Method and system for protecting model safety
By pruning and replenishing the AI model, and then retraining it to make its inference accuracy lower than the preset threshold, it solves the problem in the existing technology that it is difficult to balance safety and efficiency in AI model protection, and achieves high efficiency and safety. model protection.
Patent Information
- Application Number
- CN202411250959.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-06
- Publication Date
- 2025-01-21
AI Technical Summary
When protecting AI models, prior art usually leads to a degradation of the reasoning performance and user experience of the terminal device, and it is difficult to effectively prevent the model from being abused and white box attacks.
By pruning the AI model, some or all of the pruned nodes and connections are restored, and the restored model is retrained to make its inference accuracy lower than the preset threshold, thereby providing a safe model for use. method.
It is possible to improve the security of the AI model without affecting the model inference performance, avoid model abuse and white-box attacks, and the camouflage of the model is not easy to be discovered and has good concealment.
Smart Images
Figure CN119337364A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of artificial intelligence and information security technology, and specifically relates to a method and system for protecting model security. Background Art
[0002] With the rapid development of artificial intelligence, the application of artificial intelligence technology is becoming more and more extensive. AI models are gradually applied to all aspects of people's lives, and various AI models have been deployed on a variety of terminal devices, such as mobile phones, tablets, cars, etc.
[0003] The deployment and use environment of AI models is relatively complex. If an AI model is stolen by an adversary, on the one hand, the model will be abused and the intellectual property rights of the model producer will not be protected. On the other hand, the adversary can more easily launch white box attacks by analyzing the model, which will cause greater economic losses and social impacts.
[0004] Cryptographic technology is often used in the existing technology to protect AI models. However, AI models protected by cryptographic technology usually have large delays when in use. Some methods have large computational or communication overheads, which will ultimately affect the reasoning performance and user experience of the terminal device, and even cause the terminal device to fail to function effectively.
[0005] The application of AI models has very broad prospects, but how to improve the security and efficiency of model use remains a problem that needs to be solved urgently. Summary of the invention
[0006] The purpose of the present invention is to provide a method and system for protecting model security in order to improve the security and efficiency of using AI models.
[0007] In the technical solution of the present invention, the model is pruned, and then the pruned nodes and connections are partially or fully restored, and the restored model is retrained to obtain a secure model, wherein only the weights and / or biases of the restored connections in the model are updated during training, and the training goal is to make the model reasoning accuracy lower than a preset threshold and become unusable; when the model is used, the corresponding nodes and connections in the secure model are deleted according to the restored records, and a usable model is obtained. By disguising a part of the nodes and connections in the model, security protection is provided to the model.
[0008] Specifically, the first aspect of the present invention provides a method for protecting model security, comprising: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, partially or completely fill in the pruned nodes and connections of the second model to obtain a third model, and record the position of the pruned part in the calculation graph of the third model to form a filling record; The third model is retrained to obtain a fourth model for publishing to users; wherein, during the retraining, only the weights and / or biases of the nodes and connections that are supplemented in the third model are updated, and the training goal is to make the inference accuracy of the fourth model lower than a preset threshold.
[0009] Based on the above, the method of partially or completely replenishing the pruned nodes and connections of the second model includes: setting a model replenishment ratio coefficient k, and replenishing the extra nodes and connections of the first model relative to the second model according to the calculation graph of the first model and the second model according to the ratio coefficient k, wherein 0 <k≤1。
[0010] Based on the above, a model execution file corresponding to the fourth model is released, and the model execution file includes a replenishment record.
[0011] Based on the above, the model execution file also includes a corresponding security execution strategy for performing security verification on the fourth model.
[0012] Based on the above, multiple fourth models with different calculation graphs and their corresponding replenishment records are obtained through retraining, and different fourth models are used for different applications or users respectively.
[0013] A second aspect of the present invention provides a model use method, when using the fourth model obtained according to the method for protecting model security, the corresponding nodes and connections in the fourth model are deleted according to the replenishment records.
[0014] According to a third aspect of the present invention, there is provided a system for protecting model security, comprising a model protection unit; the model protection unit comprises a model acquisition module, a model pruning module, a model replenishment module and a model retraining module; the model acquisition module is used to acquire a first model; the model pruning module is used to perform model pruning on the first model to obtain a second model; the model replenishment module is used to partially or fully replenish the pruned nodes and connections of the second model to obtain a third model, and record the position of the padded part in the calculation graph of the third model to form a replenishment record; the model retraining module is used to train the third model to obtain a fourth model for publishing to users; wherein, during retraining, only the weights and / or biases of the padded nodes and connections in the third model are updated, and the training goal is to make the inference accuracy of the fourth model lower than a preset threshold.
