Model protection method, model equipment, data reasoning method and data reasoning equipment

Abstract

The invention discloses a model protection method, a model device and a data reasoning method and device.The model protection method comprises the steps that at least one target model parameter in a first model is determined; based on the at least one target model parameter and a first matrix set, determining a permutation matrix corresponding to each target model parameter; the first matrix set comprises at least one first matrix; different first matrixes have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix and the matrix dimension of the parameter matrix of the target model parameter have a corresponding relationship; replacing a parameter matrix of a corresponding target model parameter in the first model by using the replacement matrix to obtain a second model; and sending the second model.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of computer technology, and in particular to a model protection method and model side device, and a data reasoning method and device. Background Art

[0002] Artificial Intelligence Personal Computer (AIPC) is a personal computer that integrates AI technology. By integrating hardware such as the Central Processing Unit (CPU), Graphics Processing Unit (GPU) and Neural Processing Unit (NPU), AIPC can be equipped with a variety of AI models (for example, Large Language Model Meta AI (LLAMA), Transformer model, Vincent graph model, etc.) to meet users' various AI needs.

[0003] However, after AIPC downloads the AI ​​model software package from the model party's server or platform and installs the AI ​​model, the AI ​​model running on AIPC may be subject to illegal operations such as reverse engineering and unauthorized access, resulting in the leakage of model parameters of the AI ​​model, and the leakage of model parameters further leads to the abuse of the model party's intellectual property rights, the leakage of commercial secrets or data abuse. Therefore, how to achieve the protection of the model parameters of the AI ​​model is crucial to preventing the abuse of intellectual property rights, ensuring data privacy and maintaining system security. Summary of the invention

[0004] In view of this, the present application at least provides a model protection method and model side device, data reasoning method and device.

[0005] The technical solution of this application is implemented as follows:

[0006] In one aspect, the present application provides a data processing method, the method comprising:

[0007] determining at least one target model parameter in the first model;

[0008] Based on the at least one target model parameter and the first matrix set, determining a permutation matrix corresponding to each target model parameter; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the parameter matrix of the target model parameter;

[0009] Using the permutation matrix to permute the parameter matrix of the corresponding target model parameters in the first model to obtain a second model;

[0010] The second model is sent.

[0011] In some embodiments, determining the permutation matrix corresponding to each target model parameter based on the at least one target model parameter and the first matrix set includes:

[0012] determining a target generation strategy based on the at least one target model parameter;

[0013] Based on the target generation strategy, determining at least one first target matrix corresponding to each of the target model parameters from the first matrix set;

[0014] Based on the at least one first target matrix, a permutation matrix corresponding to each of the target model parameters is generated.

[0015] In some embodiments, the determining of the target generation strategy based on the at least one target model parameter comprises at least one of the following:

[0016] Based on the number of the at least one target model parameter, determining a target generation strategy corresponding to each of the target model parameters;

[0017] Determining a target generation strategy corresponding to each target model parameter based on a matrix dimension of a parameter matrix of the target model parameters;

[0018] Based on the type of the network layer corresponding to each of the target model parameters, a target generation strategy corresponding to each of the target model parameters is determined.

[0019] In some embodiments, the target generation strategy includes one of a first generation strategy and a second generation strategy; the first generation strategy represents determining at least one first target matrix from the first matrix set based on a minimum amount of calculation; the second generation strategy represents determining multiple first target matrices from the first matrix set based on selecting a maximum number of first target matrices;

[0020] The determining of the target generation strategy based on the at least one target model parameter comprises at least one of the following:

[0021] In a case where the number of the at least one target model parameter is greater than a number threshold, determining the first generation strategy as the target generation strategy; in a case where the number of the at least one target model parameter is not greater than the number threshold, determining the second generation strategy as the target generation strategy;

[0022] In the case where the matrix dimension corresponding to the parameter matrix of each target model parameter is greater than a dimension threshold, the first generation strategy is determined as the target generation strategy; in the case where the matrix dimension corresponding to the parameter matrix of at least one target model parameter is not greater than the dimension threshold, the second generation strategy is determined as the target generation strategy;

[0023] For each of the target model parameters, when the type of the network layer corresponding to the target model parameter is a specified type, the second generation strategy is determined as the target generation strategy; when the type of the network layer corresponding to the target model parameter is not a specified type, the first generation strategy is determined as the target generation strategy.

[0024] In some embodiments, determining at least one target model parameter in the first model includes:

[0025] determining at least one target network layer in the first model;

[0026] For each of the target network layers, at least one target model parameter in the target network layer is determined; wherein each of the target model parameters represents a model parameter determined through model training.

[0027] In some embodiments, the first model includes a converter model; the at least one target network layer includes at least an input data encoding layer, a plurality of attention layers, a plurality of fully connected layers, a plurality of normalization layers, and a classifier layer;

[0028] The step of determining, for each target network layer, at least one target model parameter in the target network layer comprises:

[0029] Determine at least one first target model parameter from at least one model parameter contained in the calculation formula corresponding to the input data encoding layer, each attention layer, each fully connected layer, each normalization layer and classifier layer of the first model.

[0030] In some embodiments, the first model includes a large language model; the target network layer includes at least an input data encoding layer, a plurality of normalization layers, a plurality of attention layers, a plurality of fully connected layers, and a classifier layer;

[0031] The step of determining, for each target network layer, at least one target model parameter in the target network layer comprises:

[0032] Determine at least one second target model parameter from at least one model parameter included in the calculation formula corresponding to the input data encoding layer, each of the normalization layers, each of the fully connected layers, and the classifier layer;

[0033] At least one third target model parameter is determined from at least one model parameter included in the calculation formula corresponding to each of the attention layers; wherein, when the third target model parameter includes the model parameter for calculating the query vector and the key vector in the calculation formula corresponding to the attention layer, the third target model parameter is not used as a multiplicand to perform the permutation processing.

[0034] On the other hand, the present application provides a data reasoning method, applied to a data reasoning device, comprising:

[0035] Receive a second model; wherein the second model is obtained by replacing a parameter matrix of a corresponding target model parameter in the first model with a replacement matrix; the replacement matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the replacement matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter;

[0036] In response to the input data, data reasoning is performed using the second model to obtain a reasoning result corresponding to the input data.

[0037] On the other hand, the present application provides a model side device, including a first processor and a first communication interface;

[0038] The first processor is used to determine at least one target model parameter in the first model; based on the at least one target model parameter and the first matrix set, determine a permutation matrix corresponding to each of the target model parameters; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter; the parameter matrix of the corresponding target model parameter in the first model is permuted by the permutation matrix to obtain a second model;

[0039] The first communication interface is used to send the second model.

[0040] In another aspect, the present application provides a data inference device, including a second processor and a second communication interface;

[0041] The second communication interface is used to receive a second model; wherein the second model is obtained by replacing a parameter matrix of a corresponding target model parameter in the first model with a replacement matrix; the replacement matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the replacement matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter;

[0042] The second processor is used to perform data reasoning using the second model in response to input data to obtain a reasoning result corresponding to the input data.

