A method for training a deep learning model and related devices

Abstract

The embodiment of the application provides a kind of training method of deep learning model and related equipment, for meeting the requirement of large model training, also protect data security as far as possible as possible.The embodiment of the application method includes: with the first irreversible operation layer in the deep learning model as the cutting point, the deep learning model is cut into the first deep learning submodel and the second deep learning submodel;First deep learning submodel is deployed in trusted execution environment, and the second deep learning submodel is deployed in untrusted execution environment;Obtain the initial training data of data provider, input the initial training data into first deep learning submodel, obtain intermediate output data;Intermediate output data is transmitted to the second deep learning submodel, and the training result data corresponding to the second deep learning submodel is obtained;According to training result data and the prediction result data corresponding to initial training data, the first deep learning submodel and the second deep learning submodel of training completion are obtained.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a training method and related equipment for a deep learning model. Background Technology

[0002] Currently, countries and alliances around the world have implemented extremely strict regulations on their own data security. For example, they prohibit direct offshore access to sensitive domestic data and prevent foreign companies from directly collecting and processing sensitive domestic data. For instance, if a robotics company in one country needs to promote its robot delivery service in another country, it needs to use the city's map and traffic information to train the robot's deep learning navigation system and model. However, the city's map and traffic information are usually considered sensitive information in other countries.

[0003] Currently, data security is often ensured through Trusted Execution Environments (TEEs). This approach places data and data access programs within the TEE for execution. Because the TEE provides a hardware-guaranteed execution environment isolated from other computer processing and main memory access, this isolated environment is invisible to the operating system and other applications within the system. Therefore, the execution security of data and access programs can be guaranteed; even if a hacker gains administrator privileges, they cannot steal the data. However, the aforementioned methods for ensuring training data security suffer from limitations due to the limited memory available in the TEE. This makes it difficult to guarantee data security during the training of large models and also limits the full utilization of other system resources, resulting in a limited scope of application.

[0004] Therefore, there is an urgent need for a model training method that can effectively protect data security while also meeting the requirements for training large models as much as possible. Summary of the Invention

[0005] This application provides a training method and related equipment for a deep learning model, which can meet the training requirements of large models while protecting data security as much as possible.

[0006] The first aspect of this application provides a method for training a deep learning model, applied to a computer device, wherein the deep learning model is trained on the computer device, and the computer device is deployed with a trusted execution environment and an untrusted execution environment. The method includes:

[0007] Using the first irreversible operation layer in the deep learning model as the dividing point, the deep learning model is divided into a first deep learning sub-model and a second deep learning sub-model; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking.

[0008] The first deep learning sub-model is deployed in the trusted execution environment, and the second deep learning sub-model is deployed in the untrusted execution environment;

[0009] Obtain initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data; transmit the intermediate output data to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model;

[0010] Based on the training result data and the prediction result data corresponding to the initial training data, the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model are adjusted respectively to obtain the trained first deep learning sub-model and the trained second deep learning sub-model, wherein the trained first deep learning sub-model and the trained second deep learning sub-model are used to form the trained deep learning model.

[0011] Optionally, dividing the deep learning model into a first deep learning sub-model and a second deep learning sub-model, using the first irreversible layer in the deep learning model as the dividing point, includes:

[0012] Obtain the ranking order of all irreversible operation layers in the deep learning model, and set the irreversible operation layer whose ranking order is the target ranking layer as the first irreversible operation layer;

[0013] A preset number of irreversible operation layers are set in the first deep learning sub-model, and the first irreversible operation layer is set as the last irreversible operation layer in the first deep learning sub-model;

[0014] The irreversible operation layer whose ranking order is after the first irreversible operation layer is set in the second deep learning sub-model.

[0015] Optionally, adjusting the first model parameters of the first deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes:

[0016] Determine the ranking order of all irreversible operation layers in the second deep learning sub-model;

[0017] According to the order opposite to the ranking order, the training result data and the prediction result data are input to all the irreversible operation layers of the second deep learning sub-model to obtain the first loss function value corresponding to the second irreversible operation layer; wherein, the second irreversible operation layer is the irreversible operation layer located below the first irreversible operation layer in the ranking order, and is the first irreversible operation layer in the second deep learning sub-model.

[0018] The parameters of the first model are adjusted based on the value of the first loss function.

[0019] Optionally, adjusting the second model parameters of the second deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes:

[0020] According to the order opposite to the ranking order, the training result data and the prediction result data are sequentially transmitted to all the irreversible operation layers of the second deep learning sub-model to obtain the second loss function value corresponding to each irreversible operation layer.

[0021] Based on each value of the second loss function, the second model parameters of the irreversible operation layer corresponding to the second loss function value are adjusted respectively.

[0022] Optionally, the step of inputting the initial training data into the first deep learning sub-model to obtain intermediate output data includes:

[0023] Determine the first model parameters of the first deep learning sub-model; wherein the first model parameters include at least matrix parameter data;

[0024] The initial training data is input into the first deep learning sub-model O = f(M, O1) for computation to obtain the intermediate output data; wherein, O is the intermediate output data, M is the matrix parameter data, O1 is the output result of all irreversible operation layers in the first deep learning sub-model, and f is the operation performed by the first irreversible operation layer.

[0025] Optionally, adjusting the first model parameters of the first deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes:

[0026] The matrix parameter data and the matrix vector data are updated based on the training result data and the prediction result data to obtain the target matrix parameter data and the target matrix vector data;

[0027] The first model parameters are adjusted based on the target matrix parameter data, the target matrix vector data, and the activation function.

[0028] Optionally, the initial training data obtained from the data provider includes:

[0029] Obtain the initial encrypted data provided by the data provider;

[0030] Obtain the decryption key data for the initial encrypted data through a secure communication channel;

[0031] The initial encrypted data is decrypted using the decryption key data to obtain the initial training data.

