Method and related device for implementing security model reasoning

Abstract

The present disclosure provides a method for implementing security model reasoning and related equipment. The method comprises: grouping at least part of the convolution kernel of a first model in a trusted execution environment, and performing obfuscation processing on the group by using random information to obtain an encrypted second model; wherein the obfuscation information used in the obfuscation processing is stored in the trusted execution environment, and the obfuscation information comprises group information of the convolution kernel and random information corresponding to the group; deploying the second model in a model reasoning environment, performing model reasoning on input information by using the second model to obtain a first output result; and processing the first output result by using the obfuscation information in the trusted execution environment to obtain a second output result.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method and related equipment for implementing secure model reasoning. Background Technology

[0002] In recent years, thanks to the continuous development of artificial intelligence (AI) technology, various AI products have been widely used in fields such as payment, risk control, security, and autonomous driving. With the popularization of AI applications, a more convenient and efficient user experience has become a pursuit. Therefore, based on traditional cloud services, AI is increasingly being applied directly to the edge, completing all model loading and inference calculations directly on terminal or edge devices. However, this has also brought a series of risks and challenges, among which protecting the security of edge models is one of the issues of great concern.

[0003] To protect model security, related technologies have provided several model obfuscation methods, which protect the model by obfuscating and encrypting model parameters. However, current model obfuscation methods can recover some of the obfuscated model parameters from the obfuscated model, and thus the model can be restored based on these parameters, thereby affecting the security of the model and user data. Summary of the Invention

[0004] In view of this, the purpose of this disclosure is to propose a device for implementing secure model reasoning.

[0005] To achieve the above objectives, the first aspect of this disclosure provides a method for implementing secure model reasoning, comprising:

[0006] At least a portion of the convolutional kernels of a first model in a trusted execution environment are grouped, and the groups are obfuscated using random information to obtain an encrypted second model; wherein, the obfuscation information used during the obfuscation process is stored in the trusted execution environment, and the obfuscation information includes the grouping information of the convolutional kernels and the random information corresponding to the groups;

[0007] The second model is deployed in a model inference environment, and the input information is inferred through the second model to obtain the first output result.

[0008] The first output result is processed using the obfuscation information in the trusted execution environment to obtain the second output result.

[0009] In some embodiments, the model inference environment includes an edge device or a terminal device, and the model inference environment is an untrusted execution environment.

[0010] In some embodiments, grouping at least a portion of the convolutional kernels of the first model in the trusted execution environment includes:

[0011] For any convolutional layer in the first model, the convolutional kernels in that convolutional layer are grouped.

[0012] And / or,

[0013] For multiple convolutional layers in the first model, the convolutional kernels in the multiple convolutional layers are mixed and grouped.

[0014] In some embodiments, the method further includes:

[0015] The convolutional kernels with the most distant cosine similarity are grouped together.

[0016] In some embodiments, the random information includes: a group of vectors that are linearly independent of the number of convolutional kernels in the group;

[0017] The step of using random information to confuse each group includes: calculating the product of the group and the vector group.

[0018] In some embodiments, the random information corresponding to different groups is different.

[0019] In some embodiments, the method further includes:

[0020] The indices of each convolutional kernel after obfuscation are randomly shuffled.

[0021] In some embodiments, the first output result includes intermediate output results corresponding to different convolutional layers of the second model and the final output result of the second model;

[0022] The process of processing the first output result using the obfuscation information in the trusted execution environment to obtain the second output result includes:

[0023] The intermediate output result is transmitted to the trusted execution environment, and the intermediate output result is inversely operated on based on the obfuscation information to obtain the intermediate operation result. The intermediate operation result is then sent to the second model for the operation of the next convolutional layer.

[0024] Repeat the above process until all convolutional layers of the second model have been processed, and obtain the final output result of the second model;

[0025] The final output of the second model is transmitted to the trusted execution environment, and the final output of the second model is inversely operated on based on the obfuscation information to obtain the second output.

[0026] In some embodiments, during the transmission of the intermediate output results, the intermediate computation results, and the final output results between the trusted execution environment and the second model, the intermediate output results, the intermediate computation results, and the final output results are encrypted.

[0027] In some embodiments, the second model is run on an accelerated device; the step of performing model inference on the input information using the second model includes:

[0028] The acceleration device is used to accelerate the linear calculations in the second model.

[0029] The second aspect of this disclosure provides a model security assessment method, including:

[0030] Obtain the model to be evaluated, which includes the second model as described in the first aspect;

[0031] Determine the type of the model to be evaluated, and obtain the publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated;

[0032] Statistical analysis is performed on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated;

[0033] The model to be evaluated is restored based on the pre-trained model, the obfuscated content, and the obfuscation method to obtain the restored model;

[0034] The safety of the model to be evaluated is determined based on the comparison results of the output information of the restored model and the model to be evaluated.

[0035] A third aspect of this disclosure provides an apparatus for implementing secure model reasoning, comprising:

[0036] The obfuscation module is configured to: group at least a portion of the convolutional kernels of a first model in a trusted execution environment, and obfuscate the groups using random information to obtain an encrypted second model; wherein the obfuscation information used during the obfuscation process is stored in the trusted execution environment, and the obfuscation information includes the grouping information of the convolutional kernels and the random information corresponding to the groups;

[0037] The inference module is configured to: deploy the second model in the model inference, perform model inference on the input information through the second model, and obtain the first output result;

[0038] The processing module is configured to process the first output result using the obfuscation information in the trusted execution environment to obtain a second output result.

[0039] A fourth aspect of this disclosure provides a model safety assessment apparatus, comprising:

[0040] The acquisition module is configured to: acquire a model to be evaluated, the model to be evaluated including the second model as described in the first aspect;

[0041] The determination module is configured to: determine the type of the model to be evaluated, and obtain a publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated;

[0042] The analysis module is configured to perform statistical analysis on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated.