[0043] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0045] Figure 1 A schematic diagram of the implementation process of a model protection method provided in this application;

[0046] Figure 2 A schematic diagram of the implementation flow of another model protection method provided in this application;

[0047] Figure 3 A schematic diagram of the implementation flow of another model protection method provided in this application;

[0048] Figure 4 A schematic diagram of the implementation process of a data reasoning method provided in this application;

[0049] Figure 5 A schematic diagram of the process of performing data reasoning on the Transformer model obtained by using the model protection method provided in this application;

[0050] Figure 6 A schematic diagram of the process of performing data reasoning using the LLAMA model obtained by the model protection method provided in this application;

[0051] Figure 7 A schematic diagram of the hardware entity of a model party device provided for this application;

[0052] Figure 8 A hardware entity diagram of a data reasoning device provided for this application;

[0053] Fig. 9A schematic diagram of the structure of a model protection system provided in this application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application are further elaborated in detail below in conjunction with the drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0055] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0056] The terms "first / second / third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first / second / third" can be interchanged with a specific order or sequence where permitted so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing this application and are not intended to limit this application.

[0058] In order to protect AI models, various model protection schemes have been proposed in related technologies, such as model encryption, model watermarking, model obfuscation, federated learning, differential privacy, etc. However, all of the above protection schemes have corresponding technical problems. For example, model encryption technology generates high computational overhead; model watermarking technology can easily detect and track unauthorized model use, but is vulnerable to attacks; model obfuscation technology can increase the difficulty of reverse engineering, but will lead to a decrease in model performance; federated learning technology generates high communication costs; differential privacy technology protects model data by adding noise, which will lead to reduced model accuracy.

[0059] Based on this, the present application provides a model protection method, which is executed in a model side device to protect the model parameters before sending the model to the AIPC. Here, the model side device may refer to a server, a laptop, a tablet computer, a desktop computer, a mobile device (such as a mobile phone, a portable video player, a personal digital assistant, a dedicated messaging device) and other devices with data processing capabilities.

[0060] Figure 1 A schematic diagram of the implementation flow of a model protection method provided in this application, such as Figure 1 As shown, the method includes the following steps S101 to S104:

[0061] Step S101, determining at least one target model parameter in a first model.

[0062] Here, the first model is an AI model provided by the model party. In some embodiments, the first model may include an LLAMA model, a Transformer model, a Vincent graph model, a Vincent video model, and the like.

[0063] The first model includes a plurality of model parameters. In some embodiments, the model parameters may refer to model parameters determined in a model training phase.

[0064] The target model parameters refer to model parameters determined from the plurality of model parameters of the first model and obtained by permuting the parameter matrix thereof.

[0065] In some embodiments, the target model parameters can be randomly determined from multiple model parameters of the first model according to a preset random algorithm; they can also be model parameters of a specified type, such as weight parameters, determined from multiple model parameters of the first model according to a preset parameter type; they can also be model parameters determined from a specified network layer of the first model; and so on.

[0066] In some embodiments, the number of target model parameters may be determined based on the total number of model parameters of the first model. For example, when the total number of model parameters of the first model is large, a larger number of target model parameters are determined from the multiple model parameters of the first model; otherwise, a smaller number of target model parameters are determined.

[0067] In some embodiments, the number of target model parameters can be determined according to the application scenario of the first model. For example, when the application scenario of the first model is a public scenario (for example, AIPC applied in a public environment), a larger number of target model parameters are determined from multiple model parameters of the first model; when the application scenario of the first model is a private scenario (for example, AIPC applied in a home environment), a smaller amount of target model parameters are determined from multiple model parameters of the first model. In this way, when the first model is applied in a public scenario, a larger number of target model parameters are determined, which can improve the protection strength of the model parameters; when the first model is applied in a private scenario, a smaller number of target model parameters are determined, which can improve the speed of matrix permutation of the target model parameters and reduce the amount of calculation.

[0068] Step S102, based on the at least one target model parameter and the first matrix set, determine the permutation matrix corresponding to each of the target model parameters; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter.

[0069] Here, the first matrix set refers to a pre-set basic matrix set consisting of at least one first matrix.

[0070] Different first matrices have different matrix elements or matrix dimensions. For example, the first matrix may be a one-dimensional matrix, a two-dimensional matrix, a three-dimensional matrix, or a four-dimensional matrix, etc. For another example, when multiple first matrices are two-dimensional matrices, the matrix elements of each two-dimensional first matrix are different.

[0071] In some embodiments, each matrix element of the first matrix is ​​0 or 1.

[0072] In this way, at least one first matrix is ​​determined from the first matrix set, and matrix multiplication, inversion, transposition and other calculations are performed based on the determined at least one first matrix, so as to determine a plurality of second matrices.

[0073] In some embodiments, based on the matrix dimension of the parameter matrix of at least one target model parameter, at least one first matrix is ​​determined from the first matrix set, and matrix calculation is performed based on the determined at least one first matrix to obtain a permutation matrix so that the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the target model parameter.

[0074] For example, when the matrix dimension of at least one target model parameter is m*n, matrix calculation is performed using at least one first matrix determined from the first matrix set, and the dimension of the obtained permutation matrix is ​​m*m or n*n.

[0075] Here, the permutation matrix is ​​a square matrix, and each row and each column of the permutation matrix has only one matrix element whose value is 1, and the values ​​of the other matrix elements are all 0.

[0076] Step S103: using the permutation matrix to permute the parameter matrix of the corresponding target model parameters in the first model to obtain a second model.

[0077] As described above, the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameters. Therefore, by performing matrix multiplication operations on the permutation matrix and the corresponding parameter matrix of the target model parameters, the permutation processing of the parameter matrix of the target model parameters can be achieved.

[0078] In this way, by using the permutation matrix to perturb the parameter matrix of the corresponding target model parameters, a second model is obtained, so that the permuted target model parameters in the second model can maintain the element values ​​of the parameter matrix of the target model parameters before permutation, but the element positions are different from the positions before permutation in the first model, thereby achieving the effect of encrypting the target model parameters using the permutation matrix.

[0079] Step S104: sending the second model.

[0080] Here, the model-side device sends the second model obtained after replacing the model parameters to the client device, that is, AIPC.

[0081] In some embodiments, the model side device sends the second model to the AIPC based on the model request of the AIPC.

[0082] In some embodiments, the model-side device periodically performs a parameter matrix permutation operation on at least one target model parameter in the first model, and periodically sends the second model obtained after the parameter permutation to the AIPC.

[0083] In the model protection method provided by the present application, first, at least one target model parameter in the first model is determined; then, based on the at least one target model parameter and the first matrix set, a permutation matrix corresponding to each target model parameter is determined, wherein the first matrix set includes at least one first matrix, different first matrices have different matrix elements or matrix dimensions, and the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the parameter matrix of the target model parameter; then, the parameter matrix of the corresponding target model parameter in the first model is permuted by the permutation matrix to obtain a second model; finally, the second model is sent. In this way, on the one hand, the parameter matrix of at least one target model parameter of the first model is permuted by the permutation matrix, so that the permuted target model parameter can retain the element information in the parameter matrix before permutation, and the element position in the parameter matrix of the permuted model parameter is different from that before permutation, thereby achieving the effect of encrypting the target model parameter by using the permutation matrix; on the other hand, based on at least one target model parameter of the first model and the first matrix set, the permutation matrix corresponding to each target model parameter is determined, which improves the generation complexity of the permutation matrix corresponding to each target model parameter, thereby improving the security of the target model parameter.