[0032] A second aspect of this application provides a training system for a deep learning model, applied to a computer device, wherein the deep learning model is trained on the computer device, the computer device being deployed with a trusted execution environment and an untrusted execution environment, and the system comprising:

[0033] The segmentation unit is used to segment the deep learning model into a first deep learning sub-model and a second deep learning sub-model, with the first irreversible operation layer in the deep learning model as the segmentation point; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking.

[0034] The deployment unit is used to deploy the first deep learning sub-model in the trusted execution environment and the second deep learning sub-model in the untrusted execution environment.

[0035] The acquisition unit is used to acquire the initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data, and transmit the intermediate output data to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model.

[0036] The adjustment unit is used to adjust the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model according to the training result data and the prediction result data corresponding to the initial training data, so as to obtain the trained first deep learning sub-model and the second deep learning sub-model, wherein the trained first deep learning sub-model and the second deep learning sub-model are used to form the trained deep learning model.

[0037] The second aspect of the embodiments of this application provides a method for performing the training method described in the first aspect.

[0038] A third aspect of this application provides a training apparatus for a deep learning model, comprising:

[0039] Central processing unit, memory, input / output interfaces, wired or wireless network interfaces, and power supply;

[0040] The memory is either a short-term storage memory or a persistent storage memory;

[0041] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the training method described in the first aspect.

[0042] A fourth aspect of this application provides a computer-readable storage medium, characterized in that the computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the training method described in the first aspect.

[0043] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: The deep learning model training method disclosed in this application first divides the deep learning model into a first deep learning sub-model and a second deep learning sub-model, using the first irreversible operation layer in the deep learning model as the dividing point; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking; then, the first deep learning sub-model is deployed in a trusted execution environment, and the second deep learning sub-model is deployed in an untrusted execution environment; then, the initial training data from the data provider is obtained, and the initial training data is input into the first deep learning sub-model to obtain intermediate output data; the intermediate output data is transmitted to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model; finally, based on the training result data and the prediction result data corresponding to the initial training data, the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model are adjusted respectively to obtain the trained first deep learning sub-model and the trained second deep learning sub-model, wherein the trained first deep learning sub-model and the trained second deep learning sub-model are used to form the trained deep learning model. Therefore, by placing a portion of the training model within a trusted execution environment, only a tiny fraction of the trusted execution environment's resources are required, thus satisfying both data security protection and the requirements for training large models. Furthermore, the remaining portion of the training model is executed outside the feasible execution environment, remaining fully visible to the data user. This allows the data user to adjust model parameters promptly based on training progress without compromising data security, maximizing flexibility. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings.

[0045] Figure 1 This is a schematic diagram illustrating the deployment of a deep learning model disclosed in an embodiment of this application;

[0046] Figure 2 This is a flowchart illustrating a training method for a deep learning model disclosed in an embodiment of this application.

[0047] Figure 3This is a flowchart illustrating another method for training a deep learning model disclosed in an embodiment of this application.

[0048] Figure 4 This is a flowchart illustrating another method for training a deep learning model disclosed in an embodiment of this application.

[0049] Figure 5 This is a schematic diagram of the structure of a training system for a deep learning model disclosed in an embodiment of this application;

[0050] Figure 6 This is a schematic diagram of the structure of a training device for a deep learning model disclosed in an embodiment of this application. Detailed Implementation

[0051] Currently, countries and alliances around the world have implemented extremely strict regulations on their own data security. For example, they prohibit direct offshore access to sensitive domestic data and prevent foreign companies from directly collecting and processing sensitive domestic data. For instance, if a robotics company in one country needs to promote its robot delivery service in another country, it needs to use the city's map and traffic information to train the robot's deep learning navigation system and model. However, the city's map and traffic information are usually considered sensitive information in other countries.

[0052] The methods for solving these types of problems can generally be categorized into the following main types:

[0053] (1) Based on the implementation of user / group access control provided by the computer operating system, data providers and users are divided into different groups.

[0054] A) The data provider has full read, write, and execute permissions for the directory where the data is stored and provides an executable program to the data user. This executable program only accesses data that the data provider has authorized to be accessed externally.

[0055] B) Data users obtain the necessary data through executable programs provided by data providers. However, this approach has the following problems: 1. Data providers need to understand the logic of data users and maintain different data access programs for different users. Once the user's data processing logic is adjusted, the data provider needs to rewrite the executable program. 2. The cost and risk are too high for data users. Taking the deep learning model training of the aforementioned robot cruise system as an example, the data access executable program is the model training program. During the training process, the robot company cannot directly access the model training data and output, and cannot adjust the parameters used during model training in a timely manner. The model training effect indicators can only be obtained after training is completed. If the training results are not ideal at this time, a lot of training resources and time will be wasted. Due to various technical or commercial reasons, the data provider cannot help the robot company adjust the model training parameters according to the training situation. 3. Security cannot be effectively guaranteed. If the operating system is attacked by hackers and administrator privileges are obtained, the hackers can arbitrarily change user / group access control permissions or directly steal data.

[0056] (2) Implementation based on a Trusted Execution Environment (TEE). This scheme places the data and data access programs within a TEE for execution. Because the TEE provides a hardware-guaranteed execution environment isolated from other computer processing and main memory access, this isolated environment is invisible to the operating system and other applications within the system. Therefore, the execution security of the data and access programs can be guaranteed, and even if a hacker gains administrator privileges, they cannot steal the data. However, this scheme has the following problems:

[0057] A) Insufficient computing resources. Because a Trusted Execution Environment (TEE) is a special computer execution area (Intel SGX) or hardware isolation area (ARM Trust Zone), this area is typically very small (e.g., only 128MB of memory in an Intel SGX) to avoid affecting the execution of other normal programs. Therefore, it cannot accommodate large amounts of data and complex processing logic. Thus, placing the entire data access program inside the TEE is impractical. For example, the TEE might not be able to fully accommodate the aforementioned robot navigation deep learning training program. Furthermore, with the advent of the era of large models, even all eight GPUs on a single computer node cannot accommodate the entire model. Therefore, this solution cannot be used to guarantee data security during large model training.

