Model encryption method, device, storage medium and electronic device

Abstract

The present application discloses a model encryption method, device, storage medium and electronic device, and relates to the field of computer technology. The method includes: compressing a target model according to preset compression information to obtain a compressed model; determining an encryption strategy according to the storage space of the compressed model; obtaining a parameter file of the compressed model; encrypting the parameter file according to the encryption strategy to obtain an encrypted file. By compressing the model and determining the encryption strategy according to the compressed model, the present application can save computing resources of a computing device while encrypting the model, and can also improve the efficiency of encrypting the model.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a model encryption method, device, storage medium and electronic device. Background Art

[0002] Deep learning is a new research direction in the field of machine learning. It is introduced into machine learning to make it closer to its original goal - artificial intelligence. Deep learning is the internal laws and representation levels of learning sample data. The information obtained in the learning process is of great help in the interpretation of data such as text, images and sounds. Its ultimate goal is to enable machines to have analytical learning capabilities like humans and to recognize data such as text, images and sounds. Deep learning is a complex machine learning algorithm that has achieved results in speech and image recognition that far exceed previous related technologies. Deep learning has achieved many results in search technology, data mining, machine learning, machine translation, natural language processing, multimedia learning, speech, recommendation and personalization technology, and other related fields. Deep learning enables machines to imitate human activities such as seeing, hearing and thinking, solves many complex pattern recognition problems, and makes great progress in artificial intelligence related technologies.

[0003] In actual commercial deployment, deep learning models face the problem of model theft and leakage, and may contain sensitive information. Therefore, how to encrypt deep learning models and achieve the purpose of protecting deep learning models is an urgent problem that needs to be solved. Summary of the invention

[0004] In view of the above problems, the present application provides a model encryption method, device, storage medium and electronic device to solve the problem of how to encrypt a deep learning model.

[0005] In order to solve the above technical problems, this application proposes the following solutions:

[0006] In a first aspect, the present application provides a model encryption method, the method comprising: compressing a target model according to preset compression information to obtain a compressed model; determining an encryption strategy according to a storage space of the compressed model; obtaining a parameter file of the compressed model; and encrypting the parameter file according to the encryption strategy to obtain an encrypted file.

[0007] In combination with the first aspect, in a possible implementation method, the encryption strategy is determined based on the storage space of the compression model, including: when the storage space of the compression model is less than or equal to a first threshold, determining the encryption strategy to be a hierarchical encryption strategy; when the storage space of the compression model is greater than the first threshold, determining the encryption strategy to be a random encryption strategy.

[0008] In combination with the first aspect, in another possible implementation method, when the encryption strategy is a hierarchical encryption strategy, the parameter file is encrypted according to the encryption strategy to obtain an encrypted file, including: setting the number of encryption layers and starting the encryption layer according to the number of layers of the model indicated by the parameter file; for each encryption layer, mapping the parameter file according to a preset hash function to obtain an encrypted file.

[0009] In combination with the first aspect, in another possible implementation, setting the number of encryption layers according to the number of layers of the model indicated by the parameter file includes: setting the number of encryption layers to be less than or equal to the maximum number of layers of the parameter in the parameter file.

[0010] In combination with the first aspect, in another possible implementation method, for each encryption layer, a mapping operation is performed on the parameter file according to a preset hash function to obtain an encrypted file, including: mapping the parameters of each encryption layer in the parameter file into a hash value of a preset length; and constructing an encrypted file according to the hash values ​​corresponding to all encryption layers in the parameter file.

[0011] In combination with the first aspect, in another possible implementation method, when the encryption strategy is a random encryption strategy, the parameter file is encrypted according to the encryption strategy to obtain an encrypted file, including: obtaining a first time and binary data of the parameter file, the first time is used to indicate the time when the parameter file is encrypted; encrypting the parameter file according to the binary data and the first time to obtain an encrypted file.