[0084] In some embodiments, Figure 2 As shown, the model protection method provided by the present application includes the following steps S201 to S206:

[0085] Step S201: determine at least one target model parameter in the first model.

[0086] Here, step S201 corresponds to the above step S101, so when implementing step S201, reference may be made to the specific implementation of the above step S101.

[0087] Step S202: determining a target generation strategy based on the at least one target model parameter.

[0088] Here, the target generation strategy refers to a strategy of generating a permutation matrix corresponding to each target model parameter using at least one first matrix in the first matrix set.

[0089] In some embodiments, for each target model parameter, the target generation strategy may include a strategy of selecting at least one first matrix corresponding to the target model parameter from a set of first matrices.

[0090] In some embodiments, for each target model parameter, the target generation strategy may also include a strategy for generating a permutation matrix using at least one selected first matrix, that is, after determining at least one first matrix for the target model parameter, how to generate a permutation matrix using the determined at least one first matrix.

[0091] Step S203: Based on the target generation strategy, determine at least one first target matrix corresponding to each of the target model parameters from the first matrix set.

[0092] Here, based on the matrix dimension of the parameter matrix of the target model parameters and the determined target generation strategy, at least one first target matrix is ​​determined from the first matrix set, wherein the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions.

[0093] For example, when the parameter matrix of the target model parameters has 2 rows and 3 columns, based on one target generation strategy, a first matrix (for example, a first matrix with both 2 rows and 2 columns, or a first matrix with both 3 rows and 3 columns) can be selected from the first matrix set as the first target matrix; based on another target generation strategy, multiple first matrices (for example, a first matrix with 2 rows and 3 columns and a first matrix with 3 rows and 2 columns, or a first matrix with 3 rows and 2 columns and a first matrix with 2 rows and 3 columns) can be selected from the first matrix set as the first target matrix.

[0094] Step S204: generating a permutation matrix corresponding to each of the target model parameters based on the at least one first target matrix.

[0095] Here, the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameters.

[0096] After determining at least one first target matrix, the determined first target matrix may be used as a permutation matrix, or a matrix operation may be performed on the determined at least one first target matrix and the operation result may be used as a permutation matrix.

[0097] In some embodiments, matrix operations may include matrix transposition operations, multiplication operations, and the like.

[0098] For example, when the parameter matrix of the target model parameters has 2 rows and 3 columns, and a first target matrix (for example, a first matrix with 2 rows and 2 columns) is determined from the first matrix set, the determined first target matrix can be used as a permutation matrix; a transpose operation can also be performed on the determined first target matrix to use the transposed matrix of the first matrix as a permutation matrix.

[0099] For another example, when the parameter matrix of the target model parameters has 2 rows and 3 columns, and multiple first target matrices are determined from the first matrix set (for example, a first matrix with 2 rows and 3 columns and a first matrix with 3 rows and 2 columns), transposition operations, multiplication operations, etc. can be performed on the determined multiple first target matrices, and the results of the operations can be used as permutation matrices.

[0100] Step S205, using the permutation matrix to permute the parameter matrix of the corresponding target model parameters in the first model to obtain a second model;

[0101] Step S206: sending the second model.

[0102] Here, step S205 and step S206 have corresponding relationships with the above-mentioned step S103 and step S104 respectively. Therefore, when implementing step S205 and step S206, the specific implementation methods of the above-mentioned step S103 and step S104 can be referred to respectively.

[0103] In the above embodiment, a target generation strategy is determined based on at least one target model parameter, and at least one first target matrix is ​​determined from a first matrix set according to the target generation strategy, and a permutation matrix corresponding to each target model parameter is generated based on the at least one first target matrix, so that the generation method of the permutation matrix corresponding to each target model parameter can be flexibly configured according to at least one target model parameter corresponding to the first model.

[0104] In some embodiments, the determining of the target generation strategy based on the at least one target model parameter, that is, the above step S202, can be implemented as at least one of the following steps S2021 to S2023:

[0105] Step S2021: Based on the number of the at least one target model parameter, determine a target generation strategy corresponding to each target model parameter.

[0106] Here, based on the number of at least one target model parameter determined for the first model, a target generation strategy corresponding to each target model parameter is determined.

[0107] For example, when the number of at least one target model parameter is large, a relatively simple target generation strategy may be configured for each target model parameter. For example, a first target matrix with a smaller number is determined from a first matrix set for each target model parameter, or a matrix operation scheme with fewer steps is selected for at least one first target matrix to determine a permutation matrix, thereby reducing the computational resources required to calculate the permutation matrix of the target model parameter.

[0108] For another example, when the number of at least one target model parameter is small, a more complex target generation strategy may be configured for each target model parameter. For example, a larger number of first target matrices may be determined from the first matrix set for each target model parameter, or a more complex matrix operation scheme may be selected for at least one first target matrix to determine a permutation matrix, thereby increasing the computational complexity of the permutation matrix.

[0109] Step S2022: determining a target generation strategy corresponding to each target model parameter based on the matrix dimension of the parameter matrix of the target model parameters.

[0110] Since the matrix dimension of the permutation matrix of each target model parameter corresponds to the matrix dimension of the parameter matrix of the target model parameter, for each target model parameter, the target generation strategy of the permutation matrix can be determined based on the matrix dimension of the parameter matrix.

[0111] For example, when the dimension of the parameter matrix of the target model parameter is high, a relatively simple target generation strategy can be configured for the target model parameter. For example, at least one first target matrix with a small number and close matrix dimension is determined from the first matrix set for the target model parameter, or a relatively simple matrix operation scheme is selected for at least one first target matrix to determine the permutation matrix. In this way, when determining the permutation matrix of the high-dimensional target model parameter, the amount of matrix operation can be reduced, thereby reducing the computing resources required to calculate the permutation matrix of at least one target model parameter.

[0112] For another example, when the dimension of the parameter matrix of the target model parameter is low, a more complex target generation strategy can be configured for the target model parameter. For example, at least one first target matrix with a large number and low matrix dimension is determined from the first matrix set for the target model parameter, or a more complex matrix operation scheme is selected for at least one first target matrix to determine the permutation matrix. In this way, when determining the permutation matrix of the low-dimensional target model parameter, selecting a more complex target generation strategy can increase the computational complexity of the permutation matrix.

[0113] Step S2023: determining a target generation strategy corresponding to each target model parameter based on the type of the network layer corresponding to each target model parameter.

[0114] Here, the type of network layer refers to the type of each neural network included in the first model, for example, an embedding layer, an attention layer, a fully connected layer, and so on.

[0115] Since each type of network layer in the first model contains different numbers of model parameters, has different impacts on model performance, etc., the corresponding target generation strategy can be determined based on the type of network layer corresponding to each target model parameter.

[0116] For example, a more complex target generation strategy is configured for each target model parameter belonging to the attention layer, while a simpler target generation strategy is configured for each target model parameter belonging to the fully connected layer.