[0058] B) Performance Bottleneck. Because the security of the feasible execution environment requires encryption and decryption of memory reads and writes, its computation time is typically several times (5-7 times) longer than that of an external, ordinary execution environment (untrusted execution environment). Placing the entire data access executable program within a trusted execution environment is, in some cases, an unacceptable economic and business loss. Where training large models typically takes months, this approach could take years.

[0059] C) Inability to fully utilize other system resources. Since the Trusted Execution Environment (TEE) can only provide encryption and decryption functions when the processor accesses main memory, it cannot guarantee access to device memory. Therefore, this solution cannot access other available resources on the system, such as graphics processing units (GPUs), field-programmable gate arrays (FPGAs), and application-specific integrated circuits (ASICs), further limiting the performance of this solution.

[0060] D) It may introduce other security vulnerabilities. The more code in a trusted execution environment (TEX), and the more complex the processing logic, the greater the likelihood of the code introducing security vulnerabilities, and the lower the chance of them being discovered by developers. Therefore, the size of code placed in a TEX should be strictly controlled, which is one of the reasons why viable execution environments are usually designed to be very small.

[0061] (3) In addition, some manufacturers have proposed implementations based on the trusted execution environment within the GPU to address the aforementioned performance and resource constraints. However, this approach also introduces other problems:

[0062] A) The Trusted Execution Environment (TEX) is trusted because it provides a remote attestation mechanism for the data provider. After successful attestation, a direct, secure, encrypted channel is established between the data provider and the TEX, through which a secret provision key is used to access the data provided by the provider. Since GPU cards lack network access capabilities, they cannot perform remote attestation and provide the secret provision, thus significantly limiting the applicability of this solution.

[0063] B) The GPU is merely an external device attached to a computer and cannot directly access the network and local file system. It needs to access main memory, the network, and the local file system through the operating system (CPU, central processing unit) to obtain or access the data it needs. The security of this intermediate operation is completely exposed outside the GPU's trusted execution environment and cannot be guaranteed.

[0064] Therefore, considering the aforementioned technical problems, the technical solution of this application needs to address how to solve the problem of data usability without visibility while ensuring the security of the data itself. Specifically, the technical solution of this application ensures this by using a remote verification service of a trusted execution environment. First, the hardware platform (BIOS, Firmware, or CPU microcode) equipped with this trusted execution environment has the latest security updates installed. The trusted execution environment indeed loads a data access program provided by the data provider (or provided by a data user verified by the data provider), and the installation of this program conforms to pre-defined requirements. Finally, this solution separates direct data access from data usage logic through irreversible mathematical operations, placing direct data access within the trusted execution environment and executing the data usage logic outside the trusted execution environment (e.g., on an untrusted CPU execution environment or a GPU accelerator card).

[0065] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0066] It should be noted that the terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in a sequence other than that illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0067] It should also be noted that the descriptions involving "first," "second," etc., in this application are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0068] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating the deployment of a deep learning model disclosed in an embodiment of this application.

[0069] Depend on Figure 1 As can be seen, the deep learning model in this application includes two sub-models, deployed in a trusted execution environment and an untrusted execution environment (such as a GPU accelerator card), respectively. Both the trusted and untrusted execution environments deploy at least an irreversible operation layer. While the deep learning model in this application can also deploy a reversible operation layer, it should be noted that this application does not restrict the deployment of the reversible operation layer; the description focuses primarily on the irreversible operation layer. Furthermore, in this application, it is assumed that a mathematical operation function is F(X) = Y, where F is the function name, X is the function input, and Y is the function output. X and Y can be scalars, vectors, matrices, or tensors, and can also be tables and query outputs (views) of a database. F can be an operator in deep learning or a SQL or non-SQL query statement in a database query. If for any given F, there exists an F′ such that F′(Y) = X, meaning F does not have a corresponding invertible function such that we can derive X from the output of the operation F, then we define the operation F as an irreversible operation. To distinguish between reversible and irreversible operations in deep learning model training, the following definition is used.

[0070] 1. Fully connected layer matrix-vector multiplication (MatMul) operation: If the matrix is ​​not invertible, we cannot derive X from Y in MX = Y. Y = M′X (M′ is the inverse matrix of M).

[0071] Second, convolutional layers and regularization layers contain averaging and addition (subtraction) operations, which are irreversible. For example: (X1+X2+…+X…) nSince ) / n = Y, we cannot derive X1, X2, ..., X from Y in reverse order. n Addition operation: X1 + X2 = Y. We cannot find X1 and X2 by reversing Y if X1 and X2 are not 0.

[0072] Therefore, operators that include averaging operations include convolution (which includes addition) and BatchNorm (which includes both addition and averaging).

[0073] III. Pooling layer (MaxPool) is irreversible because it involves the MAX operation: max(X1, X2, ..., X...). n ) = X i We cannot get from X i Find X1, X2, ..., X in reverse order n .

[0074] Some activation functions (such as sigmoid and tanh) are invertible because they have inverse functions. Some activation functions (such as ReLU and GeLU) are invertible on certain piecewise functions and are therefore defined as invertible functions (from a data security perspective).

[0075] Furthermore, since deep learning models are computed layer by layer, such as L1, L2, ..., L... n There are n layers in total, if L i The layer is irreversible, while L j The layer is reversible, but since j < i, we can consider L as... i The layer is irreversible because L i It is a composite function F i =(F i -1(F i-1 -2(…(F1)))), therefore, it is impossible to obtain from F i (X) = Y and Y are used to find X in reverse.

[0076] Based on the above description, such as Figure 1 As shown, the entire model's L Transformers are divided into two parts. The first part contains one Transformer. The original training data, after being processed by EmbeddedPatches, is input into the first Transformer. The second part contains the remaining L-1 Transformers. The first part is executed in a trusted execution environment, while the second part can be executed outside of a trusted execution environment, such as on a GPU.