[0043] The restoration module is configured to restore the model to be evaluated based on the pre-trained model, the obfuscated content, and the obfuscation method to obtain the restored model;

[0044] The security module is configured to determine the security of the model to be evaluated based on the comparison results of the output information of the restored model and the model to be evaluated.

[0045] A fifth aspect of this disclosure provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in the first or second aspect.

[0046] A sixth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method described in the first or second aspect.

[0047] A seventh aspect of this disclosure provides a computer program product including computer program instructions that, when executed on a computer, cause the computer to perform the method described in the first or second aspect.

[0048] As can be seen from the above, the method and related device for implementing secure model inference provided in this disclosure store the first model in a trusted execution environment. By grouping at least some of the convolutional kernels in the first model and obfuscating the groups using random information, an encrypted second model is obtained. The obfuscation information used in the obfuscation process is stored in the trusted execution environment. This introduces sufficient randomness and thoroughly obfuscates the convolutional kernels, ensuring the parameter security when the model is deployed to an edge device and preventing the model and user information from being disclosed during the inference process. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating an exemplary method provided by an embodiment of this disclosure is shown.

[0051] Figure 2 A schematic diagram of an exemplary convolution kernel obfuscation according to an embodiment of the present disclosure is shown.

[0052] Figure 3 A flowchart illustrating an exemplary method provided by an embodiment of this disclosure is shown.

[0053] Figure 4 A flowchart illustrating an exemplary method provided by an embodiment of this disclosure is shown.

[0054] Figure 5 A schematic diagram illustrating an exemplary result according to an embodiment of the present disclosure is shown.

[0055] Figure 6 A schematic diagram illustrating an exemplary result according to an embodiment of the present disclosure is shown.

[0056] Figure 7 A flowchart illustrating an exemplary method provided by an embodiment of this disclosure is shown.

[0057] Figure 8 A schematic diagram of an exemplary apparatus provided by an embodiment of the present disclosure is shown.

[0058] Figure 9 A schematic diagram of an exemplary apparatus provided by an embodiment of the present disclosure is shown.

[0059] Figure 10 A schematic diagram of the hardware structure of an exemplary computer device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0061] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0062] As described in the background section, with the increasing importance of model inference services on edge devices, users tend to deploy inference services to edge devices equipped with powerful accelerators such as GPUs or NPUs to reduce latency and instability in cloud communication. However, because terminal devices are more open and easier to debug and analyze, especially in user-facing scenarios where any user can download models to their local device via an app, edge devices may be untrusted, and directly loading model parameters may compromise the security of model or user data.

[0063] To improve the security of models deployed on edge devices, hardware-accelerated secure outsourced inference schemes based on cryptography and Trusted Execution Environment (TEE) can be used to encrypt the models.

[0064] While cryptographic schemes are secure and provable, they come with high overhead and loss of accuracy. In contrast, reasoning based on trusted execution environments has low latency and no loss of accuracy, making it more suitable for on-device inference.

[0065] For TEE-based solutions, one approach is to shield certain layers within the TEE, but this method has been compromised. Another approach involves obfuscating the model to prevent the GPU from directly using offloaded parameters and utilizing secret information stored in the TEE to ensure normal inference. This type of solution is more covert, introducing passive adversaries to perform black-box attacks and analyze the security performance of the model.

[0066] However, these schemes modify the model parameters less during the obfuscation process, which allows some secret parameters to be recovered from the obfuscated model.

[0067] In view of this, embodiments of the present disclosure provide a method for implementing secure model reasoning to solve the above-mentioned problems.

[0068] like Figure 1 As shown, the method for implementing secure model inference includes:

[0069] Step S101: At least a portion of the convolutional kernels of the first model in the trusted execution environment are grouped, and the groups are obfuscated using random information to obtain an encrypted second model; wherein, the obfuscation information used in the obfuscation process is stored in the trusted execution environment, and the obfuscation information includes the grouping information of the convolutional kernels and the random information corresponding to the groups.

[0070] The first model is a pre-trained model that can be used to implement reasoning functions. The first model can be trained using any model training method, and this embodiment does not limit it.

[0071] The first model can be any type of model, such as a neural network model, a clustering model, a reinforcement learning model, or a natural language processing model; this embodiment does not limit this type of model.

[0072] In this embodiment, after obtaining the first model, the first model can be deployed to the trusted execution environment (TEE) of the terminal device.

[0073] Trusted Execution Environment (TEE) is a hardware-based security technology that creates a secure computing environment isolated from the outside world by dividing it into secure and insecure parts. This secure computing environment guarantees the confidentiality and integrity of the data and code loaded within it. Examples of TEE systems include Intel SGX, TDX, AMD SEV, and ARM TrustZone.

[0074] In this embodiment, after obtaining the first model, each convolutional kernel in each convolutional layer of the first model can be obtained, and each convolutional kernel can be randomly grouped, with each group including a certain number of convolutional kernels. Then, random information is used to obfuscate each group, thereby achieving model obfuscation and model encryption of the first model, thus obtaining the second model. The inference accuracy of the second model is basically the same as that of the first model.

[0075] In this embodiment, the obfuscation information used during obfuscation processing, such as the grouping information of the convolution kernel and the random information corresponding to the grouping, are stored in a trusted execution environment to ensure the security of the obfuscation information and prevent the obfuscation information from being obtained by adversaries to perform reverse obfuscation operations on the second model to restore the first model.

[0076] In this embodiment, some convolutional kernels of the first model can be grouped, and then randomly generated information can be used to obfuscate the convolutional kernels in each group. The more convolutional kernels that are grouped and obfuscated using random information, the less likely the encrypted second model is to be recovered.