[0117] In this way, the corresponding target generation strategy is determined according to the type of network layer corresponding to the target model parameters. Different model parameter protection strategies can be provided for different types of network layers. While reasonably using the computing resources of the model party, the diversity of the permutation matrix generation method is increased, further improving the security of the model parameters.

[0118] In some embodiments, the target generation strategy includes one of a first generation strategy and a second generation strategy; the first generation strategy represents the determination of at least one first target matrix from the first matrix set based on the minimum computational amount; the second generation strategy represents the determination of multiple first target matrices from the first matrix set based on selecting the maximum number of first target matrices.

[0119] Here, in the first generation strategy, determining at least one first target matrix from the first matrix set based on the minimum amount of calculation means that when using at least one first target matrix to calculate the permutation matrix corresponding to each target model parameter, the consumed computing resources are minimized. For example, the amount of calculation can be reduced by reducing the number of matrix transposition calculation steps, the amount of calculation can be reduced by selecting a first matrix with a matrix dimension close to that of the parameter matrix as the first target matrix, and so on.

[0120] In the second generation strategy, multiple first target matrices are determined from the first matrix set based on selecting the maximum number of first target matrices, which means that when selecting at least one first target matrix from the first matrix set, when there are multiple selection schemes, the selection scheme corresponding to the maximum number of first target matrices is used as the scheme for determining the first target matrix. In this way, the complexity of generating the permutation matrix can be improved by using the maximum number of first target matrices to generate the permutation matrix.

[0121] In this way, the target generation strategy is determined based on the at least one target model parameter, that is, the above step S202, can be implemented as at least one of the following steps S2024 to S2026:

[0122] Step S2024, when the number of at least one target model parameter is greater than the quantity threshold, the first generation strategy is determined as the target generation strategy; when the number of at least one target model parameter is not greater than the quantity threshold, the second generation strategy is determined as the target generation strategy.

[0123] Here, the quantity threshold refers to a threshold of the number of target model parameters included in the first model.

[0124] When the number of target model parameters in the first model is greater than the number threshold, the first generation strategy is determined as the target generation strategy, thereby reducing the computing resources required to calculate a larger number of permutation matrices and increasing the generation speed of the permutation matrices.

[0125] When the number of target model parameters in the first model is not greater than the quantity threshold, since the number of target model parameters is small, correspondingly, the number of permutation matrices to be calculated is also small and the computing resources required to calculate the permutation matrices are also small. Therefore, the second generation strategy can be determined as the target generation strategy to generate corresponding permutation matrices based on the maximum number of first target matrices, thereby increasing the complexity of generating each permutation matrix.

[0126] Step S2025, when the matrix dimension corresponding to the parameter matrix of each target model parameter is greater than the dimension threshold, the first generation strategy is determined as the target generation strategy; when the matrix dimension corresponding to the parameter matrix of at least one target model parameter is not greater than the dimension threshold, the second generation strategy is determined as the target generation strategy.

[0127] Here, the dimension threshold refers to a preset threshold of the dimension of the parameter matrix of the target model parameters.

[0128] When the dimension of the parameter matrix of the target model parameters is greater than the dimension threshold, since the high-dimensional matrix operations consume a lot of computing resources, the first generation strategy is determined as the target generation strategy to give priority to selecting a combination of at least one first target matrix that requires the least amount of computation, thereby reducing the computing resources required to calculate the high-dimensional matrix and increasing the generation speed of the permutation matrix.

[0129] When the dimension of the parameter matrix of the target model parameters is not greater than the dimension threshold, since the computing resources consumed by low-dimensional matrix operations are relatively small, the second generation strategy is determined as the target generation strategy to utilize the maximum number of first target matrices to generate corresponding permutation matrices, thereby increasing the generation complexity of each permutation matrix.

[0130] Step S2026: For each of the target model parameters, when the type of the network layer corresponding to the target model parameter is a specified type, the second generation strategy is determined as the target generation strategy; when the type of the network layer corresponding to the target model parameter is not a specified type, the first generation strategy is determined as the target generation strategy.

[0131] Here, the specified type of network layer may be a network layer that is pre-specified for the first model and has a smaller number of target model parameters or has a greater impact on model performance.

[0132] In some embodiments, the specified type of network layer may include an attention layer, a normalization layer, or a fully connected layer.

[0133] Here, when the type of the network layer corresponding to the target model parameter is a specified type, the number of target model parameters belonging to the same type of network layer as the target model parameter is small, or the target model parameter has a greater impact on the model performance. Therefore, the second generation strategy is determined as the target generation strategy to utilize the maximum number of first target matrices to generate corresponding permutation matrices, thereby increasing the generation complexity of each permutation matrix.

[0134] When the type of the network layer corresponding to the target model parameter is not the specified type, the number of target model parameters belonging to the same type of network layer as the target model parameter is large, or the target model parameter has little impact on the model performance. Therefore, the second generation strategy is determined as the target generation strategy to give priority to selecting a combination of at least one first target matrix with the smallest required computational amount, thereby reducing the computing resources required to calculate the permutation matrix corresponding to the target model parameter and improving the generation speed of the permutation matrix.

[0135] In some embodiments, Figure 3 As shown, the model protection method provided by the present application includes the following steps S301 to S305:

[0136] Step S301, determining at least one target network layer in the first model.

[0137] Here, the target network layer may be any network layer identified from the plurality of network layers of the first model.

[0138] In some embodiments, each network layer of the first model can be determined as a target network layer; a specified type of network layer in the first model can also be determined as a target network layer, for example, an attention layer, a fully connected layer, a pooling layer, an embedding processing layer, etc. in the first model can be determined as a target network layer.

[0139] Step S302: for each of the target network layers, determine at least one target model parameter in the target network layer; wherein each of the target model parameters represents a model parameter determined by model training.

[0140] Here, at least one target model parameter is determined from a plurality of model parameters of each target network layer.

[0141] In some embodiments, at least one target model parameter is determined from a calculation formula corresponding to each target network layer.

[0142] For example, the core calculation formula of the attention layer includes the weight parameter W used to calculate the query vector Q q , the weight parameter W used to calculate the key vector K k , and the weight parameter W used to calculate the value vector V v In this way, when determining at least one target model parameter corresponding to the attention layer, the weight parameter W q , W k and W v At least one of is determined as the target model parameter.

[0143] Step S303, based on the at least one target model parameter and the first matrix set, determining a permutation matrix corresponding to each of the target model parameters; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the parameter matrix of the target model parameter;

[0144] Step S304, using the permutation matrix to permute the parameter matrix of the corresponding target model parameters in the first model to obtain a second model;

[0145] Step S305: sending the second model.

[0146] Here, step S303, step S304 and step S305 correspond to the above-mentioned step S102, step S103 and step S104 respectively. Therefore, the specific implementation methods of step S303, step S304 and step S305 can refer to the above-mentioned step S102, step S103 and step S104 respectively.