[0077] It's easy to understand that Norm, Multi-HeadAttention, and MLP in Transformer are all irreversible operations, and can all serve as dividing lines. Similarly, this dividing line can also be at any boundary in the subsequent L-1 Transformers or at any layer within a Transformer. The specific division depends on the user's need for a balance between security and performance. In short, the more computations placed in a trusted execution environment, the more secure it is. Conversely, the more computations placed outside a feasible execution environment, the better the performance.

[0078] Because the calculation result O = σ(M×X+B) of the MLP layer in the first Transformer is irreversible when M is irreversible, and the first Transformer also contains other irreversible operation layers, it is impossible to reverse the calculation from O to obtain the original geographic and traffic data, thus ensuring the security of the original data.

[0079] For the convenience of understanding the above Figure 1 For a detailed description of the training methods for specific deep learning models, please refer to [link / reference]. Figure 2 , Figure 2 This is a flowchart illustrating a training method for a deep learning model disclosed in an embodiment of this application. It includes steps 201-204.

[0080] 201. Using the first irreversible operation layer in the deep learning model as the dividing point, the deep learning model is divided into a first deep learning sub-model and a second deep learning sub-model.

[0081] In this embodiment, the first irreversible operation layer in the deep learning model is used as the splitting point, thereby dividing the deep learning model into a first deep learning sub-model and a second deep learning sub-model. The first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking. It is easy to understand that... (See also...) Figure 1 The deep learning model includes multiple irreversible operation layers. In one embodiment, the deep learning model may also include reversible operation layers. For ease of description, only the division of irreversible operation layers will be described in detail. However, it should be noted that this embodiment does not limit the number or number of irreversible and reversible operation layers in the deep learning model, and this will not be elaborated further.

[0082] 202. Deploy the first deep learning sub-model in a trusted execution environment and the second deep learning sub-model in an untrusted execution environment.

[0083] After splitting the first deep learning sub-model and the second deep learning sub-model, the first deep learning sub-model is deployed in a trusted execution environment, and the second deep learning sub-model is deployed in an untrusted execution environment.

[0084] In one specific embodiment, the hardware platform of the trusted execution environment includes BIOS, firmware, or CPU microcode, etc. The hardware platform of the untrusted execution environment includes GPU, FPGA, or ASIC, etc. It is easy to understand that this embodiment does not limit the specific trusted or untrusted execution environment, and this will not be elaborated upon further below.

[0085] 203. Obtain the initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data, and transmit the intermediate output data to the second deep learning sub-model to obtain the training result data corresponding to the second deep learning sub-model.

[0086] After dividing the deep learning sub-model into the first and second deep learning sub-models, the deep model can be trained. Specifically, the initial training data provided by the data provider is first obtained, and then the initial training data is input into the first deep learning sub-model. The first deep learning sub-model then performs calculations on the initial training data to obtain intermediate output data. The intermediate output data is then transmitted to the second deep learning sub-model to obtain the training result data corresponding to the second deep learning sub-model.

[0087] In one specific embodiment, the first Transformer layer in the trusted execution environment computes the initial training data to obtain intermediate output data. The initial training data can be the raw geographic and traffic data described above, etc., and the specific content of the initial training data is not limited here. After obtaining the intermediate output data, this intermediate output data is transmitted to Transformer layers outside the trusted execution environment. It is easy to understand that this refers to L-1 Transformer layers on the untrusted execution environment (GPU). It should be noted that in this embodiment, it is assumed that the deep learning model includes a total of L Transformer layers.

[0088] 204. Based on the training result data and the prediction result data corresponding to the initial training data, adjust the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model respectively to obtain the trained first deep learning sub-model and second deep learning sub-model.

[0089] After obtaining the training result data, the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model are adjusted based on the training result data and the prediction result data corresponding to the initial training data. This results in the trained first and second deep learning sub-models, and thus the trained deep learning model. It's easy to understand that the training results of the initial training data can be predicted in advance to obtain the prediction result data. For example, when using raw geographic and traffic data as initial training data, the prediction result data could be the corresponding cruise route or navigation route, etc. Specific prediction result data is not limited here. The trained first and second deep learning sub-models are used to form the trained deep learning model.

[0090] In one specific embodiment, the model parameters of the first deep learning sub-model and the second deep learning sub-model are adjusted using the training result data and the prediction result data until the prediction result data matches or converges with the training result data in subsequent training. Then, the training of the deep learning model can be determined to be complete.

[0091] In another specific embodiment, multiple sets of training data can be input into the first deep learning sub-model and the second deep learning sub-model until all training data is trained, at which point the deep learning model is considered to have completed training.

[0092] The deep learning model training method disclosed in this embodiment first divides the deep learning model into a first deep learning sub-model and a second deep learning sub-model, using the first irreversible operation layer as the dividing point. The first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking. The first deep learning sub-model is then deployed in a trusted execution environment, while the second deep learning sub-model is deployed in an untrusted execution environment. Next, initial training data from the data provider is obtained and input into the first deep learning sub-model to obtain intermediate output data. This intermediate output data is then transmitted to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model. Finally, based on the training result data and the prediction result data corresponding to the initial training data, the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model are adjusted respectively to obtain the trained first and second deep learning sub-models. These trained first and second deep learning sub-models are used to form the trained deep learning model. Therefore, by placing a portion of the training model within a trusted execution environment, only a tiny fraction of the trusted execution environment's resources are required, thus satisfying both data security protection and the requirements for training large models. Furthermore, the remaining portion of the training model is executed outside the feasible execution environment, remaining fully visible to the data user. This allows the data user to adjust model parameters promptly based on training progress without compromising data security, maximizing flexibility.

[0093] To facilitate Figure 2 For a detailed description of the training methods for the deep learning models described in [the document], please refer to [the document / reference]. Figure 3 , Figure 3 This is a flowchart illustrating another deep learning model training method disclosed in an embodiment of this application. It includes steps 301-310.

