A deep neural network (DNN) model training method and framework, electronic device and storage medium compatible with trusted execution environment (TEE)

Abstract

The present disclosure relates to the field of computer technology, and in particular to a deep neural network (DNN) model training method and framework compatible with a trusted execution environment (TEE), an electronic device, and a storage medium, the method comprising: inputting preset training sample image data into a DNN model, the DNN model corresponding to a target calculation graph, the target calculation graph including multiple computing nodes, and hardware execution location information of each computing node, the hardware execution location information of each computing node is used to indicate an NNA or TEE in a heterogeneous hardware platform; by dynamically optimizing the target calculation graph, controlling the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform; after the data processing is completed, obtaining an image processing result output by the DNN model, and adjusting the network parameters of the DNN model according to the image processing result. The disclosed embodiment effectively realizes the compatibility of computing efficiency and data privacy protection during the DNN model training process.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a deep neural network (DNN) model training method and framework, electronic device and storage medium compatible with a trusted execution environment (TEE). Background Art

[0002] At present, deep declarative networks (DNN) are developing towards more complex model architectures and larger model scales. On the one hand, in order to handle the growing computation, various neural network accelerators (NNAs) have been developed, such as advanced graphics processing units (GPUs), neural-network processing units (NPUs), tensor processing units (TPUs), etc., so as to accelerate DNN computations through specialized hardware optimization. On the other hand, since training DNN models requires a large amount of user data, the widespread application of DNNs has raised major security and privacy issues. In the era of artificial intelligence, how to protect data privacy while ensuring computational efficiency during DNN model training has become an urgent need and a key issue. Summary of the invention

[0003] The present invention discloses a technical solution of a deep neural network (DNN) model training method and framework, electronic device and storage medium compatible with a trusted execution environment (TEE).

[0004] According to one aspect of the present disclosure, a deep neural network (DNN) model training method compatible with a trusted execution environment (TEE) is provided, comprising: inputting preset training sample image data into a DNN model, wherein the DNN model corresponds to a target computation graph, the target computation graph includes multiple computing nodes, and hardware execution location information of each computing node, the hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is a neural network accelerator NNA or TEE in a heterogeneous hardware platform; by dynamically optimizing the target computation graph, controlling the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform; after the data processing is completed, obtaining an image processing result output by the DNN model, and adjusting the network parameters of the DNN model according to the image processing result.

[0005] In a possible implementation, the method further includes: parsing the DNN model to construct an initial computational graph of the DNN model, wherein the initial computational graph includes a plurality of computational nodes; for any computational node in the initial computational graph, when the computational node corresponds to a linear operation, determining that the hardware execution location information of the computational node indicates the NNA; for any computational node in the initial computational graph, when the computational node corresponds to a nonlinear operation, determining that the hardware execution location information of the computational node indicates the TEE; and determining the target computational graph based on the plurality of computational nodes included in the initial computational graph and the hardware execution location information of each computational node.

[0006] In a possible implementation, the target computation graph is dynamically optimized to control the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform, including: before executing each computing node that has not been executed in the target computation graph, predicting the running time of each unexecuted computing node; according to the running time of each unexecuted computing node, obtaining the optimized target computation graph by adjusting the execution order of at least one unexecuted computing node in the target computation graph, and / or by fusing at least two adjacent unexecuted computing nodes in the target computation graph, and / or by adjusting the hardware execution location information of at least one unexecuted computing node in the target computation graph; according to the optimized target computation graph, controlling the DNN model to execute each unexecuted computing node on the heterogeneous hardware platform to perform data processing on the preset training sample image data.

[0007] In one possible implementation, the running time of each unexecuted computing node includes: computing time and communication time; according to the running time of each unexecuted computing node, at least two adjacent unexecuted computing nodes in the target computing graph are merged to obtain the optimized target computing graph, including: for the unexecuted computing node A, when the hardware execution location information of the computing node A indicates the NNA, and the computing time of the computing node A is lower than the communication time, and the hardware execution location information of the unexecuted computing node B adjacent to the computing node A indicates the TEE, the computing node A and the computing node B are merged to obtain the unexecuted computing node C, and it is determined that the hardware execution location information of the computing node C indicates the TEE, wherein A, B, and C represent different computing node identifiers.

[0008] In a possible implementation, according to the optimized target computation graph, the DNN model is controlled to execute each unexecuted computing node on the heterogeneous hardware platform to perform data processing on the preset training sample image data, including: for the unexecuted computing node D, when it is determined according to the optimized target computation graph that the hardware execution location information of the computing node D indicates the NNA, based on a preset encryption algorithm, the initial input data of the computing node D is encrypted in the TEE to obtain the target encrypted input data and target decryption key of the computing node D, wherein D represents the computing node identifier, and the initial input data of the computing node D is the preset training sample image data or the intermediate feature map data in the process of the DNN model performing data processing on the preset training sample image data; the target decryption key of the computing node D is stored in the TEE, and the target encrypted input data of the computing node D is transmitted from the TEE to the NNA by using a preset data transmission method between the NNA and the TEE; and the computing operation corresponding to the computing node D is performed on the target encrypted input data of the computing node D by using the NNA to obtain the encrypted output data of the computing node D.

[0009] In a possible implementation, the initial input data of the computing node D is encrypted in the TEE based on a preset encryption algorithm to obtain the target encrypted input data and the target decryption key of the computing node D, including: determining p Gaussian noises, a linear scaling key and p noise keys according to the initial input data of the computing node D, where p is a positive integer; determining p groups of target noises based on the p Gaussian noises and the p noise keys; linearly scaling the initial input data of the computing node D using the linear scaling key to obtain scaled input data; performing noise superposition on the scaled input data and the p groups of target noises to obtain initial encrypted input data; performing data splicing on the initial encrypted input data and the p groups of target noises to obtain the target encrypted input data of the computing node D; determining the linear scaling key as the target decryption key of the computing node D, and storing the target decryption key of the computing node D in the TEE.