[0147] In some embodiments, the first model includes a transformer model; the at least one target network layer includes at least an input data encoding layer, a plurality of attention layers, a plurality of pooling layers, a plurality of fully connected layers, a plurality of normalization layers and a classifier layer;

[0148] In this way, for each target network layer, determining at least one target model parameter in the target network layer, that is, the above step S302, can be implemented as the following step S3021:

[0149] Step S3021, determine at least one first target model parameter from at least one model parameter contained in the calculation formula corresponding to the input data encoding layer, each attention layer, each pooling layer, each fully connected layer, each normalization layer and classifier layer of the first model.

[0150] Here, the input data encoding layer is used to encode the data input into the model by the user, for example, embedding processing. Therefore, in some embodiments, in order to encrypt the data output by the input data encoding layer, the last model parameter included in the calculation formula corresponding to the input data encoding layer can be used as the first target model parameter.

[0151] In some embodiments, as described above, the weight parameter W in each attention layer can be q , W k and W v At least one of is determined as the target model parameter.

[0152] For each fully connected layer, the weight matrix W in the core calculation formula corresponding to the fully connected layer can be determined as the target model parameter.

[0153] For each normalization layer, at least one of a scaling parameter γ and a translation parameter β in a core calculation formula corresponding to the normalization layer may be determined as a target model parameter.

[0154] The classifier layer is used to classify the calculation results of the neural network. Therefore, the last model parameter in the calculation formula corresponding to the classifier layer is determined as the target model parameter.

[0155] It should be noted that when the Transformer model introduces a bias term, for example, when a bias term is introduced in an attention layer, a fully connected layer, or other neural networks, the bias term is not permuted.

[0156] From the above, it can be seen that when the first model is a Transformer model, the model parameters in various types of neural network layers in the Transformer model are replaced to improve the security of the model parameters of the Transformer model.

[0157] In some embodiments, the first model includes a large language LLAMA model; the target network layer includes at least an input data encoding layer, a plurality of normalization layers, a plurality of attention layers, a plurality of fully connected layers and a classifier layer;

[0158] In this way, for each target network layer, determining at least one target model parameter in the target network layer, that is, the above step S302, can be implemented as the following steps S3022 to S3023:

[0159] Step S3022, determining at least one second target model parameter from at least one model parameter included in the calculation formula corresponding to the input data encoding layer, each of the normalization layers, each of the fully connected layers and the classifier layer.

[0160] Here, the specific implementation method of determining at least one second target model parameter from at least one model parameter contained in the calculation formula corresponding to the input data encoding layer, each normalization layer, each fully connected layer and the classifier layer in step S3022 is the same as the specific implementation method of determining at least one first target model parameter from at least one model parameter contained in the calculation formula corresponding to the input data encoding layer, each attention layer, each fully connected layer, each normalization layer and classifier layer of the first model in the above-mentioned step S3021. Please refer to the detailed description above.

[0161] Step S3023, determine at least one third target model parameter from at least one model parameter contained in the calculation formula corresponding to each of the attention layers; wherein, when the third target model parameter includes the model parameter for calculating the query vector and the key vector in the calculation formula corresponding to the attention layer, the third target model parameter is not used as a multiplicand to perform the permutation processing.

[0162] Here, after the attention layer of the LLAMA model calculates the original query vector and key vector, the original query vector and key vector are positionally encoded, as shown in the following formulas (1) and (2):

[0163] Q=XW q+PE1 (1);

[0164] K=XW k +PE2 (2);

[0165] Among them, PE1 and PE2 represent the position encoding information corresponding to the query vector Q and the key vector K respectively.

[0166] From the above formulas (1) and (2), we can see that if the permutation matrix is ​​used as a multiplier to calculate the model parameters W of the query vector and the key vector q and W k The parameter matrix is ​​permuted to rearrange the element positions in the parameter matrix corresponding to the query vector and the key vector. Since the position encoding information does not participate in the position permutation operation, the position encoding information cannot accurately reflect the position information of the elements of the corresponding query vector or key vector.

[0167] Therefore, when determining at least one third target model parameter included in the calculation formula corresponding to each attention layer, if the third target model parameter includes the model parameter W for calculating the query vector q Or the model parameters W used to calculate the key vector k , without using the permutation matrix as a multiplier for the model parameter W q Or the model parameter W k However, when the input feature data of the input attention layer is the data permuted by the permutation matrix, the transposed matrix of the permutation matrix corresponding to the input feature data can be used as the multiplicand for the model parameter W q and W k A replacement process is performed to replace the input feature data with the feature data before replacement before calculating the query vector Q and the key vector K.

[0168] As can be seen from the above, in each embodiment of the model protection method provided by the present application, on the one hand, at least one target model parameter of the first model is permuted using a permutation matrix so that the permuted target model parameter can retain the element information in the parameter matrix before permutation, and the element position in the permuted parameter matrix is ​​different from that before permutation, thereby achieving the effect of encrypting the target model parameter using the permutation matrix; on the other hand, based on the number of parameters of at least one target model parameter of the first model, the matrix dimension of the parameter matrix and / or the type of network layer, a target generation strategy of a permutation matrix corresponding to at least one target model parameter is determined, and at least one first target matrix is ​​determined from the first matrix set based on the target generation strategy, and the transposed matrix corresponding to each target model parameter is determined using at least one target matrix, which can simultaneously take into account the calculation speed, computing resource occupancy and generation complexity of the permutation matrix corresponding to at least one target model parameter; on the other hand, model parameters are permuted for multiple network layers such as the input data encoding layer, attention layer, normalization layer, and fully connected layer of the first model, and the permutation matrix corresponding to the target model parameter in each network layer is different, which increases the difficulty for illegal users or malicious attackers to maliciously obtain all model parameters, thereby achieving the purpose of protecting model parameters.

[0169] On the other hand, the present application also provides a data reasoning method. The data reasoning method is executed in a processor of a data reasoning device. Here, the data reasoning device may refer to a server, a laptop, a tablet computer, a desktop computer, a mobile device (such as a mobile phone, a portable video player, a personal digital assistant, a dedicated messaging device), or other device with data processing capabilities. In some embodiments, the data reasoning device is an AIPC.

[0170] Figure 4 A schematic diagram of the implementation flow of a data reasoning method provided in this application, such as Figure 4 As shown, the method includes the following steps S401 to S402:

[0171] Step S401, receiving a second model; wherein the second model is obtained by replacing a parameter matrix of corresponding target model parameters in the first model with a permutation matrix; the permutation matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameters.

[0172] Here, the data inference device receives the second model from the model side device.

[0173] In some embodiments, according to a preset update cycle, the data inference device receives the second model pushed by the model party device.

[0174] In some embodiments, the data inference device sends a model update request to the model side device, and receives a second model from the model side device based on the model update request.

[0175] Here, the method for determining the second model can refer to the various implementation methods of the model protection method applied to the model-side device described above, which will not be repeated here.

[0176] Step S402, in response to the input data, using the second model to perform data reasoning to obtain a reasoning result corresponding to the input data.

[0177] Here, the second model is used to receive user input data or input data generated by an upper-layer application, and perform data reasoning to obtain corresponding reasoning results.