[0012] In combination with the first aspect, in another possible implementation manner, encrypting a parameter file according to binary data and a first time to obtain an encrypted file includes: adjusting a value of a random position of the binary data of the parameter file according to the first time.

[0013] In a second aspect, the present application provides a model encryption device, the model encryption device comprising:

[0014] The compression module is used to compress the target model according to preset compression information to obtain a compressed model.

[0015] The determination module is used to determine the encryption strategy according to the storage space of the compression model.

[0016] The acquisition module is used to obtain the parameter file of the compression model.

[0017] The encryption module is used to encrypt the parameter file according to the encryption policy.

[0018] In combination with the second aspect, in a possible implementation method, the determination module is specifically used to: when the storage space of the compression model is less than or equal to a first threshold, determine that the encryption strategy is a hierarchical encryption strategy; when the storage space of the compression model is greater than the first threshold, determine that the encryption strategy is a random encryption strategy.

[0019] In combination with the second aspect, in another possible implementation method, when the encryption strategy is a hierarchical encryption strategy, the encryption module is specifically used to: set the number of encryption layers and start the encryption layer according to the number of layers of the model indicated by the parameter file; for each encryption layer, map the parameter file according to a preset hash function to obtain an encrypted file.

[0020] In combination with the second aspect, in another possible implementation manner, the encryption module is specifically used to: set the number of encryption layers to be less than or equal to the maximum number of layers of the parameter in the parameter file.

[0021] In combination with the second aspect, in another possible implementation, the encryption module is specifically used to: map the parameters of each encryption layer in the parameter file into a hash value of a preset length; and construct an encryption file according to the hash values ​​corresponding to all encryption layers in the parameter file.

[0022] In combination with the second aspect, in another possible implementation method, when the encryption strategy is a random encryption strategy, the encryption module is specifically used to: obtain binary data of a first time and a parameter file, the first time being used to indicate the time when the parameter file is encrypted; encrypt the parameter file according to the binary data and the first time to obtain an encrypted file.

[0023] In combination with the second aspect, in another possible implementation manner, the encryption module is specifically used to: adjust the value of the random position of the binary data of the parameter file according to the first time.

[0024] In order to achieve the above-mentioned purpose, according to the third aspect of the present application, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the model encryption method of the above-mentioned first aspect.

[0025] In order to achieve the above-mentioned purpose, according to the fourth aspect of the present application, an electronic device is provided, which includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call the program instructions in the memory to execute the model encryption method of the first aspect mentioned above.

[0026] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0027] The present application provides a model encryption method, device, storage medium and electronic device. The present application compresses the model and determines the encryption strategy according to the compressed model, which can save computing resources of the computing device while realizing model encryption and improve the efficiency of model encryption. The security of deep learning models can be improved by using two encryption methods: hierarchical encryption strategy and random encryption strategy.

[0028] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0030] Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown;

[0031] Figure 2 A schematic diagram of a flow chart of a model encryption method provided in an embodiment of the present application is shown;

[0032] Figure 3 A schematic diagram of the structure of a model encryption device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0033] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0034] In the embodiments of the present application, the terms "first" and "second" do not have a logical or temporal dependency, nor do they limit the quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another element.

[0035] In the embodiments of the present application, the term "at least one" means one or more, and the term "plurality" means two or more.

[0036] It should also be understood that the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrase "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted as "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0037] As described in the background technology, deep learning models are widely used in many fields such as system identification, pattern recognition, artificial intelligence, etc. As deep learning technology continues to mature, deep learning models have been applied to application products of many terminal devices. The application of deep learning models often involves security issues. When deep learning models are deployed on the terminal device side, model information is prone to leakage.