[0077] Assuming the first model includes 16 convolutional kernels, and each group contains 4 convolutional kernels, when only one group is included, i.e., when only one set of random information is used to obfuscate this group of 4 convolutional kernels, if the obfuscated second model is used for analysis and compared with a publicly available pre-trained model (which corresponds to the first model, for example, the first model is obtained after training based on the pre-trained model), since the second model has 12 unobfuscated convolutional kernels, i.e., the two models have 12 identical convolutional kernels, it is easy to determine the 4 obfuscated convolutional kernels in the second model based on these 12 identical convolutional kernels. Only these 4 convolutional kernels need to be analyzed and processed to recover the first model.

[0078] If two groups are included, that is, if only two sets of random information are used to confuse the four convolutional kernels of these two groups, and if the confused second model is used for analysis and compared with the publicly available pre-trained model, since the second model has eight unconfused convolutional kernels, that is, the two models have eight identical convolutional kernels, then the eight confused convolutional kernels in the second model are determined based on these eight identical convolutional kernels. The analysis and processing based on these eight convolutional kernels are required to restore the first model, which is more complicated than the analysis and processing based on four convolutional kernels to restore the first model in the previous embodiment.

[0079] Furthermore, if the 16 convolutional kernels are divided into four groups, and each of the four groups is obfuscated using random information, then analysis and processing based on the 16 convolutional kernels are required to recover the first model, making it even more difficult to recover the first model.

[0080] In this embodiment, when all convolutional kernels are grouped and each group is obfuscated using random information, the resulting second model is more difficult to recover and has higher security.

[0081] In some embodiments, when grouping the convolutional kernels in the first model, the number of convolutional kernels in each group may be the same or different, and this embodiment does not limit this.

[0082] In this embodiment, the steps of grouping the convolution kernels in the first model and obfuscating the groups using random information are also performed in a trusted execution environment, thereby ensuring the security of the model during the obfuscation process.

[0083] Step S103: Deploy the second model in the model inference environment, and use the second model to perform model inference on the input information to obtain the first output result.

[0084] In this embodiment, a second model in a model reasoning environment can be used for model reasoning. When input information is input, the second model can obtain a first output result.

[0085] The model inference environment may include edge devices or terminal devices, and is typically an untrusted execution environment.

[0086] In this embodiment, after obtaining the second model, storing the second model in the model inference environment allows the use of various types of computing resources in the model inference environment to assist the inference process of the second model, thereby ensuring the inference process of the second model.

[0087] Step S105: In the trusted execution environment, the obfuscation information is used to process the first output result to obtain the second output result.

[0088] In this embodiment, when the second model outputs the first output result, the second model will transmit the first output result to the trusted execution environment. The trusted execution environment will then perform an inverse operation on the first output result based on pre-stored obfuscation information, such as the grouping information of the convolutional kernels in each convolutional layer and the random information corresponding to each group, thereby restoring the first output result and obtaining the correct output result corresponding to the first model, namely the second output result.

[0089] The method for implementing secure model inference described in this embodiment stores a first model in a trusted execution environment. By grouping at least a portion of the convolutional kernels in the first model and obfuscating the groups using random information, an encrypted second model is obtained. The obfuscation information used during the obfuscation process is stored in the trusted execution environment. This introduces sufficient randomness and thoroughly obfuscates the convolutional kernels, ensuring parameter security when the model is deployed to edge devices and preventing model and user information from being disclosed during the inference process.

[0090] In some embodiments, the grouping of at least a portion of the convolutional kernels of the first model in the trusted execution environment in step S101 includes: grouping the convolutional kernels in any convolutional layer of the first model.

[0091] In this embodiment, when grouping the convolutional kernels in the first model, the convolutional kernels within the same convolutional layer can be grouped, rather than grouping them across convolutional layers. That is, in this embodiment, when the first model includes multiple convolutional layers, the convolutional kernels in each convolutional layer are grouped separately, meaning that the convolutional kernels in each group belong to the same convolutional layer.

[0092] In some embodiments, the grouping of at least a portion of the convolutional kernels of the first model in the trusted execution environment in step S101 includes: for a plurality of convolutional layers in the first model, mixing and grouping the convolutional kernels in the plurality of convolutional layers.

[0093] In this embodiment, when grouping the convolutional kernels in the first model, the convolutional kernels in multiple convolutional layers are mixed and grouped, meaning that the convolutional kernels can be grouped across convolutional layers. That is, in this embodiment, when the first model includes multiple convolutional layers, the convolutional kernels in each convolutional layer are mixed and grouped, meaning that the convolutional kernels in each group can belong to convolutional kernels in different convolutional layers.

[0094] In some embodiments, for some convolutional layers in the first model, the convolutional kernels in those convolutional layers may be grouped; for another part of the convolutional layers in the first model, the convolutional kernels in multiple convolutional layers may be mixed and grouped. This embodiment does not limit this.

[0095] In the above embodiments, regardless of whether the convolutional kernels in each convolutional layer are grouped individually or in a mixed group across multiple convolutional layers, the grouping can be done on some convolutional layers or on all convolutional layers. Furthermore, the more convolutional layers are grouped, the more randomness can be introduced during obfuscation, resulting in more thorough obfuscation processing, making the initial model before obfuscation more difficult to recover, and enhancing security.

[0096] In some embodiments, the method further includes grouping a preset number of convolutional kernels with the greatest cosine similarity into a group. The preset number can be a user-defined number, such as 4. Users can reasonably set the number of convolutional kernels in each group based on factors such as the number of convolutional kernels and the complexity of model confusion; this embodiment does not limit this setting.

