in Figure 5A The first computational graph shown is the same; and, Figure 5BThe computational branches of the second computational graph and Figure 5A The computational branches in the first computational graph are the same, the difference being... Figure 5B The second computational graph includes multiple obfuscation branches, namely obfuscation branch 1, obfuscation branch 2, ..., obfuscation branch N. Figure 5B In the second computation graph shown, when the output of the first expression is a correct value, the computation branch is executed; when the output of the first expression is an error value 1, obfuscation branch 1 is executed; when the output of the first expression is an error value 2, obfuscation branch 2 is executed; and when the output of the first expression is an error value N, obfuscation branch N is executed.

[0136] In this scheme, by setting one or more obfuscated branches parallel to the computation branches in the second computation graph, the execution order and dependencies of explicit operators in the original model can be effectively obscured, thereby scrambling the model structure and improving the confidentiality protection of the model.

[0137] Implementation method 2: The server generates a second computation graph with multiple computation branches, at least one obfuscated branch, and a first expression.

[0138] The first expression is connected to multiple computation branches and at least one obfuscated branch, indicating the orderly execution of multiple computation branches and multiple branches within the obfuscated branch. When the output of the first expression is a preset target value, the first expression indicates the orderly execution of multiple computation branches; when the output of the first expression is not the preset target value, the first expression indicates the orderly execution of other multiple branches or the unordered execution of multiple computation branches. In general, the computational logic of the second computation graph is the same as that of the first computation graph only when the output of the first expression is the preset target value; when the output of the first expression is not the preset target value, the computational logic of the second computation graph is different from that of the first computation graph.

[0139] For example, please refer to Figure 6A , Figure 6A This is another schematic diagram illustrating a structure for generating a second computational graph based on a first computational graph, as provided in an embodiment of this application. For example... Figure 6A As shown, Figure 6A The first computational graph in Figure 5A The first computational graph shown is the same. Furthermore, Figure 6A The second computational graph in the model comprises multiple parallel computational branches and multiple obfuscated branches, each of which includes an operator. Specifically, in Figure 6AIn the second computational graph, six branches are arranged from left to right. The first branch includes a convolution operator, the second branch is obfuscation branch 1, the third branch includes a batch normalization operator, the fourth branch is obfuscation branch 2, the fifth branch includes a linear correction operator, and the sixth branch is obfuscation branch 3. Furthermore, these six branches are connected to a conditional expression used to determine the number of branches executed; this conditional expression is connected to a first expression, used to determine the next branch to continue execution after each branch has been completed, based on the output value of the first expression.

[0140] Please see Figure 6B , Figure 6B This is a schematic diagram illustrating the operation of a second computational graph provided in an embodiment of this application. For example... Figure 6B The execution steps of the second computation graph consist of seven steps. Step 1: Run the first expression and determine the computation branch to be executed, including the convolution operator, based on the output value of the first expression. Step 2: Execute the convolution operator and determine whether three branches have been executed based on a conditional statement. Step 3: Based on the output value of the first expression, determine that the second branch to be executed is a computation branch including the batch normalization operator. Step 4: Execute the batch normalization operator and determine whether three branches have been executed based on a conditional statement. Step 5: Based on the output value of the first expression, determine that the third branch to be executed is a computation branch including the linear correction operator. Step 6: Execute the linear correction operator and determine whether three branches have been executed based on a conditional statement. Step 7: Output the result obtained from executing the linear correction operator as the output value.

[0141] Depend on Figure 6B It can be seen that, based on Figure 6A The second computation graph shown can execute multiple operators shown in the first computation graph in an orderly manner, so that the computation logic of the second computation graph is the same as that of the first computation graph.

[0142] In addition, Figure 6A When the output of the first expression is an error value, the computational logic of the second computation graph is not to execute the first, third, and fifth branches sequentially, thus making the computational logic of the second computation graph different from that of the first computation graph. For example, when the output of the first expression is error value 1, the computational logic of the second computation graph can be to execute the second, fourth, and sixth branches sequentially. As another example, when the output of the first expression is error value 2, the computational logic of the second computation graph can be to execute the second, third, and fourth branches sequentially.

[0143] Implementation method 3: The server generates a second computation graph with multiple computation branches, at least one obfuscated branch, a first expression, and a second expression.

[0144] The output of the first expression indicates the execution of one of the multiple computational branches and at least one obfuscated branch. The second expression is concatenated with the multiple computational branches and at least one obfuscated branch, and indicates the number of times the first expression is executed. Furthermore, the input of the first expression is related to the previously executed branch.