[0094] 301. Obtain the ranking order of all irreversible operation layers in the deep learning model, and set the irreversible operation layer whose ranking order is the target ranking layer as the first irreversible operation layer.

[0095] To segment a deep learning model, it is necessary to obtain all irreversible operation layers in the deep learning model and their ranking order, and then set the irreversible operation layer whose ranking order matches the target ranking as the first irreversible operation layer. The irreversible operation layer serves as the segmentation point between the first and second deep learning sub-models.

[0096] In one specific embodiment, the irreversible operation layer in the deep learning model is identified. Starting from the first layer of the deep learning model, layers are traversed one by one, searching for layers containing irreversible operations according to the definition of irreversible operations described above. For large models, it is not necessary to traverse all layers; it is sufficient to identify the irreversible operation layer whose ranking matches the target ranking based on safety and performance requirements. This target ranking can be the second layer, the third layer, or others, and can be configured according to the data provider's requirements. Correspondingly, the irreversible operation layer in the second or third layer mentioned above is the first irreversible operation layer.

[0097] 302. Set a preset number of irreversible operation layers in the first deep learning sub-model, and set the first irreversible operation layer as the last irreversible operation layer in the first deep learning sub-model. Set the irreversible operation layers ranked after the first irreversible operation layer in the second deep learning sub-model.

[0098] After determining the first irreversible operation layer, a preset number of irreversible operation layers can be set in the first deep learning sub-model, and the first irreversible operation layer can be set as the last irreversible operation layer in the first deep learning sub-model. Then, the irreversible operation layers ranked after the first irreversible operation layer are set in the second deep learning sub-model.

[0099] In one specific embodiment, the third irreversible operation layer is used as the first irreversible operation layer. This can be understood as dividing the deep learning model at the third and fourth layers, resulting in a first deep learning sub-model and a second deep learning sub-model. The first deep learning sub-model includes the first, second, and third irreversible operation layers, while the second deep learning sub-model includes the fourth layer and subsequent irreversible operation layers.

[0100] 303. Deploy the first deep learning sub-model in a trusted execution environment and the second deep learning sub-model in an untrusted execution environment.

[0101] In this embodiment, step 303 is the same as described above. Figure 2 Step 202 is similar and will not be elaborated here. However, it should be noted that in one specific embodiment, the first deep learning sub-model, which contains three layers, is deployed to a trusted execution environment (e.g., in SGX, all operators in the first three layers need to be implemented and encapsulated in a dynamic link library), and then the sub-models containing four or more layers are deployed to an untrusted execution environment (e.g., a GPU accelerator card). It is also necessary to define the data interaction between the first and second deep learning sub-models, which includes forward training and backward echelon optimization data.

[0102] 304. Obtain the initial encrypted data provided by the data provider, obtain the decryption key data for the initial encrypted data through a secure communication channel, and decrypt the initial encrypted data according to the decryption key data to obtain the initial training data.

[0103] To train a deep learning model, training data is required first. Specifically, this involves obtaining initial encrypted data from the data provider, then decrypting the initial encrypted data via a secure communication channel to obtain the initial training data.

[0104] In one specific embodiment, the data provider encrypts the original encrypted data using a secure encryption algorithm and publishes it online. Any data user can download the encrypted data but cannot obtain the decryption key. The data provider then verifies that the data user complies with relevant policies and regulations governing data use. Therefore, the data provider can use the remote verification service provided by the Trusted Execution Environment (TEE) to verify whether the entire platform's hardware environment and the software deployed therein comply with regulations. Figure 2 The execution environment shown is deployed accordingly. Simultaneously, as part of the remote verification protocol, after successful remote verification, an encrypted secure communication channel is established between the data provider and the trusted execution environment. The data provider uses the key provided by the trusted execution environment to send the data decryption key to the trusted execution environment through the encrypted secure communication channel. Upon receiving the decryption key, the trusted execution environment uses it to decrypt the encrypted data provided by the data provider to obtain the original training data. It is easy to understand that this original training data is the initial training data described above; for simplicity, it will not be elaborated upon further.

[0105] 305. Obtain the initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data, and transmit the intermediate output data to the second deep learning sub-model to obtain the training result data corresponding to the second deep learning sub-model.

[0106] In this embodiment, step 305 is the same as described above. Figure 2 Step 203 is similar and will not be elaborated here. However, it should be noted that the first Transformer layer in the trusted execution environment uses the decrypted data for computation and transmits the computation result to L-1 Transformers on the GPU outside the trusted execution environment. The intermediate output data is the computation result described above, that is, the result data after computation on the decrypted data.

[0107] When adjusting the model parameters of the first deep learning sub-model, execute steps 306-307. When adjusting the model parameters of the second deep learning sub-model, execute steps 308-309.

[0108] 306. Determine the ranking order of all irreversible operation layers in the second deep learning sub-model, and input the training result data and prediction result data into all irreversible operation layers of the second deep learning sub-model according to the order opposite to the ranking order, and obtain the first loss function value corresponding to the second irreversible operation layer.

[0109] When adjusting the model parameters of the first deep learning sub-model, after transmitting the intermediate output data to the second deep learning sub-model deployed in an untrusted execution environment, it is necessary to determine the ranking order of all irreversible operation layers in the second deep learning sub-model. Then, according to the reverse order of the ranking, the training result data and prediction result data are input to all irreversible operation layers of the second deep learning sub-model, thereby obtaining the first loss function value corresponding to the second irreversible operation layer. It is easy to understand that this first loss function value is the loss function value output by the first irreversible operation layer in the second deep learning sub-model. It is also easy to understand that the prediction result data described in this embodiment can be found in [reference needed]. Figure 3 The details of step 204 are not elaborated here.

[0110] In one specific embodiment, the loss function value of the second deep learning sub-model can be determined based on the training result data and the prediction result data. Then, the inverse gradient descent algorithm is executed on all irreversible operation layers of the second deep learning sub-model to obtain the first loss function value.

