A parameter processing method and related device for neural network model

Abstract

The present application discloses a parameter processing method and related device for a neural network model, which relates to the field of neural network technology, including: obtaining a model file of a neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on the weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters; providing the above-mentioned files to a model deployment and reasoning device, so that the model deployment and reasoning device restores the new model file based on the encrypted file of position obfuscation processing information of the structural parameters and the encrypted file of data structure transformation processing information of the weight parameters, and obtains the restored model file. The present application achieves the purpose of preventing the leakage of the structural parameters and weight parameters of the neural network model.

Description

Technical Field

[0001] The present application relates to the field of neural network technology, and in particular to a parameter processing method and related devices for a neural network model. Background Art

[0002] In the field of neural network technology, neural network models are often built by owners at a great cost of time and money, and have great commercial value to the owners. The structural parameters and weight parameters of the neural network model are the core parts, which determine the performance and application value of the neural network model. Once the structural parameters and weight parameters of the neural network model are leaked, attackers can evade payment or open up third-party services to obtain commercial benefits, thereby damaging the rights and interests of the owners of the neural network model. It can be seen that it is particularly necessary to prevent the leakage of the structural parameters and weight parameters of the neural network model. Preventing the leakage of the structural parameters and weight parameters of the neural network model can prevent unauthorized access and use, and ensure that the unique value of the neural network model is not violated. Summary of the invention

[0003] In view of the above problems, the present application provides a parameter processing method and related device for a neural network model to achieve the purpose of preventing the leakage of structural parameters and weight parameters of the neural network model. The specific scheme is as follows:

[0004] The first aspect of the present application provides a parameter processing method of a neural network model, comprising:

[0005] Obtaining a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model;

[0006] Performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters;

[0007] The new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters are provided to the model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0008] In a possible implementation, obtaining a model file of a neural network model to be parameter processed includes:

[0009] Get the original model file obtained after completing model training based on any neural network framework;

[0010] Using the original model file as the model file of the neural network model to be parameter processed;

[0011] Alternatively, the original model file is format converted to obtain a model file in a preset format;

[0012] The model file in the preset format is used as the model file of the neural network model to be subjected to parameter processing.

[0013] In a possible implementation, performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on weight parameters of the neural network model to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters, includes:

[0014] Performing position obfuscation processing on each layer in the neural network model to obtain structural parameters after the position obfuscation processing, generating a position obfuscation processing information file of the structural parameters, and encrypting the position obfuscation processing information file of the structural parameters to generate an encrypted position obfuscation processing information file of the structural parameters;

[0015] Performing data structure transformation processing on the weight parameters of the neural network model to obtain the weight parameters after the data structure transformation processing, generating a data structure transformation processing information file of the weight parameters, and encrypting the data structure transformation processing information file of the weight parameters to generate an encrypted data structure transformation processing information file of the weight parameters;

[0016] Based on the structural parameters after the position obfuscation processing and the weight parameters after the data structure transformation processing, a new model file of the neural network model is generated.

[0017] In a possible implementation, performing position obfuscation processing on each layer in the neural network model includes:

[0018] Swapping the positions of the layers in the neural network model so that the stacking order of the layers in the neural network model changes;

[0019] Then, the position obfuscation processing information file of the structural parameters records the position obfuscation processing information of each layer, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence numbers of each layer before and after the position obfuscation processing.

[0020] In a possible implementation, performing data structure transformation processing on the weight parameters of the neural network model includes:

[0021] Performing random transposition processing on the weight parameters of the neural network model so that the dimensions of the weight parameters of the neural network model are changed;

[0022] Then, the data structure transformation processing information file of the weight parameters records the data structure transformation processing information of each weight parameter, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

[0023] The second aspect of the present application provides a parameter processing method of a neural network model, comprising:

[0024] Obtaining a new model file, a position obfuscation processing information encryption file of a structural parameter, and a data structure transformation processing information encryption file of a weight parameter; the new model file, the position obfuscation processing information encryption file of the structural parameter, and the data structure transformation processing information encryption file of the weight parameter are generated by the neural network model building device after obtaining the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model;

[0025] The new model file is restored based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0026] In a possible implementation, the method of restoring the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file includes:

[0027] Decrypting the encrypted file of the position obfuscation processing information of the structural parameters to obtain the position obfuscation processing information file of the structural parameters, and restoring the structural parameters after the position obfuscation processing in the new model file based on the position obfuscation processing information file of the structural parameters to obtain the restored structural parameters;

[0028] Decrypting the encrypted file of the data structure transformation processing information of the weight parameters to obtain the data structure transformation processing information file of the weight parameters, and restoring the weight parameters after the data structure transformation processing in the new model file based on the data structure transformation processing information file of the weight parameters to obtain the restored weight parameters;

[0029] The restored model file is generated based on the restored structural parameters and the restored weight parameters.