[0145] Specifically, the input of the second expression is related to the branch executed in the previous execution, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0146] During the execution of the second computation graph, based on the input value, the first expression is run to obtain its output value. Then, based on the output value of the first expression, the branch to be executed is determined. After executing the branch, the second expression is executed to determine whether to continue looping through the first expression. If it is determined to continue looping through the first expression, based on the output value obtained from the executed branch, the first expression is executed again to determine the next branch to be executed. By repeatedly executing the above steps until the output value of the second expression determines the termination of the loop through the first expression, multiple computation branches are executed sequentially, making the computational logic of the second computation graph the same as that of the first computation graph.

[0147] For example, please refer to Figure 7A , Figure 7A This is another schematic diagram illustrating a structure for generating a second computational graph based on a first computational graph, as provided in an embodiment of this application. For example... Figure 7A As shown, Figure 7A The first computational graph in Figure 5A The first computational graph shown is the same. Furthermore, Figure 7A The second computation graph comprises multiple parallel computational branches and multiple obfuscated branches, each of which includes an operator. Furthermore, for each of the computational and obfuscated branches, there are computational expressions (i.e., expressions P1, P2, P3, P4, P5, P6, etc.) used to assign values ​​to the variable `next`. Additionally, the first expression includes two inputs: one is the input for the subsequent executed branch, and the other is the variable `next`. The first expression is used to obtain the corresponding output based on the value of the variable `next`. The second expression, based on the value assigned to the variable `next` in the previously executed branch, determines whether to continue with the first expression.

[0148] For example, please refer to Figure 7B , Figure 7B This is a schematic diagram illustrating the execution of a second computational graph, provided as an embodiment of this application. For example... Figure 7BAs shown, the first expression is a switch operator used to select the corresponding branch based on the value of the variable next. The initial input of the first expression is next = P0, and based on this initial input, the first expression selects the branch that includes the convolution operator.

[0149] When executing a branch that includes a convolution operator, the branch simultaneously assigns the value of the variable `next` to the output value of expression P1. The values ​​of expressions P1 through P4 are all less than the value of expression P5, and the value of expression P6 is greater than the value of expression P5.

[0150] After executing the branch including the convolution operator, the second expression is executed. It is determined whether the value of next is greater than or equal to the output value of expression P5. If the current value of next is less than the output value of expression P5, the first expression is executed in a loop.

[0151] When the first expression is executed for the second time, the input of the first expression includes the output after the convolution operator is executed, and next = P1; based on next = P1, the first expression selects to execute the branch that includes the batch normalization operator, and uses the output after the convolution operator is executed as the input of the batch normalization operator.

[0152] When executing a branch that includes the batch normalization operator, the branch simultaneously assigns the value of the variable next to the output value of expression P3.

[0153] After executing the branch including the batch normalization operator, the second expression is executed. It is determined whether the value of next is greater than or equal to the output value of expression P5. If the current value of next is less than the output value of expression P5, the first expression is executed in a loop.

[0154] When the first expression is executed for the third time, the input of the first expression includes the output after executing the batch normalization operator and next = P3; based on next = P3, the first expression selects to execute the branch that includes the linear correction operator, and uses the output after executing the batch normalization operator as the input of the linear correction operator.

[0155] After executing the branch including the linear correction operator, the second expression is executed. It is determined whether the value of next is greater than or equal to the output value of expression P5. Based on the fact that the current value of next is equal to the output value of expression P5, the first expression is not executed again in a loop, and the output value of the linear correction operator is output.

[0156] In general, Figure 7B In the second computation graph shown, the combination of the variable next, the first expression, and the second expression enables the orderly execution of multiple computation branches, making the computation logic of the second computation graph the same as that of the first computation graph.

[0157] In implementation methods 1 and 2 described above, the initial input of the first expression can include a first numerical value, which is configured to be encrypted. That is, the initial input of the first expression can be fixed; only when the initial input of the first expression is the first numerical value can the first expression output the correct value, thus ensuring that the computational logic of the second computation graph is the same as that of the first computation graph. Furthermore, by configuring the first numerical value for encryption protection, the output of the first expression can be protected. Even if an attacker obtains the entire second computation graph, they will be unable to obtain the correct input value of the first expression and therefore will be unable to access the correct computational logic of the second computation graph, thus achieving model confidentiality protection.

[0158] Furthermore, the initial input to the first expression can also include the output of a calculated expression, which is obtained by processing the first numerical value. Similarly, the first expression can only output a correct value if the input to the calculated expression is the first numerical value.