[0038] In view of this, an embodiment of the present application provides a model encryption method, and the specific method includes: compressing the target model according to preset compression information to obtain a compressed model; determining the encryption strategy according to the storage space of the compressed model; obtaining the parameter file of the compressed model; encrypting the parameter file according to the encryption strategy to obtain an encrypted file. By compressing the model and determining the encryption strategy according to the compressed model, the present application can save the computing resources of the computing device while realizing the encryption of the model, and can also improve the efficiency of encrypting the model. The security of the deep learning model can be improved by two encryption methods: hierarchical encryption strategy and random encryption strategy.

[0039] The embodiment of the present application also provides a model encryption device, which can be used to execute the above-mentioned model encryption method. Optionally, the model encryption device can be an electronic device with data processing capability, or a functional module in the electronic device, which is not limited.

[0040] For example, the electronic device may be a server, which may be a single server, or a server cluster consisting of multiple servers. For another example, the electronic device may be a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, and a cellular phone, a personal digital assistant (PDA), an augmented reality (AR), a virtual reality (VR) device and other terminal devices. For another example, the electronic device may also be a recording device, a video surveillance device and other devices. The present application does not impose any special restrictions on the specific form of the electronic device.

[0041] The following takes the model encryption device as an electronic device as an example. Figure 1 As shown, Figure 1 The present application provides a hardware structure of an electronic device 100.

[0042] like Figure 1 As shown, the electronic device 100 includes a processor 110 , a communication circuit 120 and a communication interface 130 .

[0043] Optionally, the electronic device 100 may further include a memory 140 . The processor 110 , the memory 140 and the communication interface 130 may be connected via a communication line 120 .

[0044] The processor 110 may be a central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 110 may also be any other device having a processing function, such as a circuit, a device, or a software module, without limitation.

[0045] In one example, the processor 110 may include one or more CPUs, such as Figure 1 CPU0 and CPU1 in.

[0046] As an optional implementation, the electronic device 100 includes multiple processors, for example, in addition to the processor 110, it may also include a processor 170. The communication line 120 is used to transmit information between the components included in the electronic device 100.

[0047] The communication interface 130 is used to communicate with other devices or other communication networks. The other communication networks may be Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc. The communication interface 130 may be a module, a circuit, a transceiver or any device capable of achieving communication.

[0048] The memory 140 is used to store instructions, where the instructions may be computer programs.

[0049] Among them, the memory 140 can be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage devices, etc., without limitation.

[0050] It should be noted that the memory 140 may exist independently of the processor 110 or may be integrated with the processor 110. The memory 140 may be used to store instructions or program codes or some data, etc. The memory 140 may be located inside the electronic device 100 or outside the electronic device 100, without limitation.

[0051] The processor 110 is used to execute the instructions stored in the memory 140 to implement the communication method provided in the following embodiments of the present application. For example, when the electronic device 100 is a terminal or a chip in a terminal, the processor 110 can execute the instructions stored in the memory 140 to implement the steps performed by the transmitting end in the following embodiments of the present application.

[0052] As an optional implementation, the electronic device 100 further includes an output device 150 and an input device 160. The output device 150 may be a device such as a display screen, a speaker, etc. that can output data of the electronic device 100 to a user. The input device 160 may be a device such as a keyboard, a mouse, a microphone, or a joystick that can input data to the electronic device 100.

[0053] It should be pointed out that Figure 1 The structure shown in the figure does not constitute a limitation on the computing device, except Figure 1 In addition to the components shown, the computing device may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0054] The model encryption device and application scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the model encryption device and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0055] Next, the model encryption method is described in detail with reference to the accompanying drawings. Figure 2 A schematic diagram of a model encryption method provided in this application. The method is applied to Figure 1 The model encryption device of the hardware structure shown in the figure specifically comprises the following steps:

[0056] Step 210: compress the target model according to preset compression information to obtain a compressed model.