[0097] In this embodiment, since the two points with the farthest cosine similarity are easily distinguished by statistical analysis, clustering and confusing the points with the farthest distribution can make the convolution kernel tend to a random distribution of similarity.

[0098] Figure 2This diagram illustrates the dimensionality reduction to a two-dimensional plane using t-SNE with the first layer convolutional kernels of ResNet18 on the CIFAR100 dataset. Specifically, "×" represents the first model, and "·" represents a publicly available pre-trained model. For clarity, only 16 convolutional kernels were selected. Connecting convolutional kernels with the same index with lines shows that, in the left image, the distribution of convolutional kernels with the same index is very similar. Then, the method of this embodiment is used to find the four farthest convolutional kernels that are mutually confused. As shown in the middle image, the points connected by straight lines form a cluster. After linear combination and shuffling, judging the index before confusion according to the format of the left image is no longer feasible. The right image also connects the most similar convolutional kernels before confusion. It can be seen that the statistical distribution characteristics of the atoms have been completely scrambled, making it difficult to recover the model's convolutional kernels.

[0099] In some embodiments, the random information includes: a vector group that has the same number of convolution kernels as the group and is linearly independent; the step S103 of using the random information to confuse each group includes: calculating the product of the group and the vector group.

[0100] Taking each group as an example, which includes four convolutional kernels with the greatest cosine similarity, for each group Randomly select 4 linearly independent vector groups {a (1) , ..., a (4)}, randomly combine the points in the group, and calculate the product with the group. Then, for a single convolution kernel, the result after confusion is:

[0101] Correspondingly, the convolutional kernels of other groups were also confused with each other, and the result can be represented as:

[0102]

[0103] In this way, the convolutional kernels within each group confuse each other's statistical features, making it difficult to recover the first model before confusion, thus ensuring the safety of the first model.

[0104] In some embodiments, the random information corresponding to different groups is different, that is, the random information corresponding to each group is randomly generated and inconsistent, thereby ensuring that more random quantities are introduced during the model confusion process, the confusion processing is more thorough, the first model before confusion is more difficult to recover, and the security is higher.

[0105] In some embodiments, the method further includes: randomly shuffling the indices of each convolutional kernel after obfuscation, i.e., shuffling the convolutional kernels after obfuscation, i.e., mixing the convolutional kernels after obfuscation through shuffling or other methods, randomly shuffling the indices of each convolutional kernel, and thus randomly shuffling the connection relationships of each convolutional kernel, thereby further obfuscating the model. After the shuffling process is completed, the obfuscated weight matrix can be obtained, and thus the encrypted second model can be obtained.

[0106] In some embodiments, the first output result includes intermediate output results corresponding to different convolutional layers of the second model and the final output result of the second model;

[0107] Step S105, which involves processing the first output result using the obfuscation information in the trusted execution environment to obtain the second output result, includes: transmitting the intermediate output result to the trusted execution environment; performing an inverse operation on the intermediate output result based on the obfuscation information to obtain an intermediate operation result; sending the intermediate operation result to the second model for the operation of the next convolutional layer; repeating the above process until the operation of all convolutional layers of the second model is completed to obtain the final output result of the second model; transmitting the final output result of the second model to the trusted execution environment; performing an inverse operation on the final output result of the second model based on the obfuscation information to obtain the second output result.

[0108] The first output result may include intermediate output results corresponding to different convolutional layers. In this embodiment, when the second model outputs an intermediate output result corresponding to a certain convolutional layer, the second model transmits the intermediate output result to the trusted execution environment. The trusted execution environment then performs an inverse operation on the intermediate output result based on pre-stored obfuscation information, namely the grouping information of the convolutional kernels in the convolutional layer and the random information corresponding to each group, thereby restoring the intermediate output result and obtaining the intermediate operation result. This intermediate operation result is the output result of the corresponding convolutional layer when directly performing inference based on the first model. Afterwards, the intermediate operation result is returned to the second model for the operation of the next convolutional layer, and the above process is repeated until the operation of all convolutional layers of the second model is completed, obtaining the final output result of the second model.

[0109] When the second model completes all inference, that is, the first output result includes the final output result of the second model, the second model transmits the final output result of the second model to the trusted execution environment, and performs the inverse operation on the final output result of the second model based on the obfuscation information in the trusted execution environment, thereby obtaining the correct output result corresponding to the first model, that is, the second output result.

[0110] In this embodiment, to ensure data security, the intermediate output results, intermediate calculation results, and final output results are encrypted during transmission between the trusted execution environment and the second model. For example, the information is masked to ensure data security.

[0111] In some embodiments, the second model is run on an acceleration device such as a GPU (graphics processing unit) or an NPU (network processing unit); the step of performing model inference on the input information using the second model includes: using the acceleration device to accelerate the linear calculations in the second model, thereby improving the computation speed during model inference.

[0112] In this embodiment, the core of model inference is to recover the correct output result in a trusted execution environment. In this embodiment, the overall inference process is divided into multiple offload layers, with linear layers as the boundary. Each offload layer safely amortizes the heavy linear operations to an untrusted execution environment to utilize more computing resources (such as GPU acceleration) in the untrusted execution environment, while less computationally intensive nonlinear operations are performed in the TEE. The inference process of one offload layer is illustrated as an example.

[0113] like Figure 4 As shown, the method for implementing secure model inference includes a preprocessing phase and an inference phase.

[0114] In the preprocessing stage: The first model (i.e., the Secret Models) deployed in the Trusted Execution Environment (TEE) is obfuscated, including using inverse clustering, normally covered, and shuffle methods. Specifically, a predetermined number of convolutional kernels with the most distant cosine similarity in each convolutional layer of the first model are grouped together, and the indices of each convolutional kernel are randomly shuffled to obtain the second model (i.e., the Protected Models). The second model is then deployed on the GPU of an edge device or terminal device.