[0159] For example, taking implementation method 1 as an example, the second calculation graph when the input of the first expression also includes a first numerical value will be described below with reference to the accompanying drawings. Please refer to... Figure 8 , Figure 8 This is another schematic diagram illustrating a structure for generating a second computational graph based on a first computational graph, as provided in an embodiment of this application. For example... Figure 8 As shown, Figure 8 The first computational graph in Figure 5A The first computational graph shown is the same. Figure 8 The second computation graph includes computational branches and obfuscation branches. The first expression has two inputs: one input serves as the input for subsequent computational or obfuscation branches, and the other input serves as the input for the first expression itself. This other input can be a first numerical value or the output value obtained by the computational expression based on the first numerical value. Only when the input to the first expression itself is correct, and the input to either the first expression or the computational expression is the first numerical value, will the output of the first expression be the preset target value, meaning the second computation graph will execute the computational branch. Otherwise, if the input to either the first expression or the computational expression is not the first numerical value, the output of the first expression will not be the preset target value, and the second computation graph will execute the obfuscation branch, thus making the actual computational logic of the second computation graph different from that of the first computation graph.

[0160] The above describes how to scramble the AI ​​model structure by generating a second computational graph, thereby protecting the confidentiality of the AI ​​model. The following will introduce another method for protecting the confidentiality of AI models from a different perspective.

[0161] In this embodiment, the server may scramble the weight parameters of the operators in the AI ​​model to prevent attackers from stealing the AI ​​model by misusing the various operators in the AI ​​model.

[0162] For example, the server can obtain a third computation graph, which is used to indicate the execution logic of the AI ​​model, and the third computation graph includes a first operator. The third computation graph and the aforementioned first computation graph can be two different computation graphs in the AI ​​model; the third computation graph can also be a sub-computation graph of the first computation graph, meaning that the first operator included in the third computation graph is one of multiple operators in the first computation graph.

[0163] Based on the third computation graph, a fourth computation graph is generated. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. In other words, the server modifies the weight parameters of the first operator in the third computation graph to obtain the second operator in the fourth computation graph. Furthermore, the server inserts the third expression after the second operator so that the output value of the combination of the second operator and the third expression is the same as the output value of the first operator, thus maintaining the computation result of the fourth computation graph unchanged from that of the third computation graph.

[0164] In simple terms, if the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator, the output of the second operator will inevitably be different from the output of the first operator based on the same input. Therefore, by introducing a third expression, the output of the second operator can be converted into the same value as the output of the first operator.

[0165] After obtaining the fourth computation graph, the server can generate the executable code corresponding to the AI ​​model based on the second and fourth computation graphs.

[0166] Optionally, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second numerical value. The input of the third expression includes the second numerical value, and the second numerical value is configured to be encrypted. That is, the third expression can only convert the output of the second operator to be the same as the output of the first operator if the input of the third expression is the second numerical value; otherwise, if the input of the third expression is not the second numerical value, the third expression cannot convert the output of the second operator to be the same as the output of the first operator.

[0167] The second value can be configured to be encrypted in the same way as the first expression described in the above embodiments, that is, the second value is configured to be encrypted using an encryption algorithm and / or run in a trusted execution environment. Please refer to the above embodiments for details, which will not be repeated here.

[0168] For example, please refer to Figure 9 , Figure 9 This is a schematic diagram illustrating how a fourth computational graph is obtained based on a third computational graph, as provided in an embodiment of this application. For example... Figure 9 As shown, the third computational graph includes convolution operator 1, whose calculation formula is y = x * w + b; where y is the output value, x is the input value, and w and b are weight parameters. The fourth computational graph obtained based on the third computational graph includes convolution operator 2 and a third expression. Convolution operator 2 is obtained by modifying the weight parameter w in convolution operator 1, and its calculation formula is y = x * w' + b; where w' = w + r, or w' = w + S(r), r is the first value, and S(r) is the value of r after processing by the computational expression. Furthermore, the input to the third expression includes the output of convolution operator 2 and the first value or the output of the first value after processing by the computational expression. When the inputs of convolution operator 1 and convolution operator 2 are the same, the output of the third expression is the same as the output of convolution operator 1. That is, assuming the third expression is D, for any input x, the following equation is satisfied: D(r, x * w' + b) = x * w + b.

[0169] As can be seen from the above example, if the first value of the third expression is incorrect, the third expression cannot convert the output of the second operator into the output of the first operator. Therefore, by encrypting the first value, the computational logic in the fourth computation graph can be protected, thereby protecting the normal execution process of the entire AI model and reducing the additional performance overhead caused by model protection.

[0170] The above describes a model processing method provided by an embodiment of this application. The following will describe a method for processing data based on the model after obtaining the confused model.

[0171] Please see Figure 10 , Figure 10 This is a flowchart illustrating a model-based data processing method provided in an embodiment of this application. Figure 10 As shown, the model-based data processing method includes the following steps 1001-1003.

[0172] Step 1001: Based on the execution code of the AI ​​model, obtain a second computation graph. The second computation graph includes at least one computation branch, at least one obfuscated branch, and a first expression. The output of the first expression is used to indicate the execution of at least one computation branch or a branch in at least one obfuscated branch. At least one computation branch includes at least one operator of the AI ​​model. At least one computation branch and at least one obfuscated branch have different computation logic. The target code related to the first expression in the execution code is configured to be encrypted and protected.