[0030] The third aspect of the present application provides a parameter processing device for a neural network model, comprising:

[0031] A first acquisition unit is used to acquire a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model;

[0032] A file generating unit, used for performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model, to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters;

[0033] The file providing unit is used to provide the new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters to the model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0034] In a possible implementation, the first acquiring unit is specifically configured to:

[0035] Get the original model file obtained after completing model training based on any neural network framework;

[0036] Using the original model file as the model file of the neural network model to be parameter processed;

[0037] Alternatively, the original model file is format converted to obtain a model file in a preset format;

[0038] The model file in the preset format is used as the model file of the neural network model to be subjected to parameter processing.

[0039] In a possible implementation, the file generating unit includes:

[0040] A first file generating unit is used to perform position obfuscation processing on each layer in the neural network model to obtain structural parameters after the position obfuscation processing, generate a position obfuscation processing information file of the structural parameters, and encrypt the position obfuscation processing information file of the structural parameters to generate an encrypted file of the position obfuscation processing information of the structural parameters;

[0041] A second file generating unit is used to perform data structure transformation processing on the weight parameters of the neural network model to obtain the weight parameters after the data structure transformation processing, generate a data structure transformation processing information file of the weight parameters, and encrypt the data structure transformation processing information file of the weight parameters to generate an encrypted data structure transformation processing information file of the weight parameters;

[0042] The third file generation unit is used to generate a new model file of the neural network model based on the structural parameters after the position obfuscation processing and the weight parameters after the data structure transformation processing.

[0043] In a possible implementation, the first file generating unit is specifically configured to:

[0044] Swapping the positions of the layers in the neural network model so that the stacking order of the layers in the neural network model changes;

[0045] Then, the position obfuscation processing information file of the structural parameters records the position obfuscation processing information of each layer, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence numbers of each layer before and after the position obfuscation processing.

[0046] In a possible implementation, the second file generating unit is specifically configured to:

[0047] Performing random transposition processing on the weight parameters of the neural network model so that the dimensions of the weight parameters of the neural network model are changed;

[0048] Then, the data structure transformation processing information file of the weight parameters records the data structure transformation processing information of each weight parameter, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

[0049] A fourth aspect of the present application provides a parameter processing device for a neural network model, comprising:

[0050] The second acquisition unit is used to acquire a new model file, an encrypted file of position obfuscation processing information of structural parameters, and an encrypted file of data structure transformation processing information of weight parameters; the new model file, the encrypted file of position obfuscation processing information of structural parameters, and the encrypted file of data structure transformation processing information of weight parameters are generated by the neural network model building device after acquiring the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model;

[0051] The restoration processing unit is used to restore the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0052] In a possible implementation, the restoration processing unit is specifically used to:

[0053] Decrypting the encrypted file of the position obfuscation processing information of the structural parameters to obtain the position obfuscation processing information file of the structural parameters, and restoring the structural parameters after the position obfuscation processing in the new model file based on the position obfuscation processing information file of the structural parameters to obtain the restored structural parameters;

[0054] Decrypting the encrypted file of the data structure transformation processing information of the weight parameters to obtain the data structure transformation processing information file of the weight parameters, and restoring the weight parameters after the data structure transformation processing in the new model file based on the data structure transformation processing information file of the weight parameters to obtain the restored weight parameters;

[0055] The restored model file is generated based on the restored structural parameters and the restored weight parameters.

[0056] In a fifth aspect, the present application provides a computer program product, comprising computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the parameter processing method of the neural network model of the first aspect or any implementation of the first aspect, and / or the parameter processing method of the neural network model of the second aspect or any implementation of the second aspect.

[0057] A sixth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0058] The memory is used to store computer programs;

[0059] The processor is used to execute the computer program so that the electronic device can implement the parameter processing method of the neural network model of the first aspect or any implementation of the first aspect, and / or the parameter processing method of the neural network model of the second aspect or any implementation of the second aspect.

[0060] In a seventh aspect, the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the parameter processing method of the neural network model of the first aspect or any implementation of the first aspect, and / or the parameter processing method of the neural network model of the second aspect or any implementation of the second aspect.

[0061] By means of the above technical scheme, the parameter processing method and related device of the neural network model provided by the present application include: obtaining the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on the weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters and an encrypted file of data structure transformation processing information of the weight parameters; providing the above files to the model deployment and reasoning device, so that the model deployment and reasoning device restores the new model file based on the encrypted file of position obfuscation processing information of the structural parameters and the encrypted file of data structure transformation processing information of the weight parameters, and obtains the restored model file. This scheme can achieve the purpose of preventing the leakage of the structural parameters and weight parameters of the neural network model. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0063] Figure 1 A schematic diagram of a process flow of a parameter processing method of a neural network model provided in an embodiment of the present application;

[0064] Figure 2 A flowchart of a method for performing position obfuscation processing on each layer in a neural network model and data structure transformation processing on weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters, provided in an embodiment of the present application;

[0065] Figure 3A schematic flow chart of another parameter processing method of a neural network model provided in an embodiment of the present application;

[0066] Figure 4 A schematic diagram of the structure of a parameter processing device for a neural network model provided in an embodiment of the present application;

[0067] Figure 5 A schematic diagram of the structure of another parameter processing device for a neural network model provided in an embodiment of the present application;

[0068] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0069] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0070] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0071] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0072] In the field of neural network technology, neural network models are often built by owners at a great cost of time and money, and have great commercial value to the owners. The structural parameters and weight parameters of the neural network model are the core parts, which determine the performance and application value of the neural network model. Once the structural parameters and weight parameters of the neural network model are leaked, attackers can evade payment or open up third-party services to obtain commercial benefits, thereby damaging the rights and interests of the owners of the neural network model. It can be seen that it is particularly necessary to prevent the leakage of the structural parameters and weight parameters of the neural network model. Preventing the leakage of the structural parameters and weight parameters of the neural network model can prevent unauthorized access and use, and ensure that the unique value of the neural network model is not violated.