[0115] During the inference phase: For input X, input X is sent to the trusted execution environment for masking to obtain X′1, and X′1 is input into each convolutional layer of the second model.

[0116] Among them, for the linear confusion method f 0 Satisfying Y′=f 0 (Y) = Conv(W′, X). For the four output channels in a group, the corresponding output results can be expressed as:

[0117]

[0118] Thus, for each layer of input information X, the TEE masks it as X' = X + R, where R can be a mask of the same size as X, and simultaneously pre-computes the noise Conv(W',R) offline. The GPU then receives the obfuscated model W' and the encrypted data X' as input. Next, the GPU performs the cumbersome linear operation Y' = Conv(W',X') = Conv(W',X) + Conv(W',R). After receiving the input Y", the TEE removes the pre-computed mask Conv(W',R) and then uses the inverse operation to restore Conv(W',X), finally recovering the correct output Y in the TEE, obtaining the second output result.

[0119] Specifically, X′1 is first input into the first convolutional layer of the second model to obtain the intermediate output Y1′ of the first convolutional layer. The intermediate output Y1′ of the first convolutional layer is then sent to the trusted execution environment for parameter restoration. The obfuscation information corresponding to the first convolutional layer stored in the trusted execution environment is used to perform the inverse operation f. 0-1 (Y1′) obtains the intermediate operation result (nonlinear op), thus completing the first convolutional layer processing (offload layer1).

[0120] Then, the intermediate calculation result is returned to the second convolutional layer of the second model in the GPU to continue the calculation until the calculation of all convolutional layers of the second model is completed, and then the second output result (Result) is obtained.

[0121] The secure model inference method described in this embodiment provides a secure model inference method based on a Trusted Execution Environment (TEE). By grouping convolutional kernels and introducing random information to combine with the grouping, the model can be more thoroughly obfuscated, ensuring the security of model parameters. By using accelerated devices to perform complex linear operations during model inference, simpler operations are performed only in the TEE. Therefore, it can be applied to any TEE. While achieving high protection of model parameters, it avoids the problem of excessive computational overhead. Thus, it can both protect model parameters from being obtained by untrusted hardware accelerators and maintain the high efficiency and accuracy of the inference process, making it better suited for the field of edge computing.

[0122] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides a model security assessment method for evaluating the security of the method for implementing secure model reasoning described in this application. Figure 3 The method, wherein, includes:

[0123] Step S301: Obtain the model to be evaluated.

[0124] The model to be evaluated may include the encrypted second model in this application embodiment, or other encrypted models in related technologies. This embodiment does not limit this.

[0125] Step S303: Determine the type of the model to be evaluated, and obtain the publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated.

[0126] In this embodiment, the model used by the user is typically obtained by further training and then obfuscating a publicly available pre-trained model. Therefore, a corresponding pre-trained model can be obtained based on the type of model to be evaluated. Model obfuscation mainly falls into two categories:

[0127] One approach involves nnsplitter and magnitude, which modify the weights of the secret model as little as possible to obtain a confused model that is very similar to the secret model but completely unusable. The motivation behind this design is to pursue the stealth of the confusion while minimizing the computational overhead of the TEE in recovering the correct output.

[0128] Another approach includes Soter and Shadownet, which completely scramble the secret model at the lowest possible cost. This obfuscated model is entirely different from the secret model; from the adversary's perspective, there is no correspondence between the obfuscated and secret models, ensuring that the information of the secret model is not leaked.

[0129] The model parameter protection capabilities of these obfuscation methods can be evaluated by introducing simple adversaries that perform black-box attacks, with norm pruning and fine-tuning attacks used as supplementary experiments. However, the security of their obfuscation strategies has not been analyzed and is unknown.

[0130] Step S305: Perform statistical analysis on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated.

[0131] In this embodiment, the security of the model to be evaluated and the pre-trained model can be assessed through statistical analysis. The specific analysis process may include:

[0132] In some model obfuscation methods, to ensure the efficiency of the inference process, model parameters are modified as little as possible, so that the inference accuracy of the obfuscated model transmitted to the GPU is approximately the same as random guessing. However, the fixed modification strategy leads to a relatively extreme weight statistical distribution, allowing users to quickly locate abnormal intervals.

[0133] These methods follow an empirical conclusion: in machine learning, the larger the weight of a parameter, the greater its impact on the model's predictive performance. The magnitude method, based on this empirical principle, selects the largest weight for modification, replaces the top 1% of weights with random numbers, and restores these weights in the TEE (Translation Earth Array). Experiments show that the prediction accuracy of the confused model approximates that of random predictions under most grid structures. Similarly, nnsplitter selects as few important weights as possible using reinforcement learning. Under different networks and hyperparameters, the nnsplitter agent progressively reduces the number of selected modified convolutional kernels, resulting in the lowest possible accuracy of the confused model.

[0134] While these methods achieve effectiveness and stealthiness with minimal modifications, the networks, after being obfuscated using these methods, invariably exhibit similar properties, namely, anomalies in the distribution of large weight parameters. This is because the obfuscation method is fixed and does not introduce randomness; therefore, the obfuscation result will inevitably evolve towards the "optimal" of the policy, i.e., modifying the original weights to larger weights.

