Model security protection method and system
Through model pruning and retrieval technology, the inference accuracy of the AI model is reduced, making it difficult to use normally after being stolen, solving the problems of security and efficiency of the AI model, and achieving efficient protection and concealment.
Patent Information
- Application Number
- CN202411250960.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-06
- Publication Date
- 2024-12-27
AI Technical Summary
The existing technology is difficult to effectively protect the security and efficiency of AI models. The decryption delay of traditional encryption and decryption algorithms is large, and the overhead of secure multi-party computing and homomorphic encryption computing or communication is large, and the versatility is not strong, resulting in the model being easily stolen during deployment and Abuse and easy to white box attack.
The second model is obtained through model pruning processing, partially or completely complementing the clipped nodes and connections, and the complemented connection weight is set to a preset value, so that the third model with inference accuracy is lower than the preset threshold value is used When detecting and modifying the preset value to zero value, it provides protection.
It improves the security of AI models, prevents the model from being abused and white box attacks, reduces the inference delay and computing overhead, and improves the concealment and security of the model.
Smart Images
Figure CN119203075A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of artificial intelligence and information security technology, and specifically relates to a model security protection method and system. Background Art
[0002] With the rapid development of artificial intelligence, the application of artificial intelligence technology is becoming more and more extensive. AI models are gradually applied to all aspects of people's lives, and various AI models have been deployed on a variety of terminal devices, such as mobile phones, tablets, cars, etc.
[0003] The deployment and use environment of AI models is relatively complex. If an AI model is stolen by an adversary, on the one hand, the model will be abused and the intellectual property rights of the model producer will not be protected. On the other hand, the adversary can more easily launch white box attacks by analyzing the model, which will cause greater economic losses and social impacts.
[0004] In the existing technology, traditional encryption and decryption algorithms are often used to protect models. However, the decryption delay of encrypted models is large when they are used, which will affect the terminal's reasoning performance and user experience. In addition, the model is in plain text during operation and may still be stolen by opponents. In addition, technologies such as secure multi-party computing and homomorphic encryption can be used to make the model reason in ciphertext form, but such methods have high computational or communication overhead and are not very versatile.
[0005] The application of AI models has very broad prospects, but how to improve the security and efficiency of model use remains a problem that needs to be solved urgently. Summary of the invention
[0006] The purpose of the present invention is to provide a model security protection method and system to meet the needs of improving the security and efficiency of using AI models.
[0007] In the technical solution of the present invention, the model is pruned, and then the pruned nodes and connections are partially or fully restored, and the weights of the restored connections are set to preset values, so that the reasoning accuracy of the restored model is lower than the preset threshold and becomes unusable. When the model is used, the preset value in the model is detected, and the weight whose value is equal to the preset value is modified to zero, so that a usable model is obtained. By disguising some nodes and connections in the model, the model is protected.
[0008] Specifically, the first aspect of the present invention provides a model security protection method, comprising: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, the pruned nodes and connections of the second model are partially or fully restored, and the weights of the restored connections are set to preset values to obtain a third model for publishing to users; the reasoning accuracy of the third model is lower than a preset threshold.
[0009] Based on the above, a model execution file corresponding to the third model is released, in which the preset values in the third model are protected by cryptographic technology.
[0010] Based on the above, the weights of the connections to be restored are set to preset values, including setting the weights of the connections to be restored to preset one or more values, or values with preset characteristics.
[0011] Based on the above, the method of partially or completely replenishing the pruned nodes and connections of the second model includes: setting a model replenishment ratio coefficient k, and replenishing the extra nodes and connections of the first model relative to the second model according to the calculation graph of the first model and the second model according to the ratio coefficient k, wherein 0 <k≤1。
[0012] Based on the above, when the pruned nodes and connections of the second model are partially or fully restored, the reasoning accuracy of the third model is made lower than the preset threshold by selecting the pruned nodes and connections and setting the preset weight values for the pruned connections.
[0013] A second aspect of the present invention provides a model use method. When using a third model obtained according to the model security protection method, a preset value in the third model is detected, and the weight whose value is equal to the preset value is modified to zero.
[0014] A third aspect of the present invention provides a model security protection system, including a model protection unit; the model protection unit includes a model acquisition module, a model pruning module, and a model recovery module; The model acquisition module is used to acquire the first model; The model pruning module is used to perform model pruning processing on the first model to obtain a second model; The model filling module is used to partially or completely fill in the pruned nodes and connections of the second model according to the calculation graph of the first model, and set the weights of the filled-in connections to preset values to obtain a third model; the reasoning accuracy of the third model is lower than a preset threshold.
[0015] The fourth aspect of the present invention provides a model usage system, including a model usage unit, which presets the third model output by the model security protection system, and when using the third model, detects the preset value in the third model and modifies the weight whose value is equal to the preset value to zero.
[0016] A fifth aspect of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the model security protection method as described above are implemented; and / or the steps of the model usage method as described above are implemented.