[0073] In order to prevent the leakage of the structural parameters and weight parameters of the neural network model, the inventor of this case conducted research, and the initial idea was: after the owner of the neural network model completes the model training using the neural network framework (PyTorch, TensorFlow, etc.), the structural parameters and weight parameters of the neural network model are stored to obtain the model file, and then the entire model file is encrypted using traditional encryption methods such as AES (Advanced Encryption Standard) and RSA (Rivest Shamir Adleman). The owner of the neural network model provides the encrypted model file to the authorized user, who decrypts it to obtain the structural parameters and weight parameters of the neural network model, thereby realizing the deployment and reasoning of the neural network model.

[0074] However, the structure of the neural network model is complex and has a large number of parameters (including structural parameters and weight parameters). For example, the 13B neural network model has 27G of parameters. Therefore, using traditional encryption methods to encrypt the entire model file will result in too long encryption time and corresponding decryption time.

[0075] In addition, the weight parameters of the neural network model are all floating-point numbers such as fp16, fp32, bf16 and other formats. Using traditional encryption methods to encrypt the entire model file and then decrypt it will cause precision loss in the weight parameters, affecting the reasoning effect of the neural network model.

[0076] Moreover, the entire model file is encrypted using traditional encryption methods, and the decrypted model file can be saved separately, resulting in the risk of leakage of the structural parameters and weight parameters of the neural network model.

[0077] In view of the problems existing in the above-mentioned ideas, the inventors of this case conducted in-depth research and finally proposed a parameter processing method for a neural network model.

[0078] The parameter processing method of the neural network model of the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0079] Reference Figure 1 , Figure 1 A flow chart of a parameter processing method of a neural network model provided in an embodiment of the present application is shown as follows: Figure 1 As shown, a parameter processing method of a neural network model provided in an embodiment of the present application, the execution subject of the method can be a neural network model construction device, and the neural network model construction device can be any electronic device. The method can include the following steps, which are described in detail below.

[0080] S101: Acquire a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model;

[0081] In this application, the model file is a file obtained after the model training is completed based on the neural network framework, which is used to save the model on the disk so that it can be loaded and used when needed, avoiding repeated training of the model, saving time and computing resources. The model file stores the structural parameters and weight parameters of the model.

[0082] The structure of the neural network model is composed of a stack of input layers, hidden layers (such as fully connected layers, convolutional layers, pooling layers, etc.) and output layers, and each hidden layer contains at least one information processing unit, such as a neuron or a data processing unit. Each information processing unit contains at least one weight parameter. In this application, the structural parameters of the neural network model may refer to the structure of each layer in the neural network model. The structure of each layer in the neural network model refers to which layers are included in the neural network model and the stacking order of each layer.

[0083] S102: performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structure parameters, and an encrypted file of data structure transformation processing information of the weight parameters;

[0084] In the present application, the new model file includes structural parameters after position obfuscation processing and weight parameters after data structure transformation processing.

[0085] S103: Providing the new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters to the model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0086] In the present application, the model deployment and inference device cannot perform model deployment and inference normally by directly using the new model file. The new model file must be restored based on the position obfuscation processing information encryption file of the structural parameters and the data structure transformation processing information encryption file of the weight parameters to obtain the restored model file. The restored model file is the model file of the neural network model before parameter processing. The model deployment and inference can be performed normally using the restored model file.

[0087] It should be noted that the restored model file is not stored separately, but is loaded into the memory of the model deployment and inference device for direct use in model deployment and inference, which will not lead to the leakage of structural parameters and weight parameters. The model deployment and inference device can be any electronic device equipped with a GPU (Graphics Processing Unit) or a CPU (Central Processing Unit).

[0088] The parameter processing method of the neural network model provided in this embodiment includes: obtaining the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on the weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters and an encrypted file of data structure transformation processing information of the weight parameters; providing the above-mentioned files to the model deployment and reasoning device, so that the model deployment and reasoning device restores the new model file based on the encrypted file of position obfuscation processing information of the structural parameters and the encrypted file of data structure transformation processing information of the weight parameters, and obtains the restored model file. This solution can achieve the purpose of preventing the leakage of the structural parameters and weight parameters of the neural network model.

[0089] In one possible implementation, obtaining the model file of the neural network model to be parameter processed includes: obtaining the original model file obtained after completing model training based on any neural network framework (such as PyTorch, TensorFlow, etc.); using the original model file as the model file of the neural network model to be parameter processed.