[0135] In some embodiments, the nnsplitter scheme was reproduced under different networks and parameters. Significantly anomalous network parameter behavior identified abnormal weight behavior. Thus, by replacing the weights in the anomalous regions, an attack model very similar to the original model could be obtained. Training this model with an additional black-box attack budget could achieve considerably high accuracy. Figure 5 The table shows the model distribution of NNSplitter. The font in the table indicates the location of outlier intervals and the accuracy of the confused model. Specifically, the NNSplitter model with 50 convolutional layers (ResNet) trained on the CIFAR100 dataset has an outlier interval position in the top 45.1% and an accuracy of 1.870% after confusion; the NNSplitter model with a convolutional neural network (AlexNet) trained on the CIFAR10 dataset has an outlier interval position in the top 62.7% and an accuracy of 10.030% after confusion; and the NNSplitter model with vgg16_bn trained on the STL10 dataset has an outlier interval position in the top 47.5% and an accuracy of 9.950% after confusion.

[0136] Some model obfuscation methods aim to shuffle the distribution of all model parameters in a cost-effective manner, by setting the smallest obfuscated atom as the convolution kernel and randomly obfuscating these atoms using lightweight methods such as shuffle and scale. However, statistical analysis has revealed that the atomic convolution kernels of secret and public models have similar statistical distributions, and this similarity allows for partial reversal of the obfuscation operation.

[0137] The core idea of ​​these methods is to introduce as little additional computation as possible to completely shuffle the model parameter distribution. Both types of methods essentially follow the same cryptographic paradigm. For a given set of weight parameters, scaling and shuffling are primarily used. By introducing a small amount of randomness, the model parameters can be sufficiently shuffled on a kernel-by-kernel basis. To verify whether scaling and shuffling can completely shuffle the model parameter distribution in kernel-by-kernel obfuscation methods, pre-trained models with the same network structure were selected, and the relationship between the kernel distributions of the pre-trained model and the secret model was evaluated. Experiments show that the cosine similarity distance between the pre-trained model and the secret model is very close, and the proportion of networks where the shuffled kernel indices of the obfuscated model can be found is close to 100%.

[0138] Figure 6 This is the result after reducing the dimensionality of the weights of the two networks, and the connection represents the correct matching relationship. Specifically, in the vgg16_bn model trained on the STL10 dataset, the similarity between the two networks in the features of the pre-trained model (public_network) and the secret model (secret_network) is 100%; in the 50-convolutional-layer (resnet) model trained on the STL10 dataset, the similarity between the two networks in the features of the pre-trained model (public_network) and the secret model (secret_network) is 98.4%; in the 18resnet_layer1.0.con model trained on the CIFAR100 dataset, the similarity between the two networks in the features of the pre-trained model (public_network) and the secret model (secret_network) is 100%; and in the AlexNet model trained on the CIFAR10 dataset, the similarity between the two networks in the features of the pre-trained model (public_network) and the secret model (secret_network) is 100%. As can be seen from the above, in most layers, the index before shuffling can be found through the publicly available pre-trained weights.

[0139] Statistical analysis of the evaluated and pre-trained models revealed that the adversary's goal was to obtain the model's private data. For model parameters that were obfuscated, declared "safe," and loaded onto the GPU, the adversary aimed to break the obfuscation and train an attack model with limited cost. This attack model would have the same architecture as the secret model and achieve performance comparable to the secret model on the same task.

[0140] To efficiently evaluate the security performance of a model, a powerful adversary can be introduced. This adversary is allowed a limited number of correct inferences, consistent with the assumptions of some black-box attacks. Simultaneously, the adversary can access all information globally, such as by pulling GPU memory and listening to PCIe signals to obtain model parameters and input data loaded onto the GPU. Furthermore, the adversary can actively acquire background knowledge, including the model's inference task, details of the model architecture, and publicly available pre-trained model parameters. In this way, the adversary can adaptively design attack schemes and attempt to build an attack model by integrating all this knowledge.

[0141] Step S307: Based on the pre-trained model, the obfuscated content, and the obfuscation method, the model to be evaluated is restored to obtain the restored model.

[0142] Step S309: Based on the comparison results of the output information of the restored model and the model to be evaluated, determine the security of the model to be evaluated.

[0143] like Figure 7 As shown, after training publicly available pre-trained models to obtain secret models, these secret models are obfuscated to obtain obfuscated models. These obfuscated models are then used as the models to be evaluated and targeted for attack. In the adversary world, the adversary first performs statistical analysis on the models to be evaluated. Based on the publicly available similarity leap between models, they determine the obfuscation method and attempt to reverse the obfuscation operation. After roughly eliminating the randomness introduced by the obfuscation based on the public strategy leap, a black-box attack is launched on the intermediate model. Following the knockoff design, the adversary is allowed 50 attack attempts per class. Using the sample images and label results from these 50 attempts, the intermediate model is retrained to obtain a surrogate model, which is very close to the pre-trained model.

[0144] For nnsplitter and magnitude, through Figure 7 The statistical analysis method shown locates the abnormal interval. By adaptively adjusting the range of the abnormal interval, the modified interval can be located relatively accurately, and the interval parameters are replaced with a publicly available pre-trained model. For SOTER and Shadownet, cosine similarity is used to find the correct convolution kernel index, and then the size of the convolution kernel is adaptively remeasured. In some embodiments, it is not necessary to accurately restore the convolution kernel size; restoring the convolution kernel with a scale of 0.1 can achieve high attack accuracy, thereby restoring the model to be evaluated and obtaining the restored model.

[0145] Finally, based on the comparison results of the output information of the restored model and the model to be evaluated, the security of the model to be evaluated is determined.

[0146] The table below shows the specific attack results and the model security assessment results.

[0147]

[0148] The left side represents the dataset, and the right side represents the attack results. Attack results without protecting the model under evaluation are denoted as No-shield, which also represents the inference accuracy of the model under evaluation. Subsequent schemes modify the secret model according to specific obfuscation methods to obtain approximately random inference results. The method for implementing secure model inference in this application is represented as (ours), where each group has 4 convolutional kernels, and all convolutional kernels in all convolutional layers are grouped and combined with different random information.