[0173] In this embodiment, the execution code of the AI ​​model is based on the above. Figure 4 The second computational graph is obtained by the processing method of the model described in the corresponding embodiment. Therefore, the terminal device can obtain the second computational graph by parsing the execution code of the AI ​​model. The second computational graph described in this embodiment is... Figure 4 The second computational graph described in the corresponding embodiment is similar; please refer to the above for details. Figure 4 The corresponding implementation examples will not be described in detail here.

[0174] Step 1002: Obtain the input data for the AI ​​model.

[0175] The input data of the AI ​​model is the data to be processed. For example, if the AI ​​model is an image processing model (such as an image classification model or an image segmentation model), the input data can be image data; if the AI ​​model is a speech processing model (such as a speech recognition model), the input data can be speech data. In short, the input data of the AI ​​model can be determined according to the actual type of the AI ​​model, and this embodiment does not limit the type of input data of the AI ​​model.

[0176] Step 1003: Process the input data based on the second computation graph to obtain the output data of the AI ​​model.

[0177] With a second computational graph, the terminal device can process the input data based on the second computational graph to obtain the output data of the AI ​​model. If the second computational graph is a part of the AI ​​model's computational graph, the terminal device can also process the input data based on the second computational graph and other computational graphs to obtain the AI ​​model's output data.

[0178] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0179] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and at least one obfuscated branch; the second expression is connected to the multiple computation branches and at least one obfuscated branch, the second expression is used to indicate the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0180] In one possible implementation, the input to the second expression is related to the branch executed in the previous execution, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0181] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0182] In one possible implementation, the target code is configured to run in a trusted execution environment; the execution code based on the AI ​​model obtains a second computation graph, including: the terminal device runs the target code in the trusted execution environment to obtain a first expression in the second computation graph.

[0183] In one possible implementation, the target code is configured to be encrypted using an encryption algorithm. The terminal device can decrypt the target code in the executable code to obtain the decrypted code; and the terminal device executes the decrypted code to obtain the first expression.

[0184] In one possible implementation, the method further includes: obtaining a fourth computation graph based on the execution code of the AI ​​model, the fourth computation graph including a second operator and a third expression, the second operator being obtained by modifying the weight parameters of the first operator in the AI ​​model, the input of the third expression including the output of the second operator, and the output of the third expression being the same as the output of the first operator when using the same input as the second operator; and processing the input data based on the second computation graph, including: processing the input data based on the second computation graph and the fourth computation graph.

[0185] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0186] To facilitate understanding, the following will introduce the model processing method and model-based data processing method provided in the embodiments of this application with specific examples.

[0187] Please see Figure 11 , Figure 11 This document provides a processing model and a flowchart illustrating the data processing based on the model, as provided in an embodiment of this application.

[0188] In the model obfuscation stage, the computation graph corresponding to the original model file is obtained by parsing the original model file. Then, the obtained computation graph is obfuscated by the model processing method provided in the embodiments of this application, including control flow structure obfuscation, encrypted data structure obfuscation, and / or model weight obfuscation based on encrypted data, to obtain an obfuscated model file.

[0189] Control flow obfuscation refers to adding obfuscated branches to blur the execution order and dependencies of explicit operators in the computation graph, thereby hiding the actual computational logic of the model. The method of adding obfuscated branches is as described above. Figures 5A to 7B As described in the corresponding embodiment, the server generates a dummy subgraph corresponding to the computational subgraph to be protected, and combines it with a user-defined opaque predicate expression (i.e., the first expression mentioned above) to establish a switch operator structure. One branch of the switch operator structure is the computational subgraph to be protected, and the other branch is a dummy subgraph or expression, thereby obscuring the dependencies between operators. Alternatively, a certain number of dummy subgraphs and computational expressions for determining branch selection are generated for the computational subgraph to be protected. Using a switch operator, the computational subgraph to be protected and the dummy subgraph are inserted into each branch of the switch, respectively. The execution order of the branches is controlled by the computational expressions and user-defined opaque predicates, thereby hiding the execution order of the model operators.

[0190] Encrypted data structure obfuscation refers to obfuscating the model structure based on encrypted data, specifically as follows: Figure 8 As described in the corresponding embodiment, specifically, the server generates a corresponding fake subgraph and computation expression for the computation subgraph to be protected. By introducing externally generated random numbers, these random numbers are used as input conditions into the computation expression to determine the execution branches of the control flow structure. During inference, only when the correct random number is input can the obfuscated model output the correct result, thereby preventing model theft.