[0090] Considering that the formats of model files obtained by model training using different neural network frameworks are different and not unified, it is not conducive to model deployment and reasoning. For example, TensorFlow's model files are generally in .ckpt format or saved_model format; PyTorch's model files are generally in .pt format or .pth format. Therefore, in order to facilitate the migration of models between different neural network frameworks, after completing model training based on any neural network framework to obtain the original model file, the original model file is often converted to a preset format model file, which is suitable for different inference engine platforms.

[0091] In another possible implementation, obtaining the model file of the neural network model to be parameter processed includes: obtaining the original model file obtained after completing model training based on any neural network framework; converting the format of the original model file to obtain a model file in a preset format; and using the model file in the preset format as the model file of the neural network model to be parameter processed.

[0092] ONNX (Open Neural Network Exchange) is an open standard for representing neural network models, which enables easy exchange of models between different neural network frameworks, greatly facilitating model deployment and reasoning. In practical applications, the original model file obtained after completing model training using any neural network framework (PyTorch, TensorFlow, etc.) can be converted into a model file in ONNX format, and the model file in ONNX format can be used for model deployment and reasoning on different inference engine platforms. As a feasible method, the model file in a preset format can be a model file in ONNX format. In this case, the model file obtained by model training using any neural network framework can be converted into a model file in ONNX format, and then the solution of this application can be applied.

[0093] In another embodiment of the present application, the specific implementation method of performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on the weight parameters of the neural network model in S102 to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters is described in detail.

[0094] Reference Figure 2 , Figure 2 A flowchart of a method for performing position obfuscation processing on each layer in a neural network model and data structure transformation processing on weight parameters of the neural network model, generating a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters, provided in an embodiment of the present application, as shown in FIG. Figure 2 As shown, the method specifically comprises the following steps:

[0095] S201: performing position obfuscation processing on each layer in the neural network model to obtain structural parameters after the position obfuscation processing, generating a position obfuscation processing information file of the structural parameters, and encrypting the position obfuscation processing information file of the structural parameters to generate an encrypted position obfuscation processing information file of the structural parameters;

[0096] In the present application, position obfuscation processing can be performed on each layer in the neural network model to obtain structural parameters after position obfuscation processing, and a position obfuscation processing information file of the structural parameters is generated, in which the position obfuscation processing information of each layer is recorded, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence number of each layer before and after the position obfuscation processing. Among them, performing position obfuscation processing on each layer of the neural network model is to exchange the positions of each layer in the neural network model, so that the stacking order of each layer in the neural network model changes.

[0097] Considering that the structure of a neural network model can be visualized as a directed acyclic graph, which contains nodes and directed edges, where, except for input nodes and output nodes, each intermediate node represents a layer, and the directed edges represent the path for information to flow between layers. As an implementable method, the intermediate nodes in the directed acyclic graph corresponding to the neural network model can be numbered according to the stacking order of each layer (i.e., from left to right, from top to bottom) to obtain the stacking order number of each layer. For example, the numbers can be 1, 2, 3, 4, 5, etc.

[0098] To facilitate understanding, assume that the neural network model contains 5 layers. Before the positions of the layers of the neural network model are obfuscated, the stacking order numbers of the layers are arranged in the order of 1, 2, 3, 4, and 5. Assume that the positions of 1 and 2 are swapped, and the positions of 3 and 4 are swapped. After the position obfuscation process, the stacking order numbers of the layers are arranged in the order of 2, 1, 4, 3, and 5.

[0099] Recording the position obfuscation processing information of each layer is equivalent to saving the key of the structural parameters, which avoids direct exposure of the structural parameters. However, if the position obfuscation processing information of each layer is saved in plain text, if the position obfuscation processing information of each layer is leaked, the risk of leakage of the structural parameters will increase. In order to further reduce the risk of leakage of the structural parameters, in this application, a preset encryption method such as AES (Advanced Encryption Standard), RSA (Rivest Shamir Adleman), DES (Data Encryption Standard) can be used to encrypt the position obfuscation processing information file of the structural parameters to obtain an encrypted file of the position obfuscation processing information of the structural parameters.

[0100] S202: performing data structure transformation processing on the weight parameters of the neural network model to obtain the weight parameters after the data structure transformation processing, generating a data structure transformation processing information file of the weight parameters, and encrypting the data structure transformation processing information file of the weight parameters to generate a data structure transformation processing information encrypted file of the weight parameters;

[0101] In the present application, the weight parameters in the model file can be subjected to data structure transformation processing to obtain the weight parameters after data structure transformation processing, and a data structure transformation processing information file of the weight parameters is generated, and the data structure transformation processing information file of the weight parameters records the data structure transformation processing information of each weight parameter. The data structure transformation processing information of each weight parameter is used to indicate the specific data structure transformation processing method of each weight parameter.