[0057] At present, the application scope of deep learning models is getting wider and wider, the complexity of deep learning models is getting higher and higher, and the resource requirements for the device side where the deep learning model is deployed are also getting higher and higher. Similarly, when encrypting a deep learning model, as the complexity of the deep learning model increases, the number of parameters in the deep learning model will also increase, and then the resources required to encrypt the deep learning model will also increase. Therefore, in an embodiment of the present application, the deep learning model is first compressed to obtain a compressed model. Under the premise of ensuring the prediction effect of the deep learning model, the size of the deep learning model is reduced as much as possible, and fewer resources are used to complete the encryption of the deep learning model, so as to better adapt to the resource requirements of the device side.

[0058] Deep learning model compression refers to using the redundancy of neural network parameters and structures to simplify the model, without affecting the task completion, to obtain a model with fewer parameters and a more streamlined structure. The compressed model requires less computing resources and memory, and can meet a wider range of application needs than the original model.

[0059] In an embodiment of the present application, the deep learning model is compressed by pruning. Pruning refers to designing evaluation criteria for network parameters based on a pre-trained deep learning model, and deleting "redundant" parameters based on this. According to the coarseness of the pruning granularity, parameter pruning can be divided into unstructured pruning and structured pruning. The granularity of unstructured pruning is relatively fine, and any "redundant" parameters in the desired proportion in the network can be removed without restriction, but it will bring about the problem that the network structure is irregular after pruning and it is difficult to effectively accelerate. The granularity of structured pruning is relatively coarse, and the smallest unit of pruning is the combination of parameters in the filter. By setting an evaluation factor for the filter or feature map, you can even delete the entire filter or several channels to make the network "narrower", which can directly obtain effective acceleration on existing software and hardware, but it may lead to a decrease in prediction accuracy, and it is necessary to restore performance by fine-tuning the model.

[0060] For example, obtain preset compression information corresponding to each layer of the network of the initial deep learning model to be compressed, wherein the initial deep learning model includes one or more layers of multi-branch networks, and one or more layers of single-branch networks, and the preset compression information is used to indicate the retained channels and pruned channels in each layer of the network. Determine the target compression information corresponding to the initial deep learning model based on the preset compression information, wherein the target compression information includes first compression information corresponding to each multi-branch network and second compression information corresponding to each single-branch network, the first compression information is obtained by fusing the preset compression information corresponding to each branch of the multi-branch network, the number of channels included in the first compression information is consistent with the number of channels of each branch of the multi-branch network, and the second compression information is the preset compression information corresponding to the single-branch network. Compress the initial deep learning model according to the target compression information to obtain a compressed model.

[0061] The target compression information corresponding to the initial deep learning model is determined by obtaining the initial compression information for indicating the retained channels and pruned channels in each layer of the network. In the target compression information, the first compression information corresponding to the multi-branch network is obtained by fusing the initial compression information corresponding to each branch of the multi-branch network, and the number of channels included in the first compression information is consistent with the number of channels of each branch of the multi-branch network. The second compression information corresponding to the single-branch network is the initial compression information corresponding to the single-branch network. This achieves the goal of compressing each layer of the network in the initial deep learning model without adding additional network layers, reducing the complexity of the model, thereby reducing the complexity of the model obtained after compressing the deep learning model.

[0062] Step 220: Determine an encryption strategy based on the storage space of the compression model.

[0063] When a computing device encrypts a deep learning model, it needs to occupy the storage resources of the computing device. Therefore, in an embodiment of the present application, after compressing the deep learning model and before encrypting it, it is necessary to determine the storage space of the compressed model and determine the specific encryption strategy based on the storage space occupied by the compressed model to avoid occupying too many resources of the computing device and affecting other threads of the computing device. It can also improve encryption efficiency.

[0064] In one embodiment, when the storage space of the compression model is less than or equal to the first threshold, the encryption strategy is determined to be a hierarchical encryption strategy. In other words, it means that the storage space occupied by the compression model is small, the amount of calculation required to encrypt the compression model is also small, and the hierarchical encryption strategy with the highest security can be used for encryption. When the storage space of the compression model is greater than the first threshold, the encryption strategy is determined to be a random encryption strategy. This means that the storage space occupied by the compression model is large, and the amount of calculation required to encrypt the compression model is also large, so the random encryption strategy with small resource occupation is used for encryption.