[0191] Model weight obfuscation based on encrypted data refers to scrambling each weight that needs protection by using externally generated random noise, with different random noise used for each weight. To ensure that weight obfuscation does not affect the correctness of the model execution results, a new subgraph (i.e., the third expression described in the above embodiment) needs to be added after the weight-obfuscated operator. The results of the operator with random noise and the weight-obfuscated operator are passed into this new subgraph. The new subgraph can restore the unobfuscated output of the protected operator, thus ensuring that weight obfuscation does not affect the accuracy of the model execution results.

[0192] During the model obfuscation stage, since random numbers are used in the model obfuscation process, these random numbers can be encrypted to generate metadata files.

[0193] After the model is obfuscated, the obfuscated model file and the corresponding encrypted metadata file are deployed to the terminal device.

[0194] During the model inference phase, the terminal device loads and parses the obfuscated model file to obtain the computational graph of the AI ​​model. Then, the terminal device decrypts the metadata file to obtain a set of random numbers; this decryption process can be performed in a trusted execution environment. After obtaining the random number set, the terminal device, based on the inference data input from the AI ​​application and the decrypted random numbers, traverses each computational unit in the execution task sequence and directly performs obfuscated model inference to obtain the inference result.

[0195] The methods provided in the embodiments of this application have been described above. For ease of understanding, the apparatus for performing the methods described in the above embodiments will be described below.

[0196] Please see Figure 12 , Figure 12 This is a schematic diagram of a model processing device provided in an embodiment of this application. Figure 12 As shown, the processing device for this model includes: an acquisition module 1201, used to acquire a first computation graph, the first computation graph being used to indicate the execution logic of the AI ​​model, the first computation graph including at least one operator; a processing module 1202, used to generate a second computation graph based on the first computation graph, the second computation graph including at least one computation branch, at least one obfuscation branch and a first expression, the output of the first expression being used to indicate the execution of a branch in the at least one computation branch or a branch in the at least one obfuscation branch, the at least one operator being included in the at least one computation branch, the at least one computation branch having different computation logic from the at least one obfuscation branch; and a processing module 1202, used to generate execution code corresponding to the AI ​​model according to the second computation graph, wherein the target code related to the first expression in the execution code is configured to be encrypted and protected.

[0197] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0198] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and the at least one obfuscated branch; the second expression is connected to the multiple computation branches and the at least one obfuscated branch, the second expression is used to indicate the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0199] In one possible implementation, the input of the second expression is related to the previously executed branch, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0200] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0201] In one possible implementation, the target code is configured to run in a trusted execution environment.

[0202] In one possible implementation, the target code is configured to be encrypted and protected using an encryption algorithm.

[0203] In one possible implementation, the acquisition module 1201 is further configured to acquire a third computation graph, which is used to indicate the execution logic of the AI ​​model, and the third computation graph includes a first operator; the processing module 1202 is further configured to: generate a fourth computation graph based on the third computation graph, the fourth computation graph including a second operator and a third expression, wherein the second operator is obtained by modifying the weight parameters of the first operator, the input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator; and generate the execution code corresponding to the AI ​​model according to the second computation graph and the fourth computation graph.

[0204] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on a second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0205] Please see Figure 13 , Figure 13 This is a schematic diagram of the structure of a model-based data processing device provided in an embodiment of this application. Figure 13As shown, the model-based data processing device includes: an acquisition module 1301, used to acquire a second computation graph based on the execution code of an AI model. The second computation graph includes at least one computation branch, at least one obfuscated branch, and a first expression. The output of the first expression is used to indicate the execution of a branch in the at least one computation branch or a branch in the at least one obfuscated branch. The at least one computation branch includes at least one operator of the AI ​​model. The at least one computation branch and the at least one obfuscated branch have different computation logic. The target code related to the first expression in the execution code is configured to be encrypted and protected. The acquisition module 1301 is also used to acquire input data of the AI ​​model. The processing module 1302 is also used to process the input data based on the second computation graph to obtain output data of the AI ​​model.

[0206] In one possible implementation, the second computation graph includes only one computation branch; the output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

[0207] In one possible implementation, the second computation graph includes multiple computation branches and also includes a second expression; the output of the first expression is used to indicate the execution of one of the multiple computation branches and the at least one obfuscated branch; the second expression is connected to the multiple computation branches and the at least one obfuscated branch, the second expression is used to indicate the number of times the first expression is executed in a loop, and the input of the first expression is related to the previously executed branch.

[0208] In one possible implementation, the input of the second expression is related to the previously executed branch, and the output of the second expression is used to indicate whether the first expression should be executed repeatedly.

[0209] In one possible implementation, the initial input to the first expression includes a first numerical value, which is configured to be encrypted.

[0210] In one possible implementation, the target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

[0211] In one possible implementation, the target code is configured to be encrypted and protected using an encryption algorithm; the processing module 1302 is further configured to decrypt the target code in the execution code to obtain decrypted code; and execute the decrypted code to obtain the first expression.