[0178] In the above-mentioned data inference method, the data inference device receives a second model obtained by permuting the parameter matrix of at least one target model parameter of the first model using a permutation matrix, and performs data inference using the second model, so that illegal users or malicious attackers can only obtain the model parameters of the intermediate network layer after permutation using the permutation matrix, the output data of the intermediate network layer and the encoding results of the input data. Since they cannot obtain the permutation matrix corresponding to each target model parameter, they cannot obtain each target model parameter before permutation, thereby achieving the effect of encrypting the model parameters and realizing model protection on the data inference device side.

[0179] Next, combine Figure 5 , taking the Transformer model as an example, the process of data reasoning using the permuted Transformer model is explained.

[0180] First, user input data X 501 is input into the input data encoding layer 502 .

[0181] Here, the input data encoding layer 502 is a data embedding layer, which is used to embed the user input data X to obtain the corresponding feature data x. At the same time, in the model parameter replacement, the replacement matrix π is used to replace the parameter matrix of the last model parameter E in the calculation formula corresponding to the input data encoding layer 502.

[0182] In this way, after the input data X is processed by the input data encoding layer 502, feature data xπ503 is obtained.

[0183] Afterwards, the feature data xπ503 is input into the neural network 520 for feature extraction in the Transformer model.

[0184] The Transformer model includes a plurality of neural networks 520, and the plurality of neural networks 520 are used to extract features from the feature data xπ 503. Here, the data processing process is described by taking the i-th neural network 520 as an example.

[0185] The feature data xπ503 outputted from the input data encoding layer 502 is inputted into the attention layer of the i-th neural network 520 for processing. Here, the attention layer includes a first network layer 504, a second network layer 505, a third network layer 506 and a fourth network layer 507; the feature data xπ503 is inputted into the first network layer 504, the second network layer 505 and the third network layer 506 respectively.

[0186] Here, for the first network layer 504, using π T and π i1 The model parameters W used to calculate the query vector Q q Specifically, replace π T As the multiplicand and W q The parameter matrix is ​​matrix-multiplied, and π i1 As a multiplier with W q In this way, the characteristic data output by the first network layer 504 is Qπ i1 507, where Q represents the original query vector calculated based on the first network layer 504, Qπ i1 507 indicates the use of model parameters W q The query vector is obtained by permuting the original query vector Q by the multiplied permutation matrix.

[0187] For the second network layer 505, use π T and π i1 The model parameters W used to calculate the key vector K k Specifically, replace π T As the multiplicand and W k The parameter matrix is ​​matrix-multiplied, and π i1 As a multiplier with W k In this way, the feature data output by the second network layer 505 is Kπ i1 508, where K represents the original key vector calculated using the second network layer 505, Kπ i1 508 indicates the use of model parameters W k Multiply the permutation matrix π i1 The key vector after permuting the original key vector K.

[0188] It should be noted that here, the same permutation matrix π is used i1For the model parameter W q and model parameters W k The purpose of the permutation is to utilize Qπ in the fourth network layer 510 in the attention layer i1 507 and Kπ i1 508 When calculating the attention score, the permutation matrix π can be offset i1 The permutation effect on the output.

[0189] For the third network layer 506, using π T and π i2 The model parameters W used to calculate the value vector V v Specifically, replace π T As the multiplicand and W v The parameter matrix is ​​matrix-multiplied, and π i2 As a multiplier with W v In this way, the feature data output by the third network layer 506 is Vπ i2 509, where V represents the original key vector calculated using the third network layer 506, Vπ i2 509 indicates the use of model parameters W v Multiply the permutation matrix π i2 The value vector after permuting the original value vector V.

[0190] Afterwards, the query vector Qπ i1 507. Key vector Kπ i1 508, and the value vector Vπ i2 509 Input to the fourth network layer 510 in the attention layer.

[0191] Here, the fourth network layer 510 is used to utilize Qπ i1 507 and Kπ i1 508 Calculate the attention score and convert the attention score into a weighted value vector Vπ i2 509; At the same time, the third network layer 510 includes a fully connected layer, and the weight parameter W0 in the fully connected layer is used to permute the matrix π i2 The transposed matrix π i2 T The parameter matrix of the weight parameter W0 is permuted as the multiplicand to offset the value vector Vπ i2 Permutation matrix π in 509 i2 ; At the same time, in order to encrypt the output feature data of the attention layer, the permutation matrix π is used as a multiplier to multiply the weight parameter W0. In this way, the output feature data of the fourth network layer 510 is uπ511.

[0192] Afterwards, the feature data uπ511 is input into the first normalization layer 512 for normalization processing.

[0193] Here, the scaling parameter γ and the translation parameter β in the first normalization layer 512 are permuted using the permutation matrix π. Specifically, the permutation matrix π is used as a multiplier to perform matrix multiplication operations with the scaling parameter γ and the translation parameter β. In this way, the first normalization layer 512 outputs feature data vπ513.

[0194] Afterwards, the feature data vπ513 is input into the fully connected layer 514 for feature processing.

[0195] Here, the fully connected layer 514 includes two layers of fully connected processing. For the first fully connected layer, the transposed matrix π of the permutation matrix π is used. T As the multiplicand, it performs matrix multiplication with the weight parameter W1 of the first fully connected layer, and uses the permutation matrix π i3 As a multiplier, it is matrix-multiplied with the weight parameter W1 to achieve the permutation of the parameter matrix of the weight parameter W1; for executing the second fully connected layer, the permutation matrix π is used i3 The transposed matrix π i3 T As the multiplicand, the weight parameter W2 of the second fully connected layer is matrix multiplied, and the permutation matrix π is used as the multiplier to perform matrix multiplication with the weight parameter W2 to achieve the permutation processing of the parameter matrix of the weight parameter W2. In this way, the fully connected layer 514 outputs the feature data zπ515.

[0196] Afterwards, the feature data zπ515 is input into the second normalization layer 516 for feature normalization processing.

[0197] Here, the permutation matrix π is used to permutate the scaling parameter γ and the translation parameter β in the second normalization layer 516. Specifically, the permutation matrix π is used as a multiplier to perform matrix multiplication operations with the scaling parameter γ and the translation parameter β. In this way, the second normalization layer 516 outputs feature data yπ517.

[0198] Afterwards, the feature data yπ517 is input into the classifier layer 518 for inference result prediction.

[0199] Here, we use the transposed matrix π of the permutation matrix π T as the multiplicand and the weight parameter W in the classifier layer 518 c Perform matrix multiplication to adjust the weight parameter W c In this way, the classifier layer 518 predicts the inference result of the input feature data yπ517 and obtains the inference result 519.

[0200] Next, combine Figure 6, taking the LLAMA model as an example, the process of data reasoning using the permuted LLAMA model is explained.

[0201] First, user input data X 601 is input into the input data encoding layer 602 .

[0202] Here, the input data encoding layer 602 is a data embedding layer, which is used to embed the user input data X to obtain the corresponding feature data x. At the same time, the model parameter replacement method of the input data encoding layer 602 is the same as that of the input data encoding layer 502 in the above Transformaer model, which will not be repeated here.

[0203] In this way, after the input data X is encoded by the input data encoding layer 602, feature data xπ603 is obtained.