[0017] A sixth aspect of the present invention provides a computer program product, which stores instructions, and when the instructions are executed by a computer, the computer implements the steps of the model security protection method as described; and / or the steps of the model usage method as described.
[0018] The present invention has substantial features and improvements over the prior art, specifically: 1. The technical solution of the present invention can effectively protect AI models. After the adversary steals the model protected by the technical solution, the adversary cannot obtain accurate and reliable results by using the model for reasoning, and it is also difficult to obtain the true structural information and weight information of the original model, thereby preventing the model from being abused and attacked by white box attacks, and greatly improving the security of the model.
[0019] 2. The technical solution of the present invention needs to detect the preset value in the model when using the model, and modify the weight whose value is equal to the preset value to zero, which brings very small inference delay and very simple steps. Compared with other model protection methods, it is very efficient.
[0020] 3. The technical solution of the present invention only requires security protection of the model execution file or the preset values in the model. When cryptographic technology is used to ensure its security, the computational overhead and communication overhead are very small.
[0021] 4. The disguised model in the technical solution of the present invention is no different from an ordinary model or a classic model. The disguise of the model is not easy to be discovered and has good concealment, which improves the security of the model from another perspective. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 It is a schematic diagram of a model security protection method according to an embodiment of the present invention.
[0023] Figure 2 is a schematic diagram of a model safety protection system according to an embodiment of the present invention.
[0024] Figure 3 It is a schematic diagram of the structure of the computer device of embodiment 3 of the present invention. DETAILED DESCRIPTION
[0025] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0026] The models in the present invention are mainly AI models, including artificial neural network models, especially deep learning models.
[0027] Example 1 This embodiment provides a model security protection method, such as Figure 1 As shown, the method includes: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, the pruned nodes and connections of the second model are partially or fully restored, and the weights of the restored connections are set to preset values to obtain a third model for publishing to users; the reasoning accuracy of the third model is lower than a preset threshold.
[0028] When using the third model obtained according to the method for protecting model security, the preset value in the third model is detected, and the weight whose value is equal to the preset value is modified to zero.
[0029] Obtaining the first model includes obtaining the first model through training, or obtaining the first model by fine-tuning a pre-trained model, or obtaining an existing first model through communication transmission, storage area reading, etc.
[0030] The first model is the original model that needs to be protected, which generally has higher reasoning accuracy.
[0031] The second model is an intermediate model that has undergone model pruning. During the pruning process, the second model is tried to maintain an accuracy close to that of the first model.
[0032] The third model is a model that has been protected. If the third model is used directly, the reasoning accuracy of the third model is lower than the preset threshold. The goal of the preset threshold is to ensure that the reasoning accuracy of the third model is very low, to the point where it is unusable. However, by using the model execution file corresponding to the third model, by detecting the preset value in the third model and modifying the weight whose value is equal to the preset value to zero, the reasoning accuracy obtained by the third model is equivalent to that of the second model.
[0033] The third model can be publicly released or deployed on various electronic products. The model execution file corresponding to the third model is only released to legitimate users in a safe manner, or safely stored in the hardware product. In this way, the purpose of protecting the model security can be achieved.
[0034] Model pruning, also known as model sparsification, aims to explore the redundancy in model weights and delete / prune redundant and non-critical weights. This reduces the number of model parameters and computational complexity, shrinks the model size, and accelerates model training / inference while minimizing the impact on model accuracy. The typical steps of model pruning usually include training, pruning, and fine-tuning. Model pruning can be classified into fine-grained pruning and coarse-grained pruning. Fine-grained pruning involves pruning connections or neurons, while coarse-grained pruning includes vector pruning, convolutional kernel pruning, channel pruning, hierarchical pruning, and so on.
[0035] Preferably, partially or fully restoring the pruned nodes and connections in the second model part includes: setting a model restoration ratio coefficient k. According to the computational graphs of the first model and the second model, the nodes and connections that the first model has more than the second model are restored to the second model according to the ratio coefficient k, where 0 < k ≤ 1. When k < 1, it is a partial restoration case, and when k = 1, it is a full restoration case. For the restored part, except for the weights, the others are restored according to the settings in the first model.
[0036] In addition, the ratio coefficient k can be made greater than 1, that is, in addition to restoring the nodes and connections that the first model has more than the second model to the second model, some additional nodes and connections can be added to the second model.
[0037] Preferably, setting the weights of the restored connections to preset values includes setting the weights of the restored connections to one or more preset numerical values or numerical values with preset characteristics.
[0038] Preferably, when partially or fully restoring the pruned nodes and connections in the second model part, by selecting the restored nodes and connections and the preset weight values of the restored connections, the inference accuracy of the third model is made lower than a preset threshold.
[0039] Preferably, releasing the model execution file corresponding to the third model, where the preset values in the third model are protected using cryptographic techniques. Cryptographic techniques include encryption / decryption, authentication, etc. Protecting the preset values using cryptographic techniques further enhances the security of the model.
[0040] The model execution file corresponding to the third model is released through a secure channel. For example, security can be ensured through encryption, identity authentication, and other means.