[0010] In one possible implementation, the method further includes: determining whether there is data overflow in the target encrypted input data of the computing node D; when there is data overflow in the target encrypted input data of the computing node D, re-encrypting the initial input data of the computing node D until there is no data overflow in the target encrypted input data of the computing node D.

[0011] In a possible implementation, the method also includes: when it is determined according to the optimized target computing graph that the hardware execution location information of the unexecuted computing node E adjacent to the computing node D indicates the TEE, using the preset data transmission method to transmit the encrypted output data of the computing node D from the NNA to the TEE, wherein E represents the computing node identifier; in the TEE, using the target decryption key of the computing node D to decrypt the encrypted output data of the computing node D to obtain the input data of the computing node E; using the TEE, performing the computing operation corresponding to the computing node E on the input data of the computing node E to obtain the output data of the computing node E.

[0012] In a possible implementation, the preset data transmission method specifically includes: according to a preset block size parameter, the data to be transmitted between the TEE and the NNA is divided into blocks to obtain multiple data blocks; the multiple data blocks are added to a preset buffer queue in sequence; based on the preset buffer queue, data is transmitted between the TEE and the NNA.

[0013] In a possible implementation manner, the method further includes: adjusting the preset block size parameter according to actual operating states of the TEE and the NNA.

[0014] According to one aspect of the present disclosure, a TEE-compatible DNN model training framework is provided, including: an input module, used to input preset training sample image data into a DNN model, wherein the DNN model corresponds to a target computation graph, the target computation graph includes multiple computing nodes, and hardware execution location information of each computing node, the hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform; a dynamic compiler, used to control the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform by dynamically optimizing the target computation graph; a training module, used to obtain an image processing result output by the DNN model after the data processing is completed, and adjust the network parameters of the DNN model according to the image processing result.

[0015] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0016] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the above method is implemented.

[0017] In the TEE-compatible DNN model training method provided in the embodiment of the present disclosure, preset training sample image data is input into the DNN model, and the DNN model corresponds to a target computation graph, which includes multiple computing nodes and hardware execution location information of each computing node. The hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform. Based on the target computation graph, the compatibility of NNA and TEE in the DNN model training process can be effectively achieved; during the training process, by dynamically optimizing the target computation graph, the DNN model is controlled to perform data processing on the preset training sample image data on the heterogeneous hardware platform, which can effectively achieve the compatibility of computing efficiency and data privacy protection in the DNN model training process; after the data processing is completed, the image processing result output by the DNN model is obtained, and according to the image processing result, the network parameters of the DNN model are adjusted, thereby effectively achieving the training of the DNN model.

[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only and do not limit the present disclosure. Other features and aspects of the present disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used to illustrate the technical solutions of the present disclosure together with the specification.

[0020] Figure 1 A flowchart of a TEE-compatible DNN model training method according to an embodiment of the present disclosure is shown.

[0021] Figure 2 A block diagram of a TEE-compatible DNN model training framework according to an embodiment of the present disclosure is shown.

[0022] Figure 3 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0023] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0024] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0025] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0026] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0027] At present, mainstream data protection technologies include: Homomorphic Encryption (HE), Multi-party Computation (MPC), Trusted Execution Environment (TEE), etc.

[0028] HE allows arithmetic operations to be performed directly on encrypted data without first decrypting the data, thus protecting the privacy of the data. However, since arithmetic operations (e.g., addition, multiplication, etc.) on encrypted data are much more computationally intensive than the same operations on plaintext data, especially in large-scale data processing tasks such as DNN model training, HE suffers from high computational overhead, high communication overhead, and noise accumulation in actual DNN model training applications. Moreover, in distributed systems, HE requires frequent exchange of encrypted data and computational results, resulting in higher communication overhead.

[0029] MPC is an encrypted computing technology that allows multiple parties to jointly calculate the result of a function without exposing their private inputs, thereby protecting data privacy. However, the core mechanism of MPC is to protect data privacy through distributed protocols. Participants cannot directly access the data of other parties during the calculation process, so a large amount of data exchange is required to share encrypted intermediate results and part of the calculation information. Therefore, MPC also has problems of high communication overhead and high calculation delay in practical applications. Especially in tasks that require a lot of calculations and data processing, such as large-scale DNN model training, this frequent communication will significantly increase the system's latency and resource consumption. Moreover, in order to ensure data privacy and the correctness of calculations, MPC usually requires multiple rounds of interaction. In each round of interaction, the participants need to exchange intermediate results and wait for all participants to complete their respective calculations. This multi-round interaction mode will increase the delay of the entire calculation process, especially when the network communication is slow or the participants are widely distributed.

[0030] TEE provides an isolated computing environment to protect the privacy of data and computing processes. However, most current TEEs (e.g., Intel's SGX) are mainly supported by CPU manufacturers, that is, to create an isolated computing area on the CPU. However, as NNAs (e.g., GPUs, TPUs, and NPUs, etc.) become the mainstream computing units for DNN model training, TEE lacks native support on these hardware. Although some studies have attempted to extend TEE to hardware such as GPUs through software isolation technology, due to the differences in architecture and computing modes of heterogeneous hardware, the computing and resource efficiency of TEE when processing complex and highly parallel DNN model training tasks is still unsatisfactory. Without support for NNA, the computing throughput of TEE to perform DNN model training tasks faces a significant bottleneck, limiting its practical application in large-scale deep learning tasks. Therefore, although TEE provides strong privacy protection capabilities, its incompatibility on heterogeneous hardware (especially NNA) limits its application scope and performance.

[0031] In order to consider both computational efficiency and data privacy protection during DNN model training, the present disclosure provides a TEE-compatible DNN model training method. The following is a detailed description of the TEE-compatible DNN model training method provided by the present disclosure.