[0102] The data structure transformation processing information of each weight parameter is recorded, which is equivalent to saving the key of the weight parameter, thereby avoiding direct exposure of the weight parameter. However, if the data structure transformation processing information of the weight parameter is saved in plain text, if the data structure transformation processing information of the weight parameter is leaked, the risk of leakage of the weight parameter will increase. In order to further reduce the risk of leakage of the weight parameter, in this application, a preset encryption method such as AES (Advanced Encryption Standard), RSA (Rivest Shamir Adleman), DES (Data Encryption Standard) can be used to encrypt the data structure transformation processing information file of the weight parameter to obtain an encrypted file of the data structure transformation processing information of the weight parameter.

[0103] In the field of neural networks, tensors are a data structure used to store and manipulate multidimensional arrays. Tensors can be viewed as an extended matrix that can have any number of dimensions. For example, a tensor containing only one number is called a scalar or 0-dimensional tensor, an array of numbers is called a vector or 1-dimensional tensor, an array of vectors is called a matrix or 2-dimensional tensor, and combining multiple matrices into a new array can create a 3-dimensional tensor. Combining multiple 3-dimensional tensors into an array can create a 4-dimensional tensor, and so on.

[0104] In a neural network model, weight parameters are usually represented by tensors. Transposition is a concept in mathematics and linear algebra, usually used for matrices or vectors. It is an operation that changes the order of rows and columns of a matrix or vector, that is, the rows of a matrix or vector are turned into columns, and the columns are turned into rows, without changing the values ​​of the elements in the matrix or vector. Transposing an odd number of times is equivalent to performing one transposition, and transposing an even number of times is equivalent to not transposing.

[0105] Then in the present application, in one possible implementation, the data structure transformation processing of the weight parameters may be a random transposition processing of the weight parameters (i.e., the number of transpositions is randomly determined) to change the dimension of the weight parameters of the neural network model, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

[0106] It should be noted that if the weight parameter is a scalar, its value remains unchanged after random transposition processing. If the weight parameter is a matrix array, the number of transpositions of each matrix in the matrix array can be recorded as the data structure transformation processing information of the weight parameter. The number of transpositions of each matrix in the matrix array can be the same or different. This application does not impose any restrictions on this.

[0107] S203: Generate a new model file of the neural network model based on the structural parameters after the position obfuscation processing and the weight parameters after the data structure transformation processing.

[0108] In the present application, the structural parameters after the position obfuscation processing can replace the original structural parameters in the model file, and the weight parameters after the data structure transformation processing can replace the original weight parameters in the model file to generate a new model file of the neural network model.

[0109] It should be noted that, in the present application, the position obfuscation process can be performed on each layer in the neural network model first, and then the data structure transformation process can be performed on the weight parameters in the model file. Alternatively, the data structure transformation process can be performed on the weight parameters in the model file first, and then the position obfuscation process can be performed on each layer in the neural network model. Alternatively, the position obfuscation process can be performed on each layer in the neural network model, and the data structure transformation process can be performed on the weight parameters in the model file at the same time. In this regard, the present application does not impose any restrictions. That is, the execution order of the above steps S201 and S202 is not limited in any way by the present application.

[0110] Next, the parameter processing method of the neural network model on the model deployment and inference device side is explained in detail.

[0111] Reference Figure 3 , Figure 3 A flow chart of another parameter processing method of a neural network model provided in an embodiment of the present application, the execution subject of the method can be a model deployment and reasoning device, and the model deployment and reasoning device can be any electronic device. Figure 3 As shown, the method comprises the following steps:

[0112] S301: obtaining a new model file, a position obfuscation processing information encryption file of a structure parameter, and a data structure transformation processing information encryption file of a weight parameter; the new model file, the position obfuscation processing information encryption file of the structure parameter, and the data structure transformation processing information encryption file of the weight parameter are generated by the neural network model building device after obtaining the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model;

[0113] It should be noted that after the neural network model building device obtains the model file of the neural network model to be parameter processed, it performs position obfuscation processing on each layer in the neural network model and performs data structure transformation processing on the weight parameters of the neural network model to generate the new model file, the position obfuscation processing information encryption file of the structural parameters, and the data structure transformation processing information encryption file of the weight parameters. The specific implementation method can be referred to the aforementioned content and will not be repeated here.

[0114] S302: Perform restoration processing on the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain a restored model file.

[0115] It should be noted that the model deployment and inference device cannot perform model deployment and inference normally by directly using the new model file. The new model file must be restored based on the position obfuscation processing information encryption file of the structural parameters and the data structure transformation processing information encryption file of the weight parameters to obtain the restored model file. The restored model file is the model file of the neural network model before parameter processing. The model deployment and inference can be performed normally using the restored model file.

[0116] It should be noted that the restored model file is not stored separately, but is loaded into the memory of the model deployment and inference device for direct use in model deployment and inference, which will not lead to the leakage of structural parameters and weight parameters. The model deployment and inference device can be any electronic device equipped with a GPU (Graphics Processing Unit) or a CPU (Central Processing Unit).