[0041] In this technical solution, the third model is published or stored in plain text. It is only necessary to protect the model execution file corresponding to the third model, especially to encrypt and protect the preset values in the third model. After the opponent obtains the third model, it cannot be used normally, the operation cannot get the correct results, and the true structure of the model cannot be known. When using the third model, there is no need to perform a large number of decryption operations on the third model, and the operation efficiency is high. Therefore, the security of the model can be greatly improved on the basis of protecting the reasoning performance of the AI model.
[0042] Embodiment 2: Based on the same inventive concept, this embodiment also provides a model security protection system. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more model security protection system embodiments provided below can refer to the limitations on the method above, and will not be repeated here.
[0043] This embodiment provides a model security protection system and a use system, such as Figure 2 As shown, it includes a model protection unit and a model use unit; the model protection unit includes a model acquisition module, a model pruning module, and a model replenishment module; The model acquisition module is used to acquire the first model; The model pruning module is used to perform model pruning processing on the first model to obtain a second model; The model filling module is used to partially or completely fill in the pruned nodes and connections of the second model according to the calculation graph of the first model, and set the weights of the filled-in connections to preset values to obtain a third model; the reasoning accuracy of the third model is lower than a preset threshold.
[0044] The model using system includes a model using unit; the model using unit presets the third model, and when using the third model, detects the preset value in the third model, and modifies the weight whose value is equal to the preset value to zero.
[0045] Preferably, the model security protection system further comprises a model publishing module, which is used to publish a model execution file corresponding to the third model, wherein the preset values in the third model are protected by cryptographic technology.
[0046] Optionally, the model protection unit and the model use unit are connected in communication, and the model use unit obtains the third model and the corresponding model execution file by communicating with the model protection unit. The model use unit may also obtain the third model from the model protection unit in other ways.
[0047] The model protection unit and the model use unit may also be in the same device. After obtaining the third model, the model protection unit may also destroy or encrypt the first model and the second model.
[0048] Each module in the above system can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.
[0049] Example 3 A computer device is provided, which may be a terminal. Figure 3 As shown, the computer device also includes a processor, a memory, an input / output interface, a display unit and an input / output device. The processor, the memory and the input / output interface are connected through a system bus, and the display unit and the input / output device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. When the computer program is executed by the processor, the steps of the model security protection method are implemented; and / or the steps of the model use method are implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.
[0050] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0051] Example 4 A computer program product is provided, wherein the computer program product stores instructions, and when the instructions are executed by a computer, the computer implements the steps of the model security protection method as described; and / or the steps of the model use method as described.
[0052] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by controlling the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0053] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0054] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.
Claims
1. A model security protection method, characterized in that: include: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, the pruned nodes and connections of the second model are partially or fully restored, and the weights of the restored connections are set to preset values to obtain a third model for publishing to users; the reasoning accuracy of the third model is lower than a preset threshold.
2. The model security protection method according to claim 1, characterized in that: A model execution file corresponding to the third model is released, wherein the preset values in the third model are protected by cryptographic technology.
3. The model security protection method according to claim 1, characterized in that: The weights of the connections to be restored are set as preset values, including setting the weights of the connections to be restored as one or more preset values, or values having preset characteristics.
4. The model security protection method according to claim 1, characterized in that: The method of partially or completely replenishing the pruned nodes and connections of the second model includes: setting a model replenishment ratio coefficient k, and replenishing the nodes and connections of the first model that are more than the second model according to the calculation graph of the first model and the second model according to the ratio coefficient k, wherein 0 <k≤1。 5. The model security protection method according to claim 1, characterized in that: When partially or completely replenishing the pruned nodes and connections of the second model, the reasoning accuracy of the third model is made lower than a preset threshold by selecting the pruned nodes and connections and selecting the preset weight values set for the pruned connections.
6. A method for using a model, characterized in that: When using the third model obtained by the model security protection method according to any one of claims 1 to 5, a preset value in the third model is detected, and the weight whose value is equal to the preset value is modified to zero.
7. A model safety protection system, characterized in that: Including a model protection unit; the model protection unit includes a model acquisition module, a model pruning module, and a model replenishment module; The model acquisition module is used to acquire the first model; The model pruning module is used to perform model pruning processing on the first model to obtain a second model; The model filling module is used to partially or completely fill in the pruned nodes and connections of the second model according to the calculation graph of the first model, and set the weights of the filled-in connections to preset values to obtain a third model; the reasoning accuracy of the third model is lower than a preset threshold.
8. A model using system, characterized in that: It includes a model using unit, which presets the third model output by the model security protection system described in claim 7, and when using the third model, detects the preset value in the third model and modifies the weight whose value is equal to the preset value to zero.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, it implements the steps of the model security protection method as described in any one of claims 1 to 5; and / or implements the steps of the model use method as described in claim 6.
10. A computer program product, characterized in that The computer program product stores instructions, which, when executed by a computer, enable the computer to implement the steps of the model security protection method according to any one of claims 1 to 5; and / or the steps of the model use method according to claim 6.