[0032] Figure 1A flowchart of a TEE-compatible DNN model training method according to an embodiment of the present disclosure is shown. The method can be executed by an electronic device such as a terminal device or a server. The terminal device can be a user equipment (UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. The method can be implemented by a processor calling a computer-readable instruction stored in a memory. Alternatively, the method can be executed by a server. Figure 1 As shown, the method includes:

[0033] In step S11, the preset training sample image data is input into the DNN model, wherein the DNN model corresponds to a target computation graph, the target computation graph includes multiple computing nodes and hardware execution location information of each computing node, and the hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is NNA or TEE in a heterogeneous hardware platform.

[0034] In an iterative training process of the DNN model, first, the preset training sample image data is input into the DNN model. The preset training sample image data is sample data used to train the DNN model. These sample data can be collected in actual scenes, such as vehicle images obtained in autonomous driving scenes, medical images obtained in medical scenes, etc. These sample data may involve user privacy. In the process of training the DNN model based on these sample data, the issue of data privacy protection needs to be considered.

[0035] A computational graph is a graph structure used to represent mathematical calculations. It is particularly important in the implementation of deep learning and neural networks. A computational graph can intuitively describe complex computational processes. By representing the computational process as a graph structure, computational optimization and model debugging can be performed more efficiently.

[0036] In one example, an embodiment of the present disclosure provides a dynamic compiler, which uses the automatic compilation process of the dynamic compiler to convert the DNN model to be trained into a target computational graph that is compatible with untrusted hardware NNA and trusted hardware TEE in heterogeneous hardware platforms. This can achieve compatibility with computing efficiency and data privacy protection during DNN model training, and has heterogeneous affinity.

[0037] Untrusted hardware NNA and trusted hardware TEE are hardware in heterogeneous hardware platforms, and their specific forms can be flexibly set according to actual scenarios. For example, untrusted hardware NNA includes: GPU, NPU, TPU, etc., and trusted hardware includes: TEE on CPU, etc. This disclosure does not make specific limitations on this.

[0038] In a possible implementation, the method also includes: parsing the DNN model to construct an initial computational graph of the DNN model, wherein the initial computational graph includes multiple computational nodes; for any computational node in the initial computational graph, when the computational node corresponds to a linear operation, determining that the hardware execution location information of the computational node indicates NNA; for any computational node in the initial computational graph, when the computational node corresponds to a nonlinear operation, determining that the hardware execution location information of the computational node indicates the TEE; and determining a target computational graph based on the multiple computational nodes included in the initial computational graph and the hardware execution location information of each computational node.

[0039] The dynamic compiler is used to parse the DNN model and construct the initial computational graph of the DNN model. The initial computational graph includes multiple computational nodes, each of which represents a computational operation (for example, convolution, matrix multiplication, activation function, etc.), and the directed edges between computational nodes represent the data dependency between the computational nodes.

[0040] The dynamic compiler is used to traverse each computing node in the initial computing graph to perform model conversion. The dynamic compiler can determine the hardware execution location information of each computing node based on the characteristics of each computing node. For example, the dynamic compiler assigns the computing nodes corresponding to linear operations (such as convolution, full connection, etc.) to NNA for execution, and the computing nodes corresponding to nonlinear operations (such as maximum pooling (Maxpool), activation function (ReLU), etc.) to TEE for execution through the method of tensor decomposition.

[0041] For example, the dynamic compiler determines the data identifier for each input data involved in the model training process (preset training sample image data or intermediate feature map data in the process of the DNN model performing data processing on the preset training sample image data), and the data identifier includes a linear identifier for indicating participation in linear operations and a nonlinear identifier for indicating participation in nonlinear operations. For input data carrying linear identifiers, the corresponding linear operations can be performed on the computing nodes assigned to the NNA; for input data carrying nonlinear identifiers, the corresponding nonlinear operations can be performed on the computing nodes assigned to the TEE.

[0042] In addition, the dynamic compiler will also replace operators that do not support privacy protection with operators that support privacy protection. For example, for linear operations corresponding to computing nodes assigned to untrusted hardware NNAs, privacy protection is supported by introducing additional encryption steps. The encryption process will be described in detail later in conjunction with possible implementations of the present disclosure, and will not be repeated here.

[0043] After the hardware execution location information of each computing node in the initial computing graph is determined according to the above method, the target computing graph can be determined according to the multiple computing nodes included in the initial computing graph and the hardware execution location information of each computing node.

[0044] In step S12, by dynamically optimizing the target computation graph, the DNN model is controlled to perform data processing on the preset training sample image data on the heterogeneous hardware platform.

[0045] During the DNN model training process, a dynamic compiler is used to dynamically optimize the target computational graph and control the DNN model to perform data processing on the preset training sample image data on the untrusted hardware NNA and trusted hardware TEE of the heterogeneous hardware platform, effectively achieving the compatibility of computing efficiency and data privacy protection during the DNN model training process.

[0046] The process of dynamically optimizing the target calculation graph will be described in detail later in conjunction with possible implementations of the present disclosure, and no specific limitation is made here.

[0047] In step S13, after the data processing is completed, the image processing result output by the DNN model is obtained, and the network parameters of the DNN model are adjusted according to the image processing result.

[0048] After the data processing is completed, the image processing results output by the DNN model are obtained. Then, according to the image processing results, the network parameters of the DNN model are adjusted to end this iterative training.

[0049] During multiple iterative training processes of the DNN model, the above steps S11 to S13 can be repeatedly performed in each iterative training until the preset iteration conditions are met, and finally a trained DNN model is obtained.

[0050] In the TEE-compatible DNN model training method provided in the embodiment of the present disclosure, preset training sample image data is input into the DNN model, and the DNN model corresponds to a target computation graph, which includes multiple computing nodes and hardware execution location information of each computing node. The hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform. Based on the target computation graph, the compatibility of NNA and TEE in the DNN model training process can be effectively achieved; during the training process, by dynamically optimizing the target computation graph, the DNN model is controlled to perform data processing on the preset training sample image data on the heterogeneous hardware platform, which can effectively achieve the compatibility of computing efficiency and data privacy protection in the DNN model training process; after the data processing is completed, the image processing result output by the DNN model is obtained, and according to the image processing result, the network parameters of the DNN model are adjusted, thereby effectively achieving the training of the DNN model.