[0212] In one possible implementation, the acquisition module 1301 is further configured to acquire a fourth computation graph based on the execution code of the AI ​​model. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator in the AI ​​model. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. The processing module 1302 is further configured to process the input data based on the second computation graph and the fourth computation graph.

[0213] In one possible implementation, the weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on a second value, and the input of the third expression includes the second value, which is configured to be encrypted.

[0214] The following describes an execution device provided in an embodiment of this application. Please refer to [link / reference]. Figure 14 , Figure 14 This is a schematic diagram of an execution device provided in an embodiment of this application. The execution device 1400 can specifically be a mobile phone, tablet, laptop, smart wearable device, server, etc., and is not limited thereto. Specifically, the execution device 1400 includes: a receiver 1401, a transmitter 1402, a processor 1403, and a memory 1404 (wherein the execution device 1400 may have one or more processors 1403). Figure 14 (Taking a processor as an example), processor 1403 may include application processor 14031 and communication processor 14032. In some embodiments of this application, receiver 1401, transmitter 1402, processor 1403 and memory 1404 may be connected via a bus or other means.

[0215] Memory 1404 may include read-only memory and random access memory, and provides instructions and data to processor 1403. A portion of memory 1404 may also include non-volatile random access memory (NVRAM). Memory 1404 stores processor and operation instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operation instructions may include various operation instructions for implementing various operations.

[0216] Processor 1403 controls the operation of the execution device. In specific applications, the various components of the execution device are coupled together through a bus system, which may include not only the data bus, but also power buses, control buses, and status signal buses. However, for clarity, all buses are referred to as the bus system in the diagram.

[0217] The methods disclosed in the embodiments of this application can be applied to or implemented by the processor 1403. The processor 1403 can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 1403 or by instructions in software form. The processor 1403 can be a general-purpose processor, a digital signal processor (DSP), a microprocessor, or a microcontroller, and may further include an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. The processor 1403 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 1404. Processor 1403 reads the information in memory 1404 and, in conjunction with its hardware, completes the steps of the above method.

[0218] Receiver 1401 can be used to receive input digital or character information, and to generate signal inputs related to the settings and function control of the execution device. Transmitter 1402 can be used to output digital or character information through the first interface; transmitter 1402 can also be used to send instructions to the disk group through the first interface to modify the data in the disk group; transmitter 1402 may also include a display device such as a display screen.

[0219] In one embodiment of this application, the processor 1403 is configured to execute... Figure 4 or Figure 10 The method in the corresponding embodiment.

[0220] The electronic device provided in this application embodiment can specifically be a chip, which includes a processing unit and a communication unit. The processing unit can be, for example, a processor, and the communication unit can be, for example, an input / output interface, pins, or circuits. The processing unit can execute computer execution instructions stored in the storage unit to cause the chip in the execution device to execute the model hyperparameter selection method described in the above embodiments, or to cause the chip in the training device to execute the model hyperparameter selection method described in the above embodiments. Optionally, the storage unit is a storage unit within the chip, such as a register or cache. Alternatively, the storage unit can be a storage unit located outside the chip within the wireless access device, such as a read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions, such as random access memory (RAM).

[0221] For details, please refer to Figure 15 , Figure 15 This is a schematic diagram of a chip provided in an embodiment of this application. The chip can be represented as a neural network processor (NPU) 1500. The NPU 1500 is mounted as a coprocessor on the host CPU, and tasks are assigned by the host CPU. The core part of the NPU is the arithmetic circuit 1503, which is controlled by the controller 1504 to extract matrix data from the memory and perform multiplication operations.

[0222] In some implementations, the arithmetic circuit 1503 internally includes multiple processing engines (PEs). In some implementations, the arithmetic circuit 1503 is a two-dimensional pulsating array. The arithmetic circuit 1503 can also be a one-dimensional pulsating array or other electronic circuits capable of performing mathematical operations such as multiplication and addition. In some implementations, the arithmetic circuit 1503 is a general-purpose matrix processor.

[0223] For example, suppose we have an input matrix A, a weight matrix B, and an output matrix C. The arithmetic circuit retrieves the corresponding data of matrix B from the weight memory 1502 and caches it in each PE of the arithmetic circuit. The arithmetic circuit retrieves the data of matrix A from the input memory 1501 and performs matrix operations with matrix B. The partial result or the final result of the obtained matrix is ​​stored in the accumulator 1508.

[0224] Unified memory 1506 is used to store input and output data. Weight data is directly transferred to weight memory 1502 via Direct Memory Access Controller (DMAC) 1505. Input data is also transferred to unified memory 1506 via DMAC.

[0225] BIU stands for Bus Interface Unit, which is used for interaction between the AXI bus and the DMAC and the Instruction Fetch Buffer (IFB) 1509.