[0149] After introducing the model security evaluation method described in this application, the obfuscated model is partially restored, and the final attack result is close to the output of the model to be evaluated. The final attack effects of the four types of models are 2.91x, 3.09x, 2.82x, and 2.9x of the black-box attack baseline, respectively. Among them, the NNsplitter obfuscation scheme, which requires the least modification and removes very few abnormal weights, has the highest attack quality, reaching 97.8% of the accuracy of the original model to be evaluated. Correspondingly, Shadownet, due to completely disrupting the scale and arrangement of the convolutional kernels, achieves a final attack effect of 91.8% of the original model.

[0150] Based on the table above, under the model security assessment method, the attack effect on the method for implementing secure model inference in this application is only 1 / 3 of that of other model obfuscation methods, and 1.03x that of black-box attacks. The method for implementing secure model inference in this application does not contain any detectable anomalies, and the accuracy of restoring the group permutation using the publicly available pre-trained model is almost equal to that of random guessing.

[0151] like Figure 8As shown, the solid line represents the average cost of each obfuscation method, and the shaded area represents the distribution of all experiments. At the beginning of the convolutional network, due to the large shape of the input data, the I / O overhead is relatively high, and the differences between the various frameworks are not significant. As the number of data out_channels increases, the CPU load increases, leading to performance differences. However, since the inverse homomorphic operation in this application (ourscheme) has the same O(n) complexity as slalom, the performance overhead of the obfuscation method in this application is basically consistent with slalom. For example, in the overhead of the intermediate convolutional layers, the difference between the obfuscation method in this application and slalom is 0.27ms, while darknight is 1.19ms longer than the obfuscation method in this application. Overall, the obfuscation method in this application improves security without introducing excessive overhead.

[0152] The table below shows the results of the throughput test.

[0153]

[0154] As shown in the table above, inference without TEE and the proposed model obfuscation method were tested in the same experimental environment. Overall, the throughput of the proposed model obfuscation method is 1 / 14 to 1 / 5 of that of pure GPU inference, and compared to slalom without model parameter protection, it only loses less than 3% of throughput. This demonstrates that on edge devices, the proposed model obfuscation method can fully utilize the capabilities of the accelerator, achieving the requirements of real-time inference while providing additional protection for model parameters.

[0155] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0156] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0157] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0158] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0159] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0160] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0161] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides an apparatus for implementing secure model reasoning.

[0162] refer to Figure 8 The device includes:

[0163] The obfuscation module 11 is configured to: group at least a portion of the convolutional kernels of a first model in a trusted execution environment, and obfuscate the groups using random information to obtain an encrypted second model; wherein the obfuscation information used during the obfuscation process is stored in the trusted execution environment, and the obfuscation information includes the grouping information of the convolutional kernels and the random information corresponding to the groups;

[0164] Inference module 13 is configured to: deploy the second model in model inference, perform model inference on the input information through the second model, and obtain the first output result;

[0165] Processing module 15 is configured to process the first output result using the obfuscation information in the trusted execution environment to obtain a second output result.

[0166] In some embodiments, the model inference environment includes an edge device or a terminal device, and the model inference environment is an untrusted execution environment.

[0167] In some embodiments, the obfuscation module 11 is further configured to:

[0168] For any convolutional layer in the first model, the convolutional kernels in that convolutional layer are grouped.

[0169] And / or,

[0170] For multiple convolutional layers in the first model, the convolutional kernels in the multiple convolutional layers are mixed and grouped.

[0171] In some embodiments, the device is further configured to:

[0172] The convolutional kernels with the most distant cosine similarity are grouped together.

[0173] In some embodiments, the random information includes: a group of vectors that are linearly independent of the number of convolutional kernels in the group;

[0174] The obfuscation module 11 is further configured to: calculate the product of the group and the vector group.

[0175] In some embodiments, the random information corresponding to different groups is different.

[0176] In some embodiments, the device is further configured to:

[0177] The indices of each convolutional kernel after obfuscation are randomly shuffled.

[0178] In some embodiments, the first output result includes intermediate output results corresponding to different convolutional layers of the second model and the final output result of the second model;

[0179] The processing module 15 is further configured to:

[0180] The intermediate output result is transmitted to the trusted execution environment, and the intermediate output result is inversely operated on based on the obfuscation information to obtain the intermediate operation result. The intermediate operation result is then sent to the second model for the operation of the next convolutional layer.

[0181] Repeat the above process until all convolutional layers of the second model are completed, and obtain the final output result of the second model; transmit the final output result of the second model to the trusted execution environment, and perform inverse operation on the final output result of the second model based on the obfuscation information to obtain the second output result.

[0182] In some embodiments, during the transmission of the intermediate output results, the intermediate computation results, and the final output results between the trusted execution environment and the second model, the intermediate output results, the intermediate computation results, and the final output results are encrypted.

[0183] In some embodiments, the second model is run on an accelerated device; the inference model is further configured to:

[0184] The acceleration device is used to accelerate the linear calculations in the second model.

[0185] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0186] The apparatus of the above embodiments is used to implement the corresponding method in any of the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0187] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides a model safety assessment device.

[0188] refer to Figure 9 The device includes:

[0189] The acquisition module 21 is configured to: acquire the model to be evaluated, wherein the model to be evaluated includes the second model as described in the above embodiments;

[0190] The determination module 23 is configured to: determine the type of the model to be evaluated, and obtain a publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated;

[0191] Analysis module 25 is configured to: perform statistical analysis on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated;

[0192] The restoration module 27 is configured to restore the model to be evaluated based on the pre-trained model, the obfuscated content, and the obfuscation method to obtain the restored model;

[0193] Security module 29 is configured to determine the security of the model to be evaluated based on the comparison results of the output information of the restored model and the model to be evaluated.