[0204] Afterwards, the feature data xπ603 is input into the neural network 622 for feature extraction in the LLAMA model.

[0205] The LLAMA model includes a plurality of neural networks 622, which are used to extract features from the feature data xπ 603. Here, the data processing process is described by taking the jth neural network 621 as an example.

[0206] The feature data xπ503 is input into the third normalization layer 604 in front of the j-th neural network 622 of the LLAMA model for normalization.

[0207] Here, the third normalization layer 604 is specifically implemented as a root mean square normalization layer (RMSNorm). When the model parameters of the third normalization layer 604 are permuted, the scaling parameter γ1 in the third normalization layer 604 is permuted using the permutation matrix π. Specifically, the permutation matrix π is used as a multiplier to perform a matrix multiplication operation with the scaling parameter γ. In this way, the third normalization layer 604 normalizes the feature data xπ503 and outputs the feature data rπ605.

[0208] Afterwards, the feature data rπ605 is input into the attention layer of the jth neural network 622 for processing. Here, the attention layer includes the fifth network layer 606, the sixth network layer 607, the seventh network layer 608, the first position encoding layer 612, the second position encoding layer 613 and the eighth network layer 614. Here, the feature data uπ605 is firstly input into the fifth network layer 606, the sixth network layer 607 and the seventh network layer 608 respectively.

[0209] Here, as mentioned above, the model parameters W used to calculate the query vector Q and the key vector K in the LLAMA model areq and W k No permutation of the parameter matrix is ​​performed as a multiplicand. Therefore, for the fifth network layer 606, only the permutation matrix π is used. T As the multiplicand, the model parameter W in the fifth network layer 606 q For the sixth network layer 607, only the permutation matrix π is used T The model parameter W of the sixth network layer 607 is used as the multiplicand k Thus, the characteristic data output by the fifth network layer 606 is Q609, and the characteristic data output by the sixth network layer 607 is K610.

[0210] For the seventh network layer 608, the model parameter replacement method is the same as that in the third network layer 506 in the above Transformer model, that is, π T and π j2 The model parameter W in the seventh network layer 608 is used as the multiplicand and the multiplier. v In this way, the characteristic data output by the seventh network layer 608 is Vπ j2 611, where V represents the original key vector calculated using the seventh network layer 608, Vπ j2 611 indicates the use of model parameters W v Multiply the permutation matrix π j2 The value vector after permuting the original value vector V.

[0211] Afterwards, the query vector Q609 and the key vector K610 are respectively input into the first position encoding layer 612 and the second position encoding layer 613 to generate position encoding information corresponding to each feature in the query vector Q and the key vector K.

[0212] Here, the position coding strategy adopted by the first position coding layer 612 and the second position coding layer 613 is a Rotary Position Embedding (RoPE) coding strategy.

[0213] After that, the query vector Q and key vector K containing the position encoding information, as well as the permuted value vector Vπ j2 611 inputs the eighth network layer 614 in the attention layer.

[0214] Here, the eighth network layer 614 calculates the attention score using the query vector Q containing the position encoding information and the key vector K, and converts the attention score into a weighted value vector Vπ j2 611; At the same time, the eighth network layer 614 includes a fully connected layer, and for the weight parameter W0 in the fully connected layer, the permutation matrix π i2T The parameter matrix of the weight parameter W0 in the eighth network layer 614 is permuted by using the permutation matrix π as the multiplicand and the multiplier. In this way, the output feature data of the eighth network layer 614 is sπ615.

[0215] Afterwards, the feature data sπ615 is input into the fourth normalization layer 616 for normalization processing.

[0216] Here, the permutation matrix π is used as a multiplier to permutate the scaling parameter γ2 in the fourth normalization layer 616. In this way, the fourth normalization layer 616 outputs feature data tπ617.

[0217] Afterwards, the feature data tπ617 is input into the fully connected layer 618 for feature processing.

[0218] Here, the fully connected layer 618 includes three layers of fully connected processing. For the first fully connected layer, the permutation matrix π T As the multiplicand, the weight parameter W1 of the first fully connected layer is matrix multiplied to permute the parameter matrix of the weight parameter W1; for the second fully connected layer, the permutation matrix π is respectively j3 T As the multiplicand, the permutation matrix π is used as the multiplier to perform matrix multiplication with the weight parameter W2 of the second fully connected layer to permute the weight parameter W2; for the third fully connected layer, the permutation matrix π is respectively T As the multiplicand, the permutation matrix π j3 T As a multiplier, the weight parameter W3 of the third fully connected layer is matrix-multiplied to permute the parameter matrix of the weight parameter W2. In this way, the fully connected layer 618 outputs feature data yπ619.

[0219] Afterwards, the feature data yπ619 is input into the classifier layer 620 for inference result prediction.

[0220] Here, for the classifier layer 620, the permutation matrix π T as the multiplicand and the weight parameter W in the classifier layer 620 c Perform matrix multiplication to adjust the weight parameter W c In this way, the classifier layer 620 predicts the inference result of the input feature data yπ619 and obtains the inference result 621.

[0221] In the above embodiment, by replacing the model parameters specified in the input data encoding layer, attention layer, normalization layer, fully connected layer and classifier layer of the Transformer model and the LLAMA model, the encoding result of the user input data X output by the input data encoding layer and the input feature data of each network layer input to the next network layer are all feature data replaced by the replacement matrix π, so that illegal users or malicious attackers cannot obtain the input or output data of each network layer; in addition, even if an illegal user or a malicious attacker obtains the input data or output data of a certain network layer, since the specified model parameters in the calculation formula corresponding to each network layer are replaced by the replacement matrix, it is difficult for the illegal user or malicious attacker to obtain the original data of the specified model parameters in each network layer; in addition, the replacement matrix corresponding to the specified model parameters in each network layer is different, which further increases the difficulty for illegal users or malicious attackers to obtain the original data of the specified model parameters in each network layer, and improves the model parameter security of the Transformer model and the LLAMA model.

[0222] Based on the above embodiments, the present application also provides a model side device. Figure 7 As shown, the model side device 700 includes a first processor 710 and a first communication interface 720; wherein,

[0223] The first processor 710 is used to determine at least one target model parameter in the first model; based on the at least one target model parameter and the first matrix set, determine a permutation matrix corresponding to each of the target model parameters; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter; the parameter matrix of the corresponding target model parameter in the first model is permuted by the permutation matrix to obtain a second model;

[0224] The first communication interface 720 is used to send the second model.

[0225] The present application also provides a data inference device. Figure 8 As shown, the data inference device 800 includes a second processor 810 and a second communication interface 820; wherein,

[0226] The second communication interface 820 is used to receive a second model; wherein the second model is obtained by replacing a parameter matrix of a corresponding target model parameter in the first model with a replacement matrix; the replacement matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the replacement matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter;

[0227] The second processor 810 is used to perform data reasoning using the second model in response to input data to obtain a reasoning result corresponding to the input data.