[0226] The Bus Interface Unit (BIU) 1515 is used by the instruction fetch memory 1509 to fetch instructions from external memory, and also by the memory access controller 1505 to fetch the original data of the input matrix A or the weight matrix B from external memory.

[0227] The DMAC is mainly used to move input data from external memory DDR to unified memory 1506, or to weight data to weight memory 1502, or to input data to input memory 1501.

[0228] The vector computation unit 1507 includes multiple arithmetic processing units that, when needed, further process the output of the computation circuit 1503, such as vector multiplication, vector addition, exponential operations, logarithmic operations, size comparisons, etc. It is mainly used for computation in non-convolutional / fully connected layers of neural networks, such as batch normalization, pixel-level summation, and upsampling of feature planes.

[0229] In some implementations, the vector computation unit 1507 can store the processed output vector in the unified memory 1506. For example, the vector computation unit 1507 can apply a linear function, or a nonlinear function, to the output of the computation circuit 1503, such as linear interpolation of feature planes extracted by a convolutional layer, or, for example, a vector of accumulated values, to generate activation values. In some implementations, the vector computation unit 1507 generates normalized values, pixel-level summed values, or both. In some implementations, the processed output vector can be used as activation input to the computation circuit 1503, for example, for use in subsequent layers of the neural network.

[0230] The instruction fetch buffer 1509 connected to the controller 1504 is used to store the instructions used by the controller 1504;

[0231] Unified memory 1506, input memory 1501, weighted memory 1502, and instruction fetch memory 1509 are all on-chip memories. External memory is proprietary to this NPU hardware architecture.

[0232] The processor mentioned above can be a general-purpose central processing unit, a microprocessor, an ASIC, or one or more integrated circuits used to control the execution of the above program.

[0233] Please refer to Figure 16 , Figure 16 This is a schematic diagram of a computer-readable storage medium provided in an embodiment of this application. This application also provides a computer-readable storage medium in some embodiments, wherein the above-described... Figure 4 or Figure 10 The disclosed method can be implemented as computer program instructions encoded in a machine-readable format on a computer-readable storage medium or on other non-transitory media or articles of art.

[0234] Figure 16 A conceptual partial view of an example computer-readable storage medium arranged according to at least some of the embodiments shown herein is illustrated schematically. The example computer-readable storage medium includes a computer program for executing computer processes on a computing device.

[0235] In one embodiment, the computer-readable storage medium 1600 is provided using a signal bearer medium 1601. The signal bearer medium 1601 may include one or more program instructions 1602, which, when executed by one or more processors, can provide the above-mentioned... Figure 4 or Figure 10 The described function or part of the function. In addition... Figure 16 The program instruction 1602 in the document also describes example instructions.

[0236] In some examples, the signal carrying medium 1601 may include a computer-readable medium 1603, such as, but not limited to, a hard disk drive, a compact disc (CD), a digital video optical disc (DVD), a digital magnetic tape, a memory, ROM, or RAM, etc.

[0237] In some embodiments, the signal-bearing medium 1601 may comprise a computer-recordable medium 1604, such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, and so on. In some embodiments, the signal-bearing medium 1601 may comprise a communication medium 1605, such as, but not limited to, digital and / or analog communication media (e.g., fiber optic cables, waveguides, wired communication links, wireless communication links, and so on). Therefore, for example, the signal-bearing medium 1601 may be transmitted by a wireless communication medium 1605 (e.g., a wireless communication medium conforming to the IEEE 802.16 standard or other transmission protocols).

[0238] One or more program instructions 1602 may be, for example, computer-executable instructions or logical implementation instructions. In some examples, the computing device may be configured to provide various operations, functions, or actions in response to one or more program instructions 1602 conveyed to the computing device via a computer-readable medium 1603, a computer-recordable medium 1604, and / or a communication medium 1605.

[0239] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0240] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0241] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0242] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A method for processing a model, characterized in that, include: Obtain a first computation graph, which is used to indicate the execution logic of an artificial intelligence (AI) model, and the first computation graph includes at least one operator; Based on the first computation graph, a second computation graph is generated. The second computation graph includes at least one computation branch, at least one obfuscated branch, and a first expression. The output of the first expression is used to indicate the execution of a branch in the at least one computation branch or a branch in the at least one obfuscated branch. The at least one operator is included in the at least one computation branch, and the at least one computation branch and the at least one obfuscated branch have different computation logic. The execution code corresponding to the AI ​​model is generated based on the second computation graph. The target code in the execution code is configured to be encrypted and protected. The target code is the code related to the first expression.