[0194] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0195] The apparatus of the above embodiments is used to implement the corresponding method in any of the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0196] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the above embodiments.

[0197] Figure 10 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0198] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0199] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0200] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0201] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0202] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0203] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0204] The electronic devices described above are used to implement the corresponding methods in any of the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0205] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to perform the methods described in any of the above embodiments.

[0206] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0207] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to perform the methods described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0208] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a computer program product, which includes a computer program. In some embodiments, the computer program is executable by one or more processors to cause the processors to perform the information processing method. Corresponding to the execution entity for each step in each embodiment of the method, the processor executing the corresponding step may belong to the corresponding execution entity.

[0209] The computer program products of the above embodiments are used to cause a processor to execute the information processing method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0210] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this disclosure as described above, which are not provided in detail for the sake of brevity.

[0211] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this disclosure, the provided drawings may or may not show well-known power / ground connections to integrated circuit (IC) chips and other components. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this disclosure, and this also takes into account the fact that the details of implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this disclosure will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuitry) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this disclosure may be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0212] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0213] This disclosure is intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for implementing secure model inference, comprising: At least a portion of the convolutional kernels of a first model in a trusted execution environment are grouped, and the groups are obfuscated using random information to obtain an encrypted second model. The obfuscation information used during the obfuscation process is stored in the trusted execution environment. The obfuscation information includes grouping information of the convolutional kernels and random information corresponding to the groups. The random information includes a group of vectors that are linearly independent of the number of convolutional kernels in each group. Obfuscating each group using the random information includes calculating the product of the group and the vector group. The second model is deployed in a model inference environment, and the input information is inferred through the second model to obtain the first output result. The first output result is processed using the obfuscation information in the trusted execution environment to obtain the second output result.

2. The method according to claim 1, wherein, The model inference environment includes edge devices or terminal devices, and the model inference environment is an untrusted execution environment.

3. The method according to claim 1, wherein, The grouping of at least a portion of the convolutional kernels of the first model in the trusted execution environment includes: For any convolutional layer in the first model, the convolutional kernels in that convolutional layer are grouped. And / or, For multiple convolutional layers in the first model, the convolutional kernels in the multiple convolutional layers are mixed and grouped.

4. The method according to claim 3, further comprising: The convolutional kernels with the most distant cosine similarity are grouped together.

5. The method according to claim 1, wherein, The random information corresponding to different groups is different.

6. The method according to claim 1, further comprising: The indices of each convolutional kernel after obfuscation are randomly shuffled.

7. The method according to claim 1, wherein, The first output result includes intermediate output results corresponding to different convolutional layers of the second model and the final output result of the second model; The process of processing the first output result using the obfuscation information in the trusted execution environment to obtain the second output result includes: The intermediate output result is transmitted to the trusted execution environment, and the intermediate output result is inversely operated on based on the obfuscation information to obtain the intermediate operation result. The intermediate operation result is then sent to the second model for the operation of the next convolutional layer. Repeat the above process until all convolutional layers of the second model are completed, and obtain the final output result of the second model; transmit the final output result of the second model to the trusted execution environment, and perform inverse operation on the final output result of the second model based on the obfuscation information to obtain the second output result.

8. The method according to claim 7, wherein, During the transmission of the intermediate output results, the intermediate calculation results, and the final output results between the trusted execution environment and the second model, the intermediate output results, the intermediate calculation results, and the final output results are encrypted.

9. The method according to claim 1, wherein, Running the second model on an accelerated device; the step of performing model inference on the input information using the second model includes: The acceleration device is used to accelerate the linear calculations in the second model.

10. A model safety assessment method, comprising: Obtain the model to be evaluated, wherein the model to be evaluated includes the second model as described in any one of claims 1-9; Determine the type of the model to be evaluated, and obtain the publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated; Statistical analysis is performed on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated; The model to be evaluated is restored based on the pre-trained model, the obfuscated content, and the obfuscation method to obtain the restored model; The safety of the model to be evaluated is determined based on the comparison results of the output information of the restored model and the model to be evaluated.

11. An apparatus for implementing secure model reasoning, comprising: An obfuscation module is configured to: group at least a portion of the convolutional kernels of a first model in a trusted execution environment, and obfuscate the groups using random information to obtain an encrypted second model; wherein the obfuscation information used during the obfuscation process is stored in the trusted execution environment, the obfuscation information including grouping information of the convolutional kernels and random information corresponding to the groups; the random information includes: a group of vectors with the same number of convolutional kernels in the group and linearly independent; the obfuscation module is configured to: calculate the product of the group and the group of vectors; The inference module is configured to: deploy the second model in the model inference, perform model inference on the input information through the second model, and obtain the first output result; The processing module is configured to process the first output result using the obfuscation information in the trusted execution environment to obtain a second output result.

12. A model safety assessment device, comprising: The acquisition module is configured to: acquire a model to be evaluated, wherein the model to be evaluated includes the second model as described in any one of claims 1-9; The determination module is configured to: determine the type of the model to be evaluated, and obtain a publicly available pre-trained model corresponding to the model to be evaluated based on the type of the model to be evaluated; The analysis module is configured to perform statistical analysis on the model to be evaluated and the pre-trained model to obtain the obfuscated content and obfuscation method of the model to be evaluated. The restoration module is configured to restore the model to be evaluated based on the pre-trained model, the obfuscated content, and the obfuscation method to obtain the restored model; The security module is configured to determine the security of the model to be evaluated based on the comparison results of the output information of the restored model and the model to be evaluated.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as claimed in any one of claims 1 to 10.

14. A non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the method according to any one of claims 1 to 10.

15. A computer program product comprising computer program instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 10.

Images