[0051] In one possible implementation, a target computation graph is dynamically optimized to control a DNN model to perform data processing on preset training sample image data on a heterogeneous hardware platform, including: before executing each computation node that has not been executed in the target computation graph, predicting the running time of each unexecuted computation node; according to the running time of each unexecuted computation node, obtaining an optimized target computation graph by adjusting the execution order of at least one unexecuted computation node in the target computation graph, and / or by fusing at least two adjacent unexecuted computation nodes in the target computation graph, and / or by adjusting the hardware execution location information of at least one unexecuted computation node in the target computation graph; according to the optimized target computation graph, controlling the DNN model to execute each unexecuted computation node on the heterogeneous hardware platform to perform data processing on the preset training sample image data.

[0052] Since the current computing environment will change relative to the previous one after each computing node in the target computing graph completes the calculation, the dynamic compiler updates the target computing graph after executing any computing node in the target computing graph and before executing the next calculation.

[0053] In one example, the dynamic compiler traverses each unexecuted computing node in the target computing graph to find adjacent computing nodes that can be fused. Then, based on the data dependency between adjacent computing nodes, and / or the computing characteristics of the computing nodes, and / or the current computing environment (e.g., hardware load, data size, etc.), it decides whether to fuse adjacent computing nodes.

[0054] The fusion of computing nodes can merge multiple computing operations into a new computing operation to reduce the number of computing nodes in the target computing graph, and enable multiple computing operations to be executed at one time on the same hardware, reducing the need for intermediate data storage and transmission, improving computing efficiency, and reducing data dependencies between computing nodes.

[0055] Specifically, an embodiment of the present disclosure provides a runtime predictor for dynamically predicting the runtime of each computing node in a target computing graph. The runtime predictor may be a multilayer perceptron (MLP) trained based on offline data collected in a preset time period, or may be a predictor of other structures, which is not specifically limited in the present disclosure.

[0056] By using the runtime predictor, the runtime of each unexecuted computing node in the target computing graph can be predicted. Then, based on the runtime of each unexecuted computing node, at least two unexecuted adjacent computing nodes in the target computing graph are fused to obtain an optimized target computing graph.

[0057] In one possible implementation, the running time of each unexecuted computing node includes: computing time and communication time; according to the running time of each unexecuted computing node, at least two adjacent unexecuted computing nodes in the target computing graph are merged to obtain an optimized target computing graph, including: for the unexecuted computing node A, when the hardware execution location information of the computing node A indicates NNA, and the computing time of the computing node A is lower than the communication time, and the hardware execution location information of the unexecuted computing node B adjacent to the computing node A indicates TEE, the computing node A and the computing node B are merged to obtain the unexecuted computing node C, and it is determined that the hardware execution location information of the computing node C indicates TEE, wherein A, B, and C represent different computing node identifiers.

[0058] The priority of the dynamic compiler to dynamically update the target computation graph is to reduce the number of data transmissions between the untrusted hardware NNA and the trusted hardware TEE to reduce high communication overhead and strike a balance between computing performance and privacy protection. Therefore, the runtime of each unexecuted computing node predicted by the runtime predictor includes: computing time and communication time.

[0059] For any unexecuted computing node A in the target computing graph, the hardware execution location information of computing node A indicates untrusted hardware NNA, and the computing time of computing node A is lower than the communication time, indicating that the hardware acceleration efficiency of executing computing node A on NNA cannot balance the high communication overhead after executing computing node A on NNA.

[0060] At this time, if the hardware execution location information of the unexecuted computing node B adjacent to computing node A indicates a trusted hardware TEE, computing node A and computing node B can be merged to obtain the unexecuted computing node C, and it is determined that the hardware execution location information of computing node C indicates a trusted hardware TEE.

[0061] That is to say, the computing operations of computing node A and computing node B are merged into a new fused computing operation on computing node C, and the fused computing operation of computing node C is instructed to be executed on the trusted hardware TEE. This can not only ensure data privacy protection, but also reduce the number of computing nodes and the storage and transmission requirements of intermediate data, thereby effectively improving computing efficiency.

[0062] In one example, the dynamic compiler traverses each unexecuted computing node in the target computing graph, searches for computing nodes whose execution order can be adjusted, and decides whether to adjust the execution order of the computing nodes based on the current hardware load and / or task characteristics.

[0063] For example, the dynamic compiler can comprehensively consider the hardware load in the current heterogeneous hardware platform based on the running time of each unexecuted computing node and the data dependencies between each unexecuted computing node, and adjust the execution order of the computing nodes by marking the computing nodes that can be executed lazily or asynchronously in the target computing graph, thereby making full use of the hardware resources in the heterogeneous hardware platform and achieving load balancing.

[0064] In one example, the dynamic compiler traverses each unexecuted computing node in the target computing graph to find out whether there is a computing node that needs to perform hardware migration.

[0065] The dynamic compiler dynamically adjusts the hardware execution location of the computing nodes according to the running time, computing characteristics, privacy protection requirements and current hardware performance characteristics of each unexecuted computing node to optimize the overall computing efficiency and data privacy protection. For example, migrate computing-intensive nodes from TEE to NNA to improve computing efficiency.

[0066] When the dynamic compiler determines to migrate a computing node from one hardware to another, the hardware migration is achieved by adjusting the hardware execution location information of the computing node in the target computing graph.

[0067] In one example, the number of times a computing node performs hardware migration is not limited to once. According to the actual operation scenario, multiple hardware migrations can be flexibly performed, and the present disclosure does not make specific limitations on this.

[0068] In one example, the dynamic compiler also detects possible errors or performance bottlenecks. If the computing performance of a computing node after hardware migration is not as expected, the dynamic compiler performs a rollback operation, migrates the computing node back to the original hardware, and re-updates the target computing graph.

[0069] In one example, the target computation graph after each optimization is saved as an execution plan and used to guide the computation process of DNN model training during actual execution.