[0111] 307. Adjust the parameters of the first model based on the value of the first loss function.

[0112] Therefore, after obtaining the first loss function value, the parameters of the first model can be adjusted to obtain the first deep learning sub-model that has been trained.

[0113] In one specific embodiment, after adjusting the parameters of the first model using the first loss function value, training data provided by the data provider can be received. If the training result data generated by the training data is the same as the prediction result data, or if the intermediate output data generated based on the initial training data converges, it can be determined that the training of the first deep learning sub-model is complete.

[0114] Based on the above embodiments, in another specific embodiment, the first Transformer layer in the trusted execution environment reads in the next training data after the parameters are updated, and so on, to complete the training of the entire model.

[0115] 308. According to the order opposite to the ranking order, the training result data and prediction result data are sequentially transmitted to all irreversible operation layers of the second deep learning sub-model to obtain the second loss function value corresponding to each irreversible operation layer.

[0116] When adjusting the model parameters of the second deep learning sub-model, the training and prediction data are sequentially transmitted to all irreversible operation layers of the second deep learning sub-model in reverse order of ranking, obtaining the second loss function value corresponding to each irreversible operation layer. It is easy to understand that, in this embodiment, each irreversible operation layer in the second deep learning sub-model can be understood as an operation layer composed of model parameters. Therefore, by transmitting the training and prediction data from the top layer back to the first irreversible operation layer in the second deep learning sub-model in reverse order of ranking, the second loss function value of each irreversible operation layer can be determined.

[0117] In one specific embodiment, the loss function value of the second deep learning sub-model can be determined based on the training result data and the prediction result data. Then, the backward gradient descent algorithm is executed on the loss function value in all irreversible operation layers of the second deep learning sub-model. The loss function value is first input into the last irreversible operation layer in the second deep learning sub-model to determine the actual result value and the prediction result value of the last irreversible operation layer, thereby determining the loss function value of the irreversible operation layer. This process is repeated from the last layer to the first layer in the second deep learning sub-model to determine the second loss function value of an irreversible operation layer.

[0118] 309. Based on each second loss function value, adjust the second model parameters of the irreversible operation layer corresponding to the second loss function value.

[0119] Once each second loss function value is determined, the second model parameters of the irreversible operation layer corresponding to each second loss function value are adjusted to obtain the trained second deep learning sub-model.

[0120] In one specific embodiment, the second model parameters of each irreversible operational layer are adjusted based on the second loss function value of that irreversible operational layer, so that the operation results of that irreversible operational layer gradually converge to or approach the prediction results data of each layer. When the above conditions are met, it is determined that the training of the second deep learning sub-model is complete.

[0121] 310. Obtain the first and second deep learning sub-models after training.

[0122] Based on steps 306-309, the first deep learning sub-model and the second deep learning sub-model that have been trained can be obtained, and the trained deep learning model can be determined based on the first deep learning sub-model and the second deep learning sub-model.

[0123] The deep learning model training method disclosed in this embodiment can effectively ensure data security.

[0124] At the same time, it also overcomes the problem of insufficient computing resources in the Trusted Execution Environment (TEE). Since the technical solution of this application only places a very small portion of the model, rather than the entire model, into the TEE, it only requires a very small portion of the TEE's resources. The remaining parts of the model can still be implemented according to the currently common insecure solutions in the industry, thus solving the problem of insufficient computing resources in the TEE.

[0125] Furthermore, the performance bottleneck issue has been overcome. Since the feasible execution environment only performs a very small portion of the computations during model training, while the vast majority of computations are completed on the GPU accelerator card, the performance difference compared to current industry-standard non-safe solutions is negligible, thus solving the performance problem.

[0126] Furthermore, it also overcomes the problem of insufficient system resource utilization: Since the data exchanged between the trusted execution environment and the external GPU card in our solution is the result of irreversible computation, even if it is visible to the outside world, it does not affect the security of the data. Therefore, the data between the CPU / main memory and the GPU does not need to be kept confidential, thus making full use of all the computing resources of the system.

[0127] Secondly, it overcomes the problem of potentially introducing other security vulnerabilities: because the amount of code running in the trusted execution environment is very small, it is easy to discover hidden security vulnerabilities and harmful code, thus effectively ensuring the security of code running in the trusted execution environment.

[0128] Furthermore, applications within a trusted execution environment can be provided by the data user. The data provider only needs to ensure that the program does not leak the original data, thus relieving the data provider of the burden of providing different data access programs for different data uses.

[0129] Finally, since the entire model training process and most of the model are executed outside the feasible execution environment and are fully visible to the data users, the data users can adjust the training parameters in a timely manner according to the training situation, and such adjustments do not affect the security of the data. Therefore, this provides flexibility for providing data transactions in the future.

[0130] Furthermore, when adjusting the model parameters of the first deep learning sub-model, various model parameters of the first deep learning sub-model can be adjusted. Please refer to [link / reference]. Figure 4 , Figure 4 This is a flowchart illustrating another deep learning model training method disclosed in an embodiment of this application. It includes steps 401-404.

[0131] 401. Determine the first model parameters of the first deep learning sub-model, and substitute the initial training data into the activation function for calculation to obtain intermediate output data.

[0132] It should be noted in advance that in this embodiment, the main focus is on... Figure 3 Another example of step 305-307 is illustrated below.

[0133] In this embodiment, the first model parameters of the first deep learning sub-model need to be determined first, and then the initial training data is substituted into the activation function for calculation to obtain intermediate output data. It should be noted that this embodiment will not further explain the first model parameters, initial training data, and intermediate output data mentioned above; please refer to [the relevant documentation] for details. Figure 2 or Figure 3 The above definition is described in the text. It should also be noted that the activation function is calculated as O = σ(M × X + B), where O represents intermediate output data, σ is the activation function, M represents matrix parameter data, X represents initial training data, and B represents matrix vector data.