[0117] In a possible implementation, the method of restoring the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file includes:

[0118] Decrypting the encrypted file of the position obfuscation processing information of the structural parameters to obtain the position obfuscation processing information file of the structural parameters, and restoring the structural parameters after the position obfuscation processing in the new model file based on the position obfuscation processing information file of the structural parameters to obtain the restored structural parameters;

[0119] Decrypting the encrypted file of the data structure transformation processing information of the weight parameters to obtain the data structure transformation processing information file of the weight parameters, and restoring the weight parameters after the data structure transformation processing in the new model file based on the data structure transformation processing information file of the weight parameters to obtain the restored weight parameters;

[0120] The restored model file is generated based on the restored structural parameters and the restored weight parameters.

[0121] In engineering implementation, the parameter processing method of the neural network model is encapsulated into two independent tools or services, which are respectively configured in the neural network model building device and the model deployment and inference device. The parameter processing method of the neural network model of the neural network model building device is kept confidential relative to the model deployment and inference device, and the parameter processing method of the neural network model of the model deployment and inference device is also kept confidential relative to the neural network model building device. This can further prevent the leakage of the structural parameters and weight parameters of the neural network model.

[0122] Assuming that the unauthorized model deployment and inference device only obtains the new model file, and does not obtain the location obfuscation processing information encryption file of the structure parameters and the data structure transformation processing information encryption file of the weight parameters, the probability of restoring the correct model file is already very low. Assuming that the model parameters contain x matrices and y layers, and each matrix is ​​transposed or not transposed, the probability of being restored is 1 / 2 x ; The probability of restoration when y layers are randomly exchanged n times is , after the final two steps are combined, the probability of being restored is ,From the results, we can see that the larger the model is, the more layers and matrices it has, and the lower the probability of being restored.

[0123] Even if an unauthorized model deployment and inference device obtains a new model file, a structural parameter location obfuscation processing information encryption file, and a weight parameter data structure transformation processing information encryption file, it is not configured with the corresponding neural network model parameter processing method, and the probability of restoring the correct model file is very low.

[0124] Therefore, the parameter processing method of the neural network model of the present application can achieve relatively good results in preventing the leakage of the structural parameters and weight parameters of the neural network model.

[0125] In addition, in the present application, the structure parameters and weight parameters themselves are not encrypted and decrypted, but the position obfuscation processing information of the structure parameters and the data structure transformation processing information of the weight parameters are encrypted and decrypted, so that the amount of encrypted and decrypted data is reduced, thereby improving the efficiency of encryption and decryption.

[0126] Furthermore, in the present application, during the entire process of performing position obfuscation processing on each layer in the neural network model and performing data structure transformation processing on the weight parameters of the neural network model, no data type conversion is generated, such as converting fp16 to int, and restoring int to fp16, etc. Therefore, the accuracy of the weight parameters in the neural network model will not be affected, thereby ensuring the reasoning effect of the neural network model.

[0127] The above introduces a parameter processing method of a neural network model applied to a neural network model building device provided in an embodiment of the present application. The following will introduce an apparatus for executing the parameter processing method of the above neural network model.

[0128] See also Figure 4 , Figure 4 A schematic diagram of a parameter processing device for a neural network model provided in an embodiment of the present application. Figure 4 As shown, the parameter processing device of the neural network model includes:

[0129] A first acquisition unit 11 is used to acquire a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model;

[0130] A file generating unit 12 is used to perform position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model, so as to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structure parameters and an encrypted file of data structure transformation processing information of the weight parameters;

[0131] The file providing unit 13 is used to provide the new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters to the model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0132] In a possible implementation, the first acquiring unit is specifically configured to:

[0133] Get the original model file obtained after completing model training based on any neural network framework;

[0134] Using the original model file as the model file of the neural network model to be parameter processed;

[0135] Alternatively, the original model file is format converted to obtain a model file in a preset format;

[0136] The model file in the preset format is used as the model file of the neural network model to be subjected to parameter processing.

[0137] In a possible implementation, the file generating unit includes:

[0138] A first file generating unit is used to perform position obfuscation processing on each layer in the neural network model to obtain structural parameters after the position obfuscation processing, generate a position obfuscation processing information file of the structural parameters, and encrypt the position obfuscation processing information file of the structural parameters to generate an encrypted file of the position obfuscation processing information of the structural parameters;

[0139] A second file generating unit is used to perform data structure transformation processing on the weight parameters of the neural network model to obtain the weight parameters after the data structure transformation processing, generate a data structure transformation processing information file of the weight parameters, and encrypt the data structure transformation processing information file of the weight parameters to generate an encrypted data structure transformation processing information file of the weight parameters;

[0140] The third file generation unit is used to generate a new model file of the neural network model based on the structural parameters after the position obfuscation processing and the weight parameters after the data structure transformation processing.

[0141] In a possible implementation, the first file generating unit is specifically configured to:

[0142] Swapping the positions of the layers in the neural network model so that the stacking order of the layers in the neural network model changes;

[0143] Then, the position obfuscation processing information file of the structural parameters records the position obfuscation processing information of each layer, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence numbers of each layer before and after the position obfuscation processing.