[0070] In one example, after optimizing the target computation graph, data needs to be transmitted between the untrusted hardware NNA and the trusted hardware TEE to meet the hardware migration requirements of the computing nodes, such as transmitting tensor data.

[0071] The disclosed embodiment provides a preset data transmission method between an untrusted hardware NNA and a trusted hardware TEE to improve the execution efficiency of the entire system.

[0072] In a possible implementation, the preset data transmission method specifically includes: according to a preset block size parameter, the data to be transmitted between the TEE and the NNA is divided into blocks to obtain multiple data blocks; the multiple data blocks are added to a preset buffer queue in sequence; and based on the preset buffer queue, data is transmitted between the TEE and the NNA.

[0073] When data needs to be transmitted between NNA and TEE, the data to be transmitted is first divided into blocks according to a preset block size parameter to obtain multiple data blocks to be transmitted.

[0074] In a possible implementation, the method further includes: adjusting a preset block size parameter according to actual operating states of the TEE and the NNA.

[0075] According to the actual operating status of TEE and NNA, such as network bandwidth, memory size, etc., the preset block size parameters are dynamically adjusted to adjust the data block size to achieve optimal transmission efficiency.

[0076] Add multiple data blocks that need to be transmitted to the preset buffer queue, where the preset buffer queue is a first-in-first-out data structure used to temporarily store data blocks waiting to be transmitted. When transmitting data between NNA and TEE, the preset buffer queue can realize asynchronous processing, that is, NNA or TEE can immediately add a new data block to the preset buffer queue when generating a new data block, without having to wait for the transmission of the previous data block to be completed. When TEE or NNA is ready to receive data, a data block will be taken out of the preset buffer queue for processing. The preset buffer queue effectively realizes the pipeline communication between NNA and TEE and reduces the waiting time. During the data transmission process, the preset buffer queue can balance the computing speed and transmission speed between TEE and NAA, making data transmission smoother and avoiding data congestion or transmission stagnation.

[0077] The size of the preset buffer queue and the size of the data block can be adjusted dynamically to adapt to different computing tasks and system states. For example, when the TEE's computing speed is detected to be faster, the size of the data block can be increased to improve data transmission efficiency; when the computing task becomes more complex, the size of the data block can be reduced to reduce transmission delay.

[0078] The preset buffer queue allows data transmission and calculation to be performed in parallel. For example, when TEE is processing the previous data block, NNA can simultaneously calculate the next data block, thereby achieving pipeline calculation and improving the execution efficiency of the overall system. Through the pipeline mechanism, the time between data transmission and calculation overlaps, reducing idle time and improving resource utilization.

[0079] In a possible implementation, according to the optimized target computation graph, the DNN model is controlled to execute each unexecuted computing node on a heterogeneous hardware platform to perform data processing on preset training sample image data, including: for the unexecuted computing node D, when it is determined according to the optimized target computation graph that the hardware execution location information of the computing node D indicates NNA, based on the preset encryption algorithm, the initial input data of the computing node D is encrypted in the TEE to obtain the target encrypted input data and the target decryption key of the computing node D, wherein D represents the computing node identifier, and the initial input data of the computing node D is the preset training sample image data or the intermediate feature map data in the process of the DNN model performing data processing on the preset training sample image data; the target decryption key of the computing node D is stored in the TEE, and the target encrypted input data of the computing node D is transmitted from the TEE to the NNA by using the preset data transmission method between the NNA and the TEE; and the computing operation corresponding to the computing node D is performed on the target encrypted input data of the computing node D by using the NNA to obtain the encrypted output data of the computing node D.

[0080] For linear operations corresponding to computing nodes assigned to untrusted hardware NNAs, privacy protection is supported by introducing additional encryption steps.

[0081] For the computing node D that needs to be executed currently, when it is determined according to the optimized target computing graph that the hardware execution location information of the computing node D indicates the untrusted hardware NNA, it is necessary to encrypt the initial input data of the computing node D by introducing an additional encryption step. The initial input data of the computing node D refers to the unencrypted data to be processed corresponding to the computing operation of the computing node D.

[0082] For example, the computing operation that computing node D needs to perform is Y=X×W. Among them, X is the initial input data of computing node D, which is the unencrypted data to be processed that needs to consider privacy protection, for example, it can be the preset training sample image data, or it can be the intermediate feature map data in the process of the DNN model performing data processing on the preset training sample image data; W is the model parameter of computing node D, for example, it can be a convolution kernel; Y is the calculation result after performing the calculation operation on the unencrypted initial input data X.

[0083] In order to ensure the privacy protection of the initial input data X, before executing the computing operation of the computing node D on the untrusted hardware NNA, the initial input data X is input into the trusted hardware TEE, so that the initial input data X is encrypted in the trusted hardware TEE to ensure the data privacy of the initial input data X.

[0084] An embodiment of the present disclosure provides an adaptive noise generator, which is used in TEE to encrypt initial input data X of computing node D based on a preset encryption algorithm to obtain target encrypted input data of computing node D and a target decryption key.

[0085] In a possible implementation, based on a preset encryption algorithm, the initial input data of the computing node D is encrypted in the TEE to obtain the target encrypted input data and the target decryption key of the computing node D, including: determining p Gaussian noises, a linear scaling key and p noise keys according to the initial input data of the computing node D, where p is a positive integer; determining p groups of target noises based on the p Gaussian noises and the p noise keys; linearly scaling the initial input data of the computing node D using the linear scaling key to obtain scaled input data; performing noise superposition on the scaled input data and the p groups of target noises to obtain the initial encrypted input data; performing data splicing on the initial encrypted input data and the p groups of target noises to obtain the target encrypted input data of the computing node D; determining the linear scaling key as the target decryption key of the computing node D, and storing the target decryption key of the computing node D in the TEE.