[0065] Step 230: Obtain the parameter file of the compression model.

[0066] Before encrypting the compression model according to the encryption strategy, it is also necessary to obtain the parameter file of the compression model. Since the device end where the deep learning model is deployed can restore the complete deep learning model according to the parameter file corresponding to the deep learning model and the corresponding deep learning framework. Therefore, when encrypting the deep learning model, this application only needs to encrypt the parameter file therein.

[0067] For example, the parameter file includes node identification, weight parameters, input parameters, output parameters, and operation parameters. Node identification is information used to identify the identity of the node. Weight parameters are used to describe the importance of the node. Operation parameters are used to describe the operation function or attribute of the node. The input / output parameters of the node reflect the connection relationship between the nodes.

[0068] Step 240: Encrypt the parameter file according to the encryption policy to obtain an encrypted file.

[0069] After the encryption strategy and parameter file are determined, the parameter file is encrypted according to the encryption strategy.

[0070] When the encryption strategy is a hierarchical encryption strategy, the number of encryption layers and the starting encryption layer are set according to the number of layers of the model indicated by the parameter file; for each encryption layer, the parameter file is mapped according to a preset hash function to obtain an encrypted file.

[0071] Specifically, the starting encryption layer and the number of encryption layers are set according to the number of layers of the deep learning model determined in the parameter file. The number of encryption layers is set to be less than or equal to the maximum number of layers of the model indicated in the parameter file, and the starting number of encryption layers is less than or equal to the difference between the maximum number of layers of the model and the number of encryption layers. Encrypt the parameter file layer by layer starting from the starting encryption layer. Map the parameters of each encryption layer in the parameter file into a hash value of a preset length; construct an encrypted file according to the hash values ​​corresponding to all encryption layers in the parameter file.

[0072] The hash algorithm maps a binary value string of any length to a binary value string of fixed length, and the binary value string obtained after mapping the original data is the hash value. Therefore, this application also needs to convert the parameters of each encryption layer into a binary value string.

[0073] Since the hash algorithm cannot reversely deduce the original data from the hash value and is very sensitive to the input data, even if the original data is modified by only one bit, the final hash value will be very different. In addition, the hash algorithm has high execution efficiency and can quickly calculate the hash value for longer texts. Encrypting the model parameter file through the hash algorithm can improve the security of the model.

[0074] When the encryption strategy is a random encryption strategy, the storage space occupied by the compression model is large, and the amount of calculation required to encrypt the compression model is also large. Therefore, the parameter file is randomly encrypted through time information. Specifically, the first time and the binary data of the parameter file are obtained, and the first time is used to indicate the time when the parameter file is encrypted. According to the first time, the value of the random position of the binary data of the parameter file is adjusted to realize the encryption of the parameter file, and then the encrypted file is obtained.

[0075] In summary, this application can save computing resources of computing devices while encrypting the model by compressing the model and determining the encryption strategy based on the compressed model, and can also improve the efficiency of encrypting the model. The security of deep learning models can be improved through two encryption methods: hierarchical encryption strategy and random encryption strategy.

[0076] It is understandable that in order to implement the functions in the above embodiments, the computer device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0077] Furthermore, as a response to the above Figure 2The implementation of the method embodiment shown in the figure, the embodiment of the present application provides a model encryption device, which is used to encrypt the target model. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Figure 3 As shown, the model encryption device 300 includes:

[0078] The compression module 310 is used to compress the target model according to preset compression information to obtain a compressed model.

[0079] The determination module 320 is used to determine the encryption strategy according to the storage space of the compression model.

[0080] The acquisition module 330 is used to acquire the parameter file of the compression model.