[0134] Therefore, based on the activation function mentioned above, intermediate output data can be obtained from the initial training data. It is easy to understand that both matrix parameter data and matrix vector data can be understood as the first model parameters.

[0135] 402. Transmit the intermediate output data to the second deep learning sub-model to obtain the training result data corresponding to the second deep learning sub-model.

[0136] In this embodiment, step 402 is the same as described above. Figure 3 Step 305 is similar, and will not be elaborated here.

[0137] 403. Update the matrix parameter data and matrix vector data based on the training result data and prediction result data to obtain the target matrix parameter data and target matrix vector data.

[0138] Once the training and prediction results are obtained, the loss function value of the second deep learning sub-model can be determined. This loss function value is then input into the first deep learning sub-model to update the matrix parameter data and matrix vector data, thereby obtaining the target matrix parameter data and target matrix vector data.

[0139] In one specific embodiment, after completing the forward computation, L-1 Transformers in the untrusted execution environment (outside the trusted execution environment) execute the backward gradient descent algorithm. They then transmit the loss function value (Loss) from the second Transformer after gradient descent back to the first Transformer within the trusted execution environment, updating the parameters in the first Transformer. Specifically, this involves updating the matrix parameter data M and the matrix vector data B to obtain the target matrix parameter data and the target matrix vector data.

[0140] 404. Adjust the parameters of the first model based on the target matrix parameter data, the target matrix vector data, and the activation function.

[0141] Therefore, based on the target matrix parameter data, target matrix vector data and activation function obtained in step 403 above, the parameters of the first model are adjusted to obtain the first deep learning sub-model after training.

[0142] The training method for a deep learning model disclosed in this embodiment expands the training methods of the first deep learning sub-model and improves the feasibility of the solution.

[0143] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0144] If the plan involves sensitive information (such as user information or corporate information), it should state that the collection, use, and processing of sensitive information must comply with the laws, regulations, and standards of the relevant countries and regions, and must be carried out with the permission or consent of the relevant entities (such as users or enterprises).

[0145] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a deep learning model training system disclosed in an embodiment of this application. The deep learning model training system is applied to a computer device, and the deep learning model is trained on the computer device. The computer device is equipped with a trusted execution environment and an untrusted execution environment.

[0146] The segmentation unit 501 is used to segment the deep learning model into a first deep learning sub-model and a second deep learning sub-model, with the first irreversible operation layer in the deep learning model as the segmentation point; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking.

[0147] Deployment unit 502 is used to deploy the first deep learning sub-model in a trusted execution environment and the second deep learning sub-model in an untrusted execution environment;

[0148] The acquisition unit 503 is used to acquire the initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data, and transmit the intermediate output data to the second deep learning sub-model to obtain the training result data corresponding to the second deep learning sub-model.

[0149] The adjustment unit 504 is used to adjust the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model according to the training result data and the prediction result data corresponding to the initial training data, so as to obtain the trained first deep learning sub-model and the second deep learning sub-model, wherein the trained first deep learning sub-model and the second deep learning sub-model are used to form the trained deep learning model.

[0150] For example, the system further includes: a setting unit 505;

[0151] The acquisition unit 503 is specifically used to acquire the ranking order of all irreversible operation layers in the deep learning model, and set the irreversible operation layer whose ranking order is the target ranking as the first irreversible operation layer.

[0152] Setting unit 505 is used to set a preset number of irreversible operation layers in the first deep learning sub-model, and to set the first irreversible operation layer as the last irreversible operation layer in the first deep learning sub-model.

[0153] Setting unit 505 is also used to set the ranking order of the irreversible operation layer after the first irreversible operation layer in the second deep learning sub-model.

[0154] For example, the system further includes: a determining unit 506;

[0155] Determining unit 506 is used to determine the ranking order of all irreversible operation layers in the second deep learning sub-model;

[0156] The acquisition unit 503 is specifically used to input the training result data and prediction result data into all irreversible operation layers of the second deep learning sub-model according to the order opposite to the ranking order, and to obtain the first loss function value corresponding to the second irreversible operation layer; wherein, the second irreversible operation layer is the irreversible operation layer located below the first irreversible operation layer in the ranking order, and is the first irreversible operation layer in the second deep learning sub-model.

[0157] The adjustment unit 504 is specifically used to adjust the parameters of the first model based on the value of the first loss function.

[0158] For example, the system includes:

[0159] The acquisition unit 503 is specifically used to transmit the training result data and prediction result data to all irreversible operation layers of the second deep learning sub-model in the order opposite to the ranking order, and to obtain the second loss function value corresponding to each irreversible operation layer.

[0160] The adjustment unit 504 is specifically used to adjust the second model parameters of the irreversible operation layer corresponding to each second loss function value according to each second loss function value.

[0161] For example, the system includes:

[0162] The determining unit 506 is specifically used to determine the first model parameters of the first deep learning sub-model; wherein, the first model parameters include at least matrix parameter data;

[0163] The acquisition unit 503 is specifically used to input the initial training data into the first deep learning sub-model O = f(M, O1) for operation and to obtain intermediate output data; where O is the intermediate output data, M is the matrix parameter data, O1 is the operation output result of all irreversible operation layers in the first deep learning sub-model, and f is the operation performed by the first irreversible operation layer.

[0164] For example, the system includes:

[0165] The acquisition unit 503 is specifically used to update the matrix parameter data and matrix vector data based on the training result data and prediction result data, and to acquire the target matrix parameter data and target matrix vector data.

[0166] The adjustment unit 504 is specifically used to adjust the parameters of the first model based on the target matrix parameter data, the target matrix vector data, and the activation function.

[0167] For example, the system includes:

[0168] The acquisition unit 503 is specifically used to acquire the initial encrypted data provided by the data provider.

[0169] The acquisition unit 503 is also used to acquire decryption key data for the initial encrypted data through a secure communication channel;

[0170] The acquisition unit 503 is also used to decrypt the initial encrypted data based on the decryption key data to obtain the initial training data.