[0144] In a possible implementation, the second file generating unit is specifically configured to:

[0145] Performing random transposition processing on the weight parameters of the neural network model so that the dimensions of the weight parameters of the neural network model are changed;

[0146] Then, the data structure transformation processing information file of the weight parameters records the data structure transformation processing information of each weight parameter, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

[0147] The above introduces a parameter processing method of a neural network model applied to a model deployment and inference device provided in an embodiment of the present application. The following will introduce a device for executing the parameter processing method of the above-mentioned neural network model.

[0148] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of another parameter processing device of a neural network model provided in an embodiment of the present application. Figure 5 As shown, the parameter processing device of the neural network model includes:

[0149] The second acquisition unit 21 is used to acquire a new model file, an encrypted file of position obfuscation processing information of structure parameters, and an encrypted file of data structure transformation processing information of weight parameters; the new model file, the encrypted file of position obfuscation processing information of structure parameters, and the encrypted file of data structure transformation processing information of weight parameters are generated by the neural network model building device after acquiring the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model;

[0150] The restoration processing unit 22 is used to restore the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file.

[0151] In a possible implementation, the restoration processing unit is specifically used to:

[0152] Decrypting the encrypted file of the position obfuscation processing information of the structural parameters to obtain the position obfuscation processing information file of the structural parameters, and restoring the structural parameters after the position obfuscation processing in the new model file based on the position obfuscation processing information file of the structural parameters to obtain the restored structural parameters;

[0153] Decrypting the encrypted file of the data structure transformation processing information of the weight parameters to obtain the data structure transformation processing information file of the weight parameters, and restoring the weight parameters after the data structure transformation processing in the new model file based on the data structure transformation processing information file of the weight parameters to obtain the restored weight parameters;

[0154] The restored model file is generated based on the restored structural parameters and the restored weight parameters.

[0155] The present application also provides an electronic device in an embodiment. Figure 6 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiment of the present application. The electronic device in the embodiment of the present application may include but is not limited to fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0156] like Figure 6 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 to a random access memory (RAM) 603. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0157] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a memory card, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0158] An embodiment of the present application also provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements a parameter processing method of any neural network model provided in the embodiment of the present application.

[0159] A computer-readable storage medium is also provided in an embodiment of the present application. The computer storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement a parameter processing method for any neural network model provided in an embodiment of the present application.

[0160] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0161] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0162] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0163] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A parameter processing method for a neural network model, characterized in that: include: Obtaining a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model; Performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters; Providing the new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters to the model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain a restored model file, and the restored model file is not stored separately, but is loaded into the memory of the model deployment and inference device to be directly used for model deployment and inference; The performing position obfuscation processing on each layer in the neural network model comprises: exchanging the positions of each layer in the neural network model so that the stacking order of each layer in the neural network model changes; recording the position obfuscation processing information of each layer in a position obfuscation processing information file of a structural parameter, wherein the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking order number of each layer before and after the position obfuscation processing; The data structure transformation processing of the weight parameters of the neural network model includes: performing random transposition processing on the weight parameters of the neural network model to change the dimensions of the weight parameters of the neural network model; recording the data structure transformation processing information of each weight parameter in a data structure transformation processing information file of the weight parameters, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

2. The method according to claim 1, characterized in that The step of obtaining a model file of a neural network model to be parameter processed includes: Get the original model file obtained after completing model training based on any neural network framework; Using the original model file as the model file of the neural network model to be parameter processed; Alternatively, the original model file is format converted to obtain a model file in a preset format; The model file in the preset format is used as the model file of the neural network model to be subjected to parameter processing.

3. The method according to claim 1 or 2, characterized in that: The method of performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structure parameters, and an encrypted file of data structure transformation processing information of the weight parameters includes: Performing position obfuscation processing on each layer in the neural network model to obtain structural parameters after the position obfuscation processing, generating a position obfuscation processing information file of the structural parameters, and encrypting the position obfuscation processing information file of the structural parameters to generate an encrypted position obfuscation processing information file of the structural parameters; Performing data structure transformation processing on the weight parameters of the neural network model to obtain the weight parameters after the data structure transformation processing, generating a data structure transformation processing information file of the weight parameters, and encrypting the data structure transformation processing information file of the weight parameters to generate an encrypted data structure transformation processing information file of the weight parameters; Based on the structural parameters after the position obfuscation processing and the weight parameters after the data structure transformation processing, a new model file of the neural network model is generated.