2. The method according to claim 1, characterized in that, The second computation graph includes only one computation branch; The output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

3. The method according to claim 1, characterized in that, The second computation graph includes multiple computation branches, and the second computation graph also includes a second expression; The output of the first expression is used to indicate the execution of one of the plurality of computational branches and the at least one obfuscated branch; The second expression is connected to the plurality of computation branches and the at least one obfuscated branch, and the second expression is used to indicate the number of times the first expression is executed in a loop.

4. The method according to claim 3, characterized in that, The input to the second expression is related to the branch executed in the previous execution, and the output of the second expression is used to determine whether to execute the first expression repeatedly.

5. The method according to any one of claims 1-4, characterized in that, The initial input to the first expression includes a first numerical value, which is configured to be encrypted.

6. The method according to any one of claims 1-4, characterized in that, The target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

7. The method according to any one of claims 1-4, characterized in that, The target code is configured to be encrypted and protected using an encryption algorithm.

8. The method according to any one of claims 1-4, characterized in that, The method further includes: Obtain a third computation graph, which is used to indicate the execution logic of the AI ​​model, and the third computation graph includes a first operator; Based on the third computation graph, a fourth computation graph is generated. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. The step of generating the execution code corresponding to the AI ​​model based on the second computation graph includes: The execution code corresponding to the AI ​​model is generated based on the second computation graph and the fourth computation graph.

9. The method according to claim 8, characterized in that, The weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second value. The input of the third expression includes the second value, and the second value is configured to be encrypted.

10. A model-based data processing method, characterized in that, include: Based on the execution code of the AI ​​model, a second computation graph is obtained. The second computation graph includes at least one computation branch, at least one obfuscated branch, and a first expression. The output of the first expression is used to indicate the execution of a branch in the at least one computation branch or a branch in the at least one obfuscated branch. The at least one computation branch includes at least one operator of the AI ​​model. The at least one computation branch and the at least one obfuscated branch have different computation logic. The target code in the execution code is configured to be encrypted and protected. The target code is the code related to the first expression. Obtain the input data of the AI ​​model; The input data is processed based on the second computation graph to obtain the output data of the AI ​​model.

11. The method according to claim 10, characterized in that, The second computation graph includes only one computation branch; The output of the first expression is used to indicate the execution of the computation branch and one of the at least one obfuscated branches.

12. The method according to claim 10, characterized in that, The second computation graph includes multiple computation branches, and the second computation graph also includes a second expression; The output of the first expression is used to indicate the execution of one of the plurality of computational branches and the at least one obfuscated branch; The second expression is connected to the plurality of computation branches and the at least one obfuscated branch, and the second expression is used to indicate the number of times the first expression is executed in a loop.

13. The method according to claim 12, characterized in that, The input to the second expression is related to the branch executed in the previous execution, and the output of the second expression is used to determine whether to execute the first expression repeatedly.

14. The method according to any one of claims 10-13, characterized in that, The initial input to the first expression includes a first numerical value, which is configured to be encrypted.

15. The method according to any one of claims 10-13, characterized in that, The target code is configured to run in a trusted execution environment, and / or the target code is configured to be obfuscated.

16. The method according to any one of claims 10-13, characterized in that, The target code is configured to be encrypted and protected using an encryption algorithm; The method further includes: The target code in the executable code is decrypted to obtain the decrypted code; Executing the decrypted code yields the first expression.

17. The method according to any one of claims 10-13, characterized in that, The method further includes: Based on the execution code of the AI ​​model, a fourth computation graph is obtained. The fourth computation graph includes a second operator and a third expression. The second operator is obtained by modifying the weight parameters of the first operator in the AI ​​model. The input of the third expression includes the output of the second operator, and the output of the third expression is the same as the output of the first operator when using the same input as the second operator. The processing of the input data based on the second computation graph includes: The input data is processed based on the second computation graph and the fourth computation graph.

18. The method according to claim 17, characterized in that, The weight parameters of the second operator are obtained by modifying the weight parameters of the first operator based on the second value. The input of the third expression includes the second value, and the second value is configured to be encrypted.

19. A model processing apparatus, characterized in that, The device includes a memory and a processor; the memory stores code, and the processor is configured to execute the code, wherein when the code is executed, the device performs the method as described in any one of claims 1 to 9.

20. A model-based data processing device, characterized in that, The device includes a memory and a processor; the memory stores code, and the processor is configured to execute the code, wherein when the code is executed, the device performs the method as described in any one of claims 10 to 18.

21. An AI system, characterized in that, include: The model processing apparatus as described in claim 19 and the model-based data processing apparatus as described in claim 20.

22. A computer storage medium, characterized in that, The computer storage medium stores instructions that, when executed by the computer, cause the computer to perform the method according to any one of claims 1 to 18.

23. A computer program product, characterized in that, The computer program product stores instructions that, when executed by a computer, cause the computer to perform the method described in any one of claims 1 to 18.

Images