[0081] The encryption module 340 is used to encrypt the parameter file according to the encryption policy.

[0082] Further, such as Figure 3 As shown, the determination module 320 is specifically used to: when the storage space of the compression model is less than or equal to the first threshold, determine the encryption strategy as a hierarchical encryption strategy; when the storage space of the compression model is greater than the first threshold, determine the encryption strategy as a random encryption strategy.

[0083] Further, such as Figure 3 As shown, when the encryption strategy is a hierarchical encryption strategy, the encryption module 340 is specifically used to: set the number of encryption layers and the start encryption layer according to the number of layers of the model indicated by the parameter file; for each encryption layer, map the parameter file according to a preset hash function to obtain an encrypted file.

[0084] Further, such as Figure 3 As shown, the encryption module 340 is specifically used to: set the number of encryption layers to be less than or equal to the maximum number of layers of the parameter in the parameter file.

[0085] Further, such as Figure 3 As shown, the encryption module 340 is specifically used to: map the parameters of each encryption layer in the parameter file into a Hash value of a preset length; and construct an encryption file according to the Hash values ​​corresponding to all encryption layers in the parameter file.

[0086] Further, such as Figure 3 As shown, when the encryption strategy is a random encryption strategy, the encryption module 340 is specifically used to: obtain the binary data of the first time and the parameter file, the first time is used to indicate the time for encrypting the parameter file; encrypt the parameter file according to the binary data and the first time to obtain an encrypted file.

[0087] Further, such as Figure 3 As shown, the encryption module 340 is specifically used to adjust the value of the random position of the binary data of the parameter file according to the first time.

[0088] An embodiment of the present application provides a storage medium on which a program is stored, and when the program is executed by a processor, the model encryption method is implemented.

[0089] An embodiment of the present application provides a processor, which is used to run a program, wherein the model encryption method is executed when the program is running.

[0090] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: compressing a target model according to preset compression information to obtain a compressed model; determining an encryption strategy according to the storage space of the compressed model; obtaining a parameter file of the compressed model; and encrypting the parameter file according to the encryption strategy to obtain an encrypted file.

[0091] Furthermore, an encryption strategy is determined based on the storage space of the compression model, including: when the storage space of the compression model is less than or equal to a first threshold, determining the encryption strategy to be a hierarchical encryption strategy; when the storage space of the compression model is greater than the first threshold, determining the encryption strategy to be a random encryption strategy.

[0092] Furthermore, when the encryption strategy is a hierarchical encryption strategy, the parameter file is encrypted according to the encryption strategy to obtain an encrypted file, including: setting the number of encryption layers and starting the encryption layer according to the number of layers of the model indicated by the parameter file; for each encryption layer, mapping the parameter file according to a preset hash function to obtain an encrypted file.

[0093] Further, the number of encryption layers is set according to the number of layers of the model indicated by the parameter file, including: setting the number of encryption layers to be less than or equal to the maximum number of layers of the parameter in the parameter file.

[0094] Furthermore, for each encryption layer, a mapping operation is performed on the parameter file according to a preset hash function to obtain an encrypted file, including: mapping the parameters of each encryption layer in the parameter file into a hash value of a preset length; and constructing an encrypted file according to the hash values ​​corresponding to all encryption layers in the parameter file.

[0095] Furthermore, when the encryption strategy is a random encryption strategy, the parameter file is encrypted according to the encryption strategy to obtain an encrypted file, including: obtaining a first time and binary data of the parameter file, the first time is used to indicate the time when the parameter file is encrypted; encrypting the parameter file according to the binary data and the first time to obtain an encrypted file.

[0096] Further, the parameter file is encrypted according to the binary data and the first time to obtain the encrypted file, including: adjusting the value of the random position of the binary data of the parameter file according to the first time.

[0097] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0098] In a typical configuration, the device includes one or more processors (CPU), memory and bus. The device may also include input / output interface, network interface and the like.