[0228] The present application also provides a model protection system. Fig. 9 As shown, the model protection system 900 includes a model side device 910 and a data reasoning device 920; wherein,

[0229] The model side device 910 is used to permute the parameter matrix of at least one target model parameter in the first model 912 by using the first matrix set 911 to obtain the second model 913. Specifically, firstly, at least one target model parameter in the first model is determined; then, based on the at least one target model parameter and the first matrix set, a permutation matrix corresponding to each of the target model parameters is determined, the first matrix set includes at least one first matrix, different first matrices have different matrix elements or matrix dimensions, and the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the parameter matrix of the target model parameter; finally, the parameter matrix of the corresponding target model parameter in the first model is permuted by using the permutation matrix to obtain the second model 913;

[0230] The data inference device 920 is used to receive the second model 913 from the model side device 910, and perform data inference based on the user input data 921 and using the second model 913 to obtain the data inference result 922 corresponding to the input data X.

[0231] It should be noted that the functions or models contained in the above-mentioned model-side device, data inference device and model protection system can be used to execute the methods described in the above-mentioned method embodiments. For technical details not disclosed in the model-side device embodiments and inference method embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0232] In the embodiment of the present application, if the above-mentioned model protection method and data reasoning method are implemented in the form of a software function module and sold or used as an independent product, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant technology. The software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific hardware, software or firmware, or any combination of hardware, software, and firmware.

[0233] An embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0234] The embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0235] An embodiment of the present application provides a computer program, including a computer-readable code. When the computer-readable code is run in a computer device, a processor in the computer device executes some or all of the steps for implementing the above method.

[0236] The embodiment of the present application provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and when the computer program is read and executed by a computer, some or all of the steps in the above method are implemented. The computer program product can be implemented specifically by hardware, software or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK) and the like.

[0237] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, storage medium, computer program and computer program product of this application, please refer to the description of the method embodiment of this application for understanding.

[0238] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0239] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0240] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0241] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0242] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0243] A person skilled in the art can understand that all or part of the steps of implementing the above method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories (ROM), magnetic disks or optical disks, etc., various media that can store program codes.

[0244] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0245] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A model protection method, comprising: determining at least one target model parameter in the first model; Based on the at least one target model parameter and the first matrix set, determining a permutation matrix corresponding to each target model parameter; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix has a corresponding relationship with the matrix dimension of the parameter matrix of the target model parameter; Using the permutation matrix to permute the parameter matrix of the corresponding target model parameters in the first model to obtain a second model; The second model is sent.

2. The method according to claim 1, wherein: The step of determining a permutation matrix corresponding to each target model parameter based on the at least one target model parameter and the first matrix set includes: determining a target generation strategy based on the at least one target model parameter; Based on the target generation strategy, determining at least one first target matrix corresponding to each of the target model parameters from the first matrix set; Based on the at least one first target matrix, a permutation matrix corresponding to each of the target model parameters is generated.

3. The method according to claim 2, wherein: The determining of the target generation strategy based on the at least one target model parameter comprises at least one of the following: Based on the number of the at least one target model parameter, determining a target generation strategy corresponding to each of the target model parameters; Determining a target generation strategy corresponding to each target model parameter based on a matrix dimension of a parameter matrix of the target model parameters; Based on the type of the network layer corresponding to each of the target model parameters, a target generation strategy corresponding to each of the target model parameters is determined.

4. The method according to claim 3, wherein: The target generation strategy includes one of a first generation strategy and a second generation strategy; the first generation strategy represents determining at least one first target matrix from the first matrix set based on a minimum amount of calculation; The second generation strategy represents determining a plurality of first target matrices from the first matrix set based on selecting a maximum number of first target matrices; The determining of the target generation strategy based on the at least one target model parameter comprises at least one of the following: In a case where the number of the at least one target model parameter is greater than a number threshold, determining the first generation strategy as the target generation strategy; In a case where the number of the at least one target model parameter is not greater than a number threshold, determining the second generation strategy as the target generation strategy; In a case where the matrix dimension corresponding to the parameter matrix of each of the target model parameters is greater than a dimension threshold, determining the first generation strategy as the target generation strategy; In a case where the matrix dimension corresponding to the parameter matrix of the at least one target model parameter is not greater than a dimension threshold, determining the second generation strategy as the target generation strategy; For each of the target model parameters, when the type of the network layer corresponding to the target model parameter is a specified type, determining the second generation strategy as the target generation strategy; When the type of the network layer corresponding to the target model parameter is not a specified type, the first generation strategy is determined as the target generation strategy.

5. The method according to claim 1, wherein: The determining of at least one target model parameter in the first model comprises: determining at least one target network layer in the first model; For each of the target network layers, at least one target model parameter in the target network layer is determined; wherein each of the target model parameters represents a model parameter determined through model training.

6. The method according to claim 5, wherein: The first model includes a converter model; the at least one target network layer includes at least an input data encoding layer, a plurality of attention layers, a plurality of fully connected layers, a plurality of normalization layers and a classifier layer; The step of determining, for each target network layer, at least one target model parameter in the target network layer comprises: Determine at least one first target model parameter from at least one model parameter contained in the calculation formula corresponding to the input data encoding layer, each attention layer, each fully connected layer, each normalization layer and classifier layer of the first model.

7. The method according to claim 5, wherein: The first model includes a large language model; the target network layer includes at least an input data encoding layer, a plurality of normalization layers, a plurality of attention layers, a plurality of fully connected layers and a classifier layer; The step of determining, for each target network layer, at least one target model parameter in the target network layer comprises: Determine at least one second target model parameter from at least one model parameter included in the calculation formula corresponding to the input data encoding layer, each of the normalization layers, each of the fully connected layers, and the classifier layer; At least one third target model parameter is determined from at least one model parameter included in the calculation formula corresponding to each of the attention layers; wherein, when the third target model parameter includes the model parameter for calculating the query vector and the key vector in the calculation formula corresponding to the attention layer, the third target model parameter is not used as a multiplicand to perform the permutation processing.

8. A data reasoning method, applied to a data reasoning device, comprising: Receive a second model; wherein the second model is obtained by replacing a parameter matrix of a corresponding target model parameter in the first model with a replacement matrix; the replacement matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the replacement matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter; In response to the input data, data reasoning is performed using the second model to obtain a reasoning result corresponding to the input data.

9. A model side device, comprising a first processor and a first communication interface; The first processor is used to determine at least one target model parameter in the first model; based on the at least one target model parameter and the first matrix set, determine a permutation matrix corresponding to each of the target model parameters; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the permutation matrix corresponds to the matrix dimension of the parameter matrix of the target model parameter; the parameter matrix of the corresponding target model parameter in the first model is permuted by the permutation matrix to obtain a second model; The first communication interface is used to send the second model.

10. A data inference device comprising a second processor and a second communication interface; The second communication interface is used to receive a second model; wherein, The second model is obtained by replacing the parameter matrix of the corresponding target model parameters in the first model with a replacement matrix; the replacement matrix is ​​determined based on at least one target model parameter in the first model and a first matrix set; the first matrix set includes at least one first matrix; different first matrices have different matrix elements or matrix dimensions; the matrix dimension of the replacement matrix corresponds to the matrix dimension of the parameter matrix of the target model parameters; The second processor is used to perform data reasoning using the second model in response to input data to obtain a reasoning result corresponding to the input data.

Images