[0086] According to the value of each element in the initial input data X of the computing node D, the mean μ and the standard deviation σ are determined. Based on the mean μ and the standard deviation σ, p Gaussian noises are generated: n1 to n p , each Gaussian noise follows a normal distribution N(μ,σ 2 ). The larger the value of p, the higher the computational complexity of decryption through brute force attack, and the more secure the encrypted data. For example, when p is 35, the computational complexity of decryption through brute force attack can reach 2 128 , fully ensuring data privacy issues. Therefore, the specific value of p can be flexibly set according to the anti-brute force attack requirements of the actual application scenario, and this disclosure does not make specific limitations on this.

[0087] In addition, a linear scaling key k0 and p noise keys need to be determined: k1 to k p , used to encrypt the initial input data X of computing node D.

[0088] In one example, the p+1 keys (k0 to k1) can be randomly generated by using polynomial calculation and linear congruential method. p ). This method consists of two stages: polynomial calculation and linear congruential processing. Design a polynomial function f(x) = ax + bx 2 +c, where a, b, and c are random integers sampled from a uniform distribution based on a random seed S. For each i from 1 to N, calculate x i=f(i), where i=0, 1, 2, 3, ..., p. Using three known prime numbers w, q, and r, calculate m=w×q×r. Then, calculate the key k i =(x i ×S) mod m, where S is a known number. The specific values ​​of w, q, r, and S can be flexibly set according to the actual application scenario, and the present disclosure does not make specific restrictions on this.

[0089] On the one hand, the initial input data X of the computing node D is linearly scaled using the linear scaling key k0 to obtain the scaled input data k0×X. On the one hand, based on p Gaussian noises: n1 to n p and p noise keys: k1 to k p , determine p groups of target noise: k1×n1, k2×n2, …, k p ×n p Then, the scaled input data and p groups of target noise are superimposed to obtain the initial encrypted input data X'=k0×X+k1×n1+k2×n2+……+k p ×n p Finally, the initial encrypted input data and p groups of target noise are concatenated to obtain the target encrypted input data X''=Concat[X', k1×n1, k2×n2, ..., k p ×n p ].

[0090] Using the preset data transmission method between the above-mentioned NNA and TEE, the target encrypted input data X'' of computing node D is transmitted from TEE to NNA, so that the computing operation corresponding to computing node D is performed on the target encrypted input data X'' of computing node D on NNA to obtain the encrypted output data Y'' of computing node D.

[0091] And, the linear scaling key k0 is determined as the target decryption key of the computing node D, and the target decryption key of the computing node D is stored in the trusted hardware TEE to ensure data privacy.

[0092] In one possible implementation, the method also includes: determining whether there is data overflow in the target encrypted input data of computing node D; when there is data overflow in the target encrypted input data of computing node D, re-encrypting the initial input data of computing node D until there is no data overflow in the target encrypted input data of computing node D.

[0093] In actual application scenarios, multiple untrusted hardware NNAs, such as GPU1, GPU2, GPU3, etc., can be used to perform computing operations of computing node D in parallel. Considering the hardware characteristics of each untrusted hardware NNA, before transmitting the target encrypted input data X'' of computing node D from TEE to each NNA, it is determined whether the target encrypted input data X'' of computing node D has data overflow according to the hardware characteristics of each untrusted hardware NNA.

[0094] In one example, for GPU1, when it is determined that there is no data overflow when the target encrypted input data X″ of computing node D is transmitted to GPU1, the target encrypted input data X″ of computing node D is directly transmitted to GPU1.

[0095] In one example, for GPU2, when it is determined that the target encrypted input data X'' of computing node D is transmitted to GPU2 and there is data overflow, based on the above encryption method, Gaussian noise is regenerated, and then the initial input data X of computing node D is re-encrypted, and the target encrypted input data X'' of computing node D is updated until it is determined that the target encrypted input data X'' of computing node D is transmitted to GPU2 and there is no data overflow. The specific encryption process can be referred to the above detailed description, which will not be repeated here.

[0096] In a possible implementation, the method also includes: when it is determined according to the optimized target computation graph that the hardware execution location information of the unexecuted computing node E adjacent to the computing node D indicates the TEE, using a preset data transmission method, transmitting the encrypted output data of the computing node D from the NNA to the TEE, where E represents the computing node identifier; in the TEE, using the target decryption key of the computing node D to decrypt the encrypted output data of the computing node D to obtain the input data of the computing node E; using the TEE, performing the computing operation corresponding to the computing node E on the input data of the computing node E to obtain the output data of the computing node E.

[0097] After performing the computing operation corresponding to computing node D on the target encrypted input data X'' of computing node D on NNA to obtain the encrypted output data Y'' of computing node D, if the hardware execution location information of the next computing node E to be executed adjacent to computing node D is determined according to the optimized target computing graph, indicating the trusted hardware TEE, at this time, the encrypted output data Y'' of computing node D is transmitted from NNA to TEE using the preset data transmission method between NNA and TEE.

[0098] The encrypted output data Y'' of the computing node D includes the first output data Y''1=X'×W=(k0×X+K e )×W=k0×X×W+K e×W, and also includes the second output data Y''2=K e ×W, where K e =k1×n1+k2×n2+……+k p ×n p .

[0099] In order to obtain the correct calculation result Y, a decryption operation is performed in the TEE. First, the first output data Y''1 is subtracted from the second output data Y''2 to obtain the initial decryption result Y'=k0×X×W; then, the initial decryption result Y' is scaled using the target decryption key k0 to obtain the correct calculation result Y=Y' / k0=X×W.

[0100] Finally, the correct calculation result Y after decryption is used as the input data of the computing node E, and the TEE is used to perform the calculation operation corresponding to the computing node E on the input data of the computing node E to obtain the output data of the computing node E. Since TEE is trusted hardware, all computing operations performed on TEE can ensure data privacy without adding additional encryption steps.

[0101] After executing all the computing nodes in the target computing graph, the current round of DNN model training is completed, and the image processing result output by the DNN model is obtained. Then, according to the image processing result, the network parameters of the DNN model are adjusted. The network parameter adjustment process can be performed according to the relevant model training process or preset conditions, and the present disclosure does not make specific limitations on this.