[0171] Please refer to the following: Figure 6 The schematic diagram of a training device for a deep learning model disclosed in this application includes:

[0172] Central processing unit 601, memory 605, input / output interface 604, wired or wireless network interface 603, and power supply 602;

[0173] Memory 605 is either a short-term storage memory or a persistent storage memory;

[0174] The central processing unit 601 is configured to communicate with the memory 605 and execute instructions stored in the memory 605 to perform the aforementioned operations. Figures 2 to 4 The training method in any of the illustrated embodiments.

[0175] This application also provides a chip system, characterized in that the chip system includes at least one processor and a communication interface, the communication interface and the at least one processor are interconnected via a circuit, and the at least one processor is used to run computer programs or instructions to perform the aforementioned... Figures 2 to 4 The training method in any of the illustrated embodiments.

[0176] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0177] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0178] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0179] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0180] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A method for training a deep learning model, characterized in that, The method, applied to a computer device, involves training a deep learning model on the computer device, wherein the computer device is deployed with a trusted execution environment and an untrusted execution environment, and includes: Using the first irreversible operation layer in the deep learning model as the dividing point, the deep learning model is divided into a first deep learning sub-model and a second deep learning sub-model; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking. The first deep learning sub-model is deployed in the trusted execution environment, and the second deep learning sub-model is deployed in the untrusted execution environment; Obtain initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data; transmit the intermediate output data to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model; Based on the training result data and the prediction result data corresponding to the initial training data, the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model are adjusted respectively to obtain the trained first deep learning sub-model and the trained second deep learning sub-model, wherein the trained first deep learning sub-model and the trained second deep learning sub-model are used to form the trained deep learning model.

2. The training method according to claim 1, characterized in that, The step of dividing the deep learning model into a first deep learning sub-model and a second deep learning sub-model, using the first irreversible operation layer in the deep learning model as the dividing point, includes: Obtain the ranking order of all irreversible operation layers in the deep learning model, and set the irreversible operation layer whose ranking order is the target ranking layer as the first irreversible operation layer; A preset number of irreversible operation layers are set in the first deep learning sub-model, and the first irreversible operation layer is set as the last irreversible operation layer in the first deep learning sub-model; The irreversible operation layer whose ranking order is after the first irreversible operation layer is set in the second deep learning sub-model.

3. The training method according to claim 1, characterized in that, The step of adjusting the first model parameters of the first deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes: Determine the ranking order of all irreversible operation layers in the second deep learning sub-model; According to the order opposite to the ranking order, the training result data and the prediction result data are input to all the irreversible operation layers of the second deep learning sub-model to obtain the first loss function value corresponding to the second irreversible operation layer; wherein, the second irreversible operation layer is the irreversible operation layer located below the first irreversible operation layer in the ranking order, and is the first irreversible operation layer in the second deep learning sub-model. The parameters of the first model are adjusted based on the value of the first loss function.

4. The training method according to claim 3, characterized in that, The step of adjusting the second model parameters of the second deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes: According to the order opposite to the ranking order, the training result data and the prediction result data are sequentially transmitted to all the irreversible operation layers of the second deep learning sub-model to obtain the second loss function value corresponding to each irreversible operation layer. Based on each value of the second loss function, the second model parameters of the irreversible operation layer corresponding to the second loss function value are adjusted respectively.

5. The training method according to claim 1, characterized in that, The step of inputting the initial training data into the first deep learning sub-model to obtain intermediate output data includes: Determine the first model parameters of the first deep learning sub-model; wherein, the first model parameters include at least matrix parameter data; The initial training data is input into the first deep learning sub-model O = f(M, O1) for computation to obtain the intermediate output data; wherein, O is the intermediate output data, M is the matrix parameter data, O1 is the output result of all irreversible operation layers in the first deep learning sub-model, and f is the operation performed by the first irreversible operation layer.

6. The training method according to claim 5, characterized in that, The step of adjusting the first model parameters of the first deep learning sub-model based on the training result data and the prediction result data corresponding to the initial training data includes: The matrix parameter data and matrix vector data are updated based on the training result data and the prediction result data to obtain the target matrix parameter data and target matrix vector data; The parameters of the first model are adjusted based on the target matrix parameter data, the target matrix vector data, and the activation function.

7. The training method according to claim 1, characterized in that, The initial training data obtained from the data provider includes: Obtain the initial encrypted data provided by the data provider; Obtain the decryption key data for the initial encrypted data through a secure communication channel; The initial encrypted data is decrypted using the decryption key data to obtain the initial training data.

8. A training system for a deep learning model, characterized in that, A system applicable to computer devices, on which a deep learning model is trained, wherein the computer devices are deployed with trusted execution environments and untrusted execution environments, the system includes: The segmentation unit is used to segment the deep learning model into a first deep learning sub-model and a second deep learning sub-model, with the first irreversible operation layer in the deep learning model as the segmentation point; wherein, the first irreversible operation layer is the irreversible operation layer in the deep learning model whose ranking order is the target ranking. The deployment unit is used to deploy the first deep learning sub-model in the trusted execution environment and the second deep learning sub-model in the untrusted execution environment. The acquisition unit is used to acquire the initial training data from the data provider, input the initial training data into the first deep learning sub-model to obtain intermediate output data, and transmit the intermediate output data to the second deep learning sub-model to obtain training result data corresponding to the second deep learning sub-model. The adjustment unit is used to adjust the first model parameters of the first deep learning sub-model and the second model parameters of the second deep learning sub-model according to the training result data and the prediction result data corresponding to the initial training data, so as to obtain the trained first deep learning sub-model and the second deep learning sub-model, wherein the trained first deep learning sub-model and the second deep learning sub-model are used to form the trained deep learning model.

9. A training device for a deep learning model, characterized in that, The device includes: Central processing unit, memory, input / output interfaces, wired or wireless network interfaces, and power supply; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the model training method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the training method as described in any one of claims 1 to 7.

Images