[0099] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0100] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0101] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0102] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0103] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A model encryption method, characterized in that: The method comprises: Compressing the target model according to preset compression information to obtain a compressed model, wherein the preset compression information is used to indicate the retained channels and the pruned channels in each layer of the network, and the preset compression information includes first compression information corresponding to each multi-branch network and second compression information corresponding to each single-branch network; Determining an encryption strategy according to the storage space of the compression model; Obtaining a parameter file of the compression model; Encrypting the parameter file according to the encryption strategy to obtain an encrypted file; When the storage space of the compression model is less than or equal to a first threshold, determining that the encryption strategy is a hierarchical encryption strategy; When the encryption strategy is the hierarchical encryption strategy, encrypting the parameter file according to the encryption strategy to obtain an encrypted file includes: Setting the number of encryption layers and the start encryption layer according to the number of model layers indicated by the parameter file, wherein the start encryption layer number is equal to the difference between the maximum number of model layers and the number of encryption layers; For each encryption layer, mapping operation is performed on the parameter file according to a preset hash function to obtain the encrypted file; The mapping operation is performed on the parameter file according to a preset hash function for each encryption layer to obtain the encrypted file, including: Mapping the parameters of each encryption layer in the parameter file into a Hash value of a preset length; The encrypted file is constructed according to the Hash values ​​corresponding to all encryption layers in the parameter file.

2. The method according to claim 1, characterized in that Determining an encryption strategy according to the storage space of the compression model includes: When the storage space of the compression model is greater than the first threshold, the encryption strategy is determined to be a random encryption strategy.

3. The method according to claim 1, characterized in that The number of encryption layers is set according to the number of layers of the parameters in the parameter file, including: The number of encryption layers is set to be less than or equal to the maximum number of layers of the parameter in the parameter file.

4. The method according to claim 2, characterized in that: When the encryption strategy is a random encryption strategy, encrypting the parameter file according to the encryption strategy to obtain an encrypted file includes: Acquire a first time and binary data of the parameter file, wherein the first time is used to indicate a time for encrypting the parameter file; The parameter file is encrypted according to the binary data and the first time to obtain the encrypted file.

5. The method according to claim 4, characterized in that Encrypting the parameter file according to the binary data and the first time to obtain the encrypted file includes: According to the first time, the value of the random position of the binary data of the parameter file is adjusted.

6. A model encryption device, characterized in that: The device comprises: A compression module, used to compress the target model according to preset compression information to obtain a compressed model, wherein the preset compression information is used to indicate the retained channels and the pruned channels in each layer of the network, and the preset compression information includes first compression information corresponding to each multi-branch network and second compression information corresponding to each single-branch network; A determination module, used to determine an encryption strategy according to the storage space of the compression model; An acquisition module, used for acquiring a parameter file of the compression model; An encryption module, used for encrypting the parameter file according to the encryption strategy; A determination module, configured to determine that the encryption strategy is a hierarchical encryption strategy when the storage space of the compression model is less than or equal to a first threshold; When the encryption strategy is the hierarchical encryption strategy, encrypting the parameter file according to the encryption strategy to obtain an encrypted file includes: The encryption module is used to set the number of encryption layers and the starting encryption layer according to the number of model layers indicated by the parameter file, and the starting encryption layer number is equal to the difference between the maximum number of model layers and the number of encryption layers; For each encryption layer, mapping operation is performed on the parameter file according to a preset hash function to obtain the encrypted file; The mapping operation is performed on the parameter file according to a preset hash function for each encryption layer to obtain the encrypted file, including: Mapping the parameters of each encryption layer in the parameter file into a Hash value of a preset length; The encrypted file is constructed according to the Hash values ​​corresponding to all encryption layers in the parameter file.

7. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the model encryption method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: The device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the model encryption method as described in any one of claims 1-5.

Images