[0102] In the TEE-compatible DNN model training method provided in the embodiment of the present disclosure, preset training sample image data is input into the DNN model, and the DNN model corresponds to a target computation graph, which includes multiple computing nodes and hardware execution location information of each computing node. The hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform. Based on the target computation graph, the compatibility of NNA and TEE in the DNN model training process can be effectively achieved; during the training process, by dynamically optimizing the target computation graph, the DNN model is controlled to perform data processing on the preset training sample image data on the heterogeneous hardware platform, which can effectively achieve the compatibility of computing efficiency and data privacy protection in the DNN model training process; after the data processing is completed, the image processing result output by the DNN model is obtained, and according to the image processing result, the network parameters of the DNN model are adjusted, thereby effectively achieving the training of the DNN model.

[0103] It can be understood that the above-mentioned various method embodiments mentioned in the present disclosure can be combined with each other to form a combined embodiment without violating the principle logic. Due to space limitations, the present disclosure will not repeat them. It can be understood by those skilled in the art that in the above-mentioned method of the specific implementation method, the specific execution order of each step should be determined according to its function and possible internal logic.

[0104] In addition, the present disclosure also provides a TEE-compatible DNN model training framework, an electronic device, a computer-readable storage medium, and a program, all of which can be used to implement any TEE-compatible DNN model training method provided by the present disclosure. The corresponding technical solutions and descriptions are referred to the corresponding records in the method part and will not be repeated here.

[0105] Figure 2 A block diagram of a TEE-compatible DNN model training framework according to an embodiment of the present disclosure is shown. Figure 2 As shown, the TEE-compatible DNN model training framework 20 includes:

[0106] An input module 21 is used to input preset training sample image data into a DNN model, wherein the DNN model corresponds to a target computing graph, the target computing graph includes multiple computing nodes, and hardware execution location information of each computing node, and the hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform;

[0107] A dynamic compiler 22, used to control the DNN model to perform data processing on preset training sample image data on a heterogeneous hardware platform by dynamically optimizing a target computation graph;

[0108] The training module 23 is used to obtain the image processing results output by the DNN model after the data processing is completed, and to adjust the network parameters of the DNN model according to the image processing results.

[0109] For the specific training process of the DNN model compatible with TEE 20, please refer to the above Figure 1 The relevant description of the method embodiment is not repeated here.

[0110] This method has a specific technical connection with the internal structure of the computer system, and can solve the technical problem of how to improve the hardware computing efficiency or execution effect (including reducing the amount of data storage, reducing the amount of data transmission, increasing the hardware processing speed, etc.), thereby obtaining the technical effect of improving the internal performance of the computer system in accordance with the laws of nature.

[0111] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0112] The embodiment of the present disclosure also provides a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor. The computer-readable storage medium can be a volatile or non-volatile computer-readable storage medium.

[0113] An embodiment of the present disclosure further proposes an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to call the instructions stored in the memory to execute the above method.

[0114] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0115] The electronic device may be provided as a terminal, a server, or a device in other forms.

[0116] Figure 3 A block diagram of an electronic device according to an embodiment of the present disclosure is shown. Figure 3 , the electronic device 1900 can be provided as a server or a terminal device. Figure 3 , the electronic device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions executable by the processing component 1922, such as an application. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0117] The electronic device 1900 may also include a power supply component 1926 configured to perform power management of the electronic device 1900, a wired or wireless network interface 1950 configured to connect the electronic device 1900 to a network, and an input / output interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932, such as a Microsoft Server operating system (Windows Server 2003). TM ), a graphical user interface operating system launched by Apple (Mac OS X TM ), a multi-user, multi-process computer operating system (Unix TM), a free and open source Unix-like operating system (Linux TM ), an open source Unix-like operating system (FreeBSD TM ) or similar.

[0118] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the electronic device 1900 to perform the above method.

[0119] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0120] Computer-readable storage media can be a tangible device that can hold and store instructions used by an instruction execution device. Computer-readable storage media can be, for example, (but not limited to) an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive lists) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer-readable storage media used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0121] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0122] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect through the Internet). In some embodiments, by using the state information of the computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit may execute the computer-readable program instructions, thereby implementing various aspects of the present disclosure.

[0123] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0124] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0125] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0126] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0127] The computer program product may be implemented in hardware, software or a combination thereof. In one optional embodiment, the computer program product is embodied as a computer storage medium, and in another optional embodiment, the computer program product is embodied as a software product, such as a software development kit (SDK) and the like.

[0128] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0129] Those skilled in the art will appreciate that, in the above method of specific implementation, the order in which the steps are written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of the steps should be determined by their functions and possible internal logic.

[0130] If the technical solution of this application involves personal information, the product using the technical solution of this application has clearly informed the personal information processing rules and obtained the individual's voluntary consent before processing the personal information. If the technical solution of this application involves sensitive personal information, the product using the technical solution of this application has obtained the individual's separate consent before processing the sensitive personal information, and at the same time meets the "explicit consent" requirement. For example, on personal information collection devices such as cameras, clear and prominent signs are set to inform that the personal information collection scope has been entered and personal information will be collected. If the individual voluntarily enters the collection scope, it is deemed that he or she agrees to the collection of his or her personal information; or on the device that processes personal information, the personal information processing rules are notified by obvious signs / information, and the individual's authorization is obtained through pop-up information or by asking the individual to upload his or her personal information; among them, the personal information processing rules may include information such as the personal information processor, the purpose of personal information processing, the processing method, and the type of personal information processed.

[0131] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A deep neural network (DNN) model training method compatible with a trusted execution environment (TEE), characterized in that: include: Inputting preset training sample image data into a DNN model, wherein the DNN model corresponds to a target computation graph, the target computation graph includes a plurality of computation nodes and hardware execution location information of each computation node, the hardware execution location information of each computation node is used to indicate that the hardware execution location of the computation node is a neural network accelerator NNA or TEE in a heterogeneous hardware platform, and each computation node represents a computation operation; By dynamically optimizing the target computation graph, controlling the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform; After the data processing is completed, the image processing result output by the DNN model is obtained, and the network parameters of the DNN model are adjusted according to the image processing result.