4. A parameter processing method for a neural network model, characterized in that: include: Obtaining a new model file, a position obfuscation processing information encryption file of a structural parameter, and a data structure transformation processing information encryption file of a weight parameter; the new model file, the position obfuscation processing information encryption file of the structural parameter, and the data structure transformation processing information encryption file of the weight parameter are generated by the neural network model building device after obtaining the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model; The new model file is restored based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain a restored model file, and the restored model file is not stored separately but loaded into the memory of the model deployment and inference device to be directly used for model deployment and inference; The position obfuscation processing of each layer in the neural network model includes: exchanging the positions of each layer in the neural network model so that the stacking order of each layer in the neural network model changes; recording the position obfuscation processing information of each layer in the position obfuscation processing information file of the structural parameters, wherein the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence number of each layer before and after the position obfuscation processing; The data structure transformation processing of the weight parameters of the neural network model includes: performing random transposition processing on the weight parameters of the neural network model to change the dimensions of the weight parameters of the neural network model; recording the data structure transformation processing information of each weight parameter in a data structure transformation processing information file of the weight parameters, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

5. The method according to claim 4, characterized in that The method of performing restoration processing on the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain the restored model file includes: Decrypting the encrypted file of the position obfuscation processing information of the structural parameters to obtain the position obfuscation processing information file of the structural parameters, and restoring the structural parameters after the position obfuscation processing in the new model file based on the position obfuscation processing information file of the structural parameters to obtain the restored structural parameters; Decrypting the encrypted file of the data structure transformation processing information of the weight parameters to obtain the data structure transformation processing information file of the weight parameters, and restoring the weight parameters after the data structure transformation processing in the new model file based on the data structure transformation processing information file of the weight parameters to obtain the restored weight parameters; The restored model file is generated based on the restored structural parameters and the restored weight parameters.

6. A parameter processing device for a neural network model, characterized in that: include: A first acquisition unit is used to acquire a model file of a neural network model to be parameter processed, wherein the model file includes structural parameters and weight parameters of the neural network model; the structural parameters of the neural network model are used to indicate the structure of each layer in the neural network model; A file generating unit, used for performing position obfuscation processing on each layer in the neural network model and data structure transformation processing on the weight parameters of the neural network model, to generate a new model file of the neural network model, an encrypted file of position obfuscation processing information of the structural parameters, and an encrypted file of data structure transformation processing information of the weight parameters; A file providing unit, configured to provide the new model file, the encrypted file of the position obfuscation processing information of the structural parameters, and the encrypted file of the data structure transformation processing information of the weight parameters to a model deployment and inference device, so that the model deployment and inference device restores the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain a restored model file, wherein the restored model file is not stored separately but loaded into a memory of the model deployment and inference device to be directly used for model deployment and inference; The file generation unit performs position obfuscation processing on each layer in the neural network model, including: the file generation unit performs position exchange on each layer in the neural network model to change the stacking order of each layer in the neural network model; the position obfuscation processing information of each layer is recorded in the position obfuscation processing information file of the structural parameters, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence number of each layer before and after the position obfuscation processing; The file generation unit performs data structure transformation processing on the weight parameters of the neural network model, including: the file generation unit performs random transposition processing on the weight parameters of the neural network model to change the dimensions of the weight parameters of the neural network model; and records the data structure transformation processing information of each weight parameter in the data structure transformation processing information file of the weight parameter, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

7. A parameter processing device for a neural network model, characterized in that: include: The second acquisition unit is used to acquire a new model file, an encrypted file of position obfuscation processing information of structural parameters, and an encrypted file of data structure transformation processing information of weight parameters; the new model file, the encrypted file of position obfuscation processing information of structural parameters, and the encrypted file of data structure transformation processing information of weight parameters are generated by the neural network model building device after acquiring the model file of the neural network model to be parameter processed, performing position obfuscation processing on each layer in the neural network model, and performing data structure transformation processing on the weight parameters of the neural network model; A restoration processing unit, used for performing restoration processing on the new model file based on the encrypted file of the position obfuscation processing information of the structural parameters and the encrypted file of the data structure transformation processing information of the weight parameters to obtain a restored model file, wherein the restored model file is not stored separately but loaded into the memory of the model deployment and inference device to be directly used for model deployment and inference; The neural network model building device performs position obfuscation processing on each layer in the neural network model, including: the neural network model building device performs position exchange on each layer in the neural network model, so that the stacking order of each layer in the neural network model changes; the position obfuscation processing information of each layer is recorded in the position obfuscation processing information file of the structural parameters, and the position obfuscation processing information of each layer is used to indicate the arrangement order of the stacking sequence number of each layer before and after the position obfuscation processing; The neural network model building device performs data structure transformation processing on the weight parameters of the neural network model, including: the neural network model building device performs random transposition processing on the weight parameters of the neural network model to change the dimensions of the weight parameters of the neural network model; the data structure transformation processing information of each weight parameter is recorded in the data structure transformation processing information file of the weight parameter, and the data structure transformation processing information of each weight parameter is used to indicate the number of transpositions of each weight parameter.

8. A computer program product, characterized in that It includes computer-readable instructions, which, when executed on an electronic device, enable the electronic device to implement the parameter processing method for a neural network model as described in any one of claims 1 to 3, and / or the parameter processing method for a neural network model as described in any one of claims 4 to 5.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the parameter processing method of the neural network model as described in any one of claims 1 to 3, and / or the parameter processing method of the neural network model as described in any one of claims 4 to 5.

10. A computer storage medium, characterized in that: The computer storage medium carries one or more computer programs, which, when executed by an electronic device, enable the electronic device to implement the parameter processing method of the neural network model as described in any one of claims 1 to 3, and / or the parameter processing method of the neural network model as described in any one of claims 4 to 5.

Images