2. The method according to claim 1, characterized in that The method further comprises: Parsing the DNN model to construct an initial computational graph of the DNN model, wherein the initial computational graph includes a plurality of computational nodes; For any computing node in the initial computing graph, when the computing node corresponds to a linear operation, determining that the hardware execution location information of the computing node indicates the NNA; For any computing node in the initial computing graph, when the computing node corresponds to a nonlinear operation, determining that the hardware execution location information of the computing node indicates the TEE; The target computation graph is determined according to the plurality of computation nodes included in the initial computation graph and hardware execution location information of each computation node.

3. The method according to claim 1, characterized in that The dynamically optimizing the target computation graph and controlling the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform include: Before executing each unexecuted computing node in the target computing graph, predicting the running time of each unexecuted computing node; According to the running time of each unexecuted computing node, by adjusting the execution order of at least one unexecuted computing node in the target computing graph, and / or by fusing at least two unexecuted adjacent computing nodes in the target computing graph, and / or by adjusting the hardware execution position information of at least one unexecuted computing node in the target computing graph, the optimized target computing graph is obtained; According to the optimized target computation graph, the DNN model is controlled to execute each unexecuted computation node on the heterogeneous hardware platform to perform data processing on the preset training sample image data.

4. The method according to claim 3, characterized in that The running time of each unexecuted computing node includes: computing time and communication time; According to the running time of each unexecuted computing node, at least two unexecuted adjacent computing nodes in the target computing graph are merged to obtain the optimized target computing graph, including: For the unexecuted computing node A, when the hardware execution location information of the computing node A indicates the NNA, and the computing time of the computing node A is lower than the communication time, and the hardware execution location information of the unexecuted computing node B adjacent to the computing node A indicates the TEE, the computing node A and the computing node B are merged to obtain the unexecuted computing node C, and it is determined that the hardware execution location information of the computing node C indicates the TEE, wherein A, B, and C represent different computing node identifiers.

5. The method according to claim 3, characterized in that: According to the optimized target computation graph, controlling the DNN model to execute each unexecuted computation node on the heterogeneous hardware platform to perform data processing on the preset training sample image data includes: For the unexecuted computing node D, when it is determined according to the optimized target computing graph that the hardware execution location information of the computing node D indicates the NNA, the initial input data of the computing node D is encrypted in the TEE based on a preset encryption algorithm to obtain the target encrypted input data and the target decryption key of the computing node D, wherein D represents the computing node identifier, and the initial input data of the computing node D is the preset training sample image data or the intermediate feature map data in the process of the DNN model performing data processing on the preset training sample image data; Storing the target decryption key of the computing node D in the TEE, and transmitting the target encrypted input data of the computing node D from the TEE to the NNA using a preset data transmission method between the NNA and the TEE; The NNA is used to perform a computing operation corresponding to the computing node D on the target encrypted input data of the computing node D, so as to obtain the encrypted output data of the computing node D.

6. The method according to claim 5, characterized in that The method of encrypting the initial input data of the computing node D in the TEE based on a preset encryption algorithm to obtain the target encrypted input data and the target decryption key of the computing node D includes: Determine p Gaussian noises, a linear scaling key, and p noise keys according to the initial input data of the computing node D, where p is a positive integer; Determining p groups of target noises based on the p Gaussian noises and the p noise keys; Using the linear scaling key, linearly scale the initial input data of the computing node D to obtain scaled input data; Performing noise superposition on the scaled input data and the p groups of target noise to obtain initial encrypted input data; Concatenate the initial encrypted input data and the p groups of target noise to obtain target encrypted input data of the computing node D; The linear scaling key is determined as a target decryption key for the computing node D, and the target decryption key for the computing node D is stored in the TEE.

7. The method according to claim 6, characterized in that The method further comprises: Determine whether there is data overflow in the target encrypted input data of the computing node D; When data overflow exists in the target encrypted input data of the computing node D, the initial input data of the computing node D is re-encrypted until data overflow does not exist in the target encrypted input data of the computing node D.

8. The method according to claim 5, characterized in that The method further comprises: When it is determined according to the optimized target computing graph that the hardware execution location information of the unexecuted computing node E adjacent to the computing node D indicates the TEE, the encrypted output data of the computing node D is transmitted from the NNA to the TEE using the preset data transmission method, where E represents a computing node identifier; In the TEE, the encrypted output data of the computing node D is decrypted using the target decryption key of the computing node D to obtain the input data of the computing node E; The TEE is used to perform a computing operation corresponding to the computing node E on the input data of the computing node E to obtain output data of the computing node E.

9. The method according to claim 5 or 7, characterized in that: The preset data transmission mode specifically includes: According to a preset block size parameter, data to be transmitted between the TEE and the NNA is divided into blocks to obtain multiple data blocks; Adding the multiple data blocks into a preset buffer queue in sequence; Based on the preset buffer queue, data is transmitted between the TEE and the NNA.

10. The method according to claim 9, characterized in that The method further comprises: The preset block size parameter is adjusted according to the actual operating status of the TEE and the NNA.

11. A TEE-compatible DNN model training device, characterized in that: include: An input module, used to input preset training sample image data into a DNN model, wherein the DNN model corresponds to a target computing graph, the target computing graph includes multiple computing nodes and hardware execution location information of each computing node, the hardware execution location information of each computing node is used to indicate that the hardware execution location of the computing node is an NNA or TEE in a heterogeneous hardware platform, and each computing node represents a computing operation; A dynamic compiler, used for controlling the DNN model to perform data processing on the preset training sample image data on the heterogeneous hardware platform by dynamically optimizing the target computation graph; The training module is used to obtain the image processing results output by the DNN model after the data processing is completed, and to adjust the network parameters of the DNN model according to the image processing results.

12. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 10.

13. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images