[0015] The fourth aspect of the present invention provides a model using system, including a model using unit, which presets the fourth model output by the system for protecting the security of the model, and when using the fourth model, deletes the corresponding nodes and connections in the fourth model according to the replenishment records.
[0016] A fifth aspect of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method for protecting the security of the model are implemented; and / or the steps of the method for using the model are implemented.
[0017] A sixth aspect of the present invention provides a computer program product, which stores instructions, and when the instructions are executed by a computer, the computer implements the method for protecting the security of the model; and / or the method for using the model.
[0018] The present invention has substantial features and improvements over the prior art, specifically: 1. The technical solution of the present invention can effectively protect AI models. After the adversary steals the model protected by the technical solution, it cannot obtain accurate and reliable results by using the model for reasoning, and it is also difficult to obtain the true structural information and weight and / or bias information of the original model, thereby preventing the model from being abused and attacked by white box attacks, and greatly improving the security of the model.
[0019] 2. The technical solution of the present invention only needs to delete the corresponding nodes and connections according to the replenishment records when using the model, and check the model according to the corresponding security policy when necessary. The reasoning delay is very small and the steps are very simple. Compared with other model protection methods, it is very efficient.
[0020] 3. The technical solution of the present invention only needs to protect the model execution file or the model's recovery record. When cryptographic technology is used to ensure its security, the computational overhead and communication overhead are very small.
[0021] 4. The disguised model in the technical solution of the present invention is no different from an ordinary model or a classic model. The disguise of the model is not easy to be discovered and has good concealment, which improves the security of the model from another perspective. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] Figure 1 It is a schematic diagram of a method for protecting model security according to an embodiment of the present invention.
[0023] Figure 2 is a schematic diagram of a system for protecting model security according to an embodiment of the present invention.
[0024] Figure 3 It is a schematic diagram of the structure of the computer device of embodiment 3 of the present invention. DETAILED DESCRIPTION
[0025] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0026] The models in the present invention are mainly AI models, including artificial neural network models, especially deep learning models.
[0027] Example 1 This embodiment provides a method for protecting model security. Figure 1 As shown, the method includes: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, partially or completely fill in the pruned nodes and connections of the second model to obtain a third model, and record the position of the pruned part in the calculation graph of the third model to form a filling record; The third model is retrained to obtain a fourth model for publishing to users; wherein, during the retraining, only the weights and / or biases of the nodes and connections that are supplemented in the third model are updated, and the training goal is to make the inference accuracy of the fourth model lower than a preset threshold.
[0028] When using the fourth model obtained according to the method for protecting model security, the corresponding nodes and connections in the fourth model are deleted according to the replenishment records.
[0029] Obtaining the first model includes obtaining the first model through training, or obtaining the first model by fine-tuning a pre-trained model, or obtaining an existing first model through communication transmission, storage area reading, etc.
[0030] The first model is the original model that needs to be protected, which generally has higher reasoning accuracy; The second model is an intermediate model that has undergone model pruning. During the pruning process, the second model is made to maintain an accuracy close to that of the first model as much as possible. The third model is another intermediate model obtained by partially or completely filling in the pruned nodes and connections of the second model; The fourth model is a security-protected model. If the fourth model is used directly in a normal manner, the results obtained will be unusable due to the low reasoning accuracy of the fourth model. However, by using the model execution file corresponding to the fourth model and deleting the corresponding nodes and connections in the fourth model according to the replenishment records, the fourth model is equivalent to the second model and can achieve normal and usable reasoning accuracy.
[0031] The fourth model can be publicly released or deployed on various electronic products. The model execution file corresponding to the fourth model is only released to legitimate users in a secure manner or securely stored in hardware products. By this method, the purpose of protecting the model security can be achieved.
[0032] Model pruning, also known as model sparsification, aims to explore the redundancy in model weights, delete / prune redundant and non-critical weights, so as to reduce the number of model parameters and calculations, decrease the model size, and accelerate model training / inference, while ensuring that the model accuracy is not affected as much as possible. The model pruning steps usually include: training, pruning, and fine-tuning. Model pruning includes fine-grained pruning and coarse-grained pruning. Fine-grained pruning is to prune connections or neurons, and coarse-grained pruning includes vector pruning, convolutional kernel pruning, channel pruning, and hierarchical pruning, etc.
[0033] Preferably, partially or fully restore the pruned nodes and connections of the second model, including: setting a model restoration ratio coefficient k, and according to the computational graphs of the first model and the second model, restore the nodes and connections that the first model has more than the second model to the second model according to the ratio coefficient k, where 0 < k ≤ 1. When 0 < k < 1, it is the case of partial restoration, and when k = 1, it is the case of full restoration. For the restored part, except for the weights, the others are restored according to the settings in the first model.
[0034] In addition, the ratio coefficient k can also be made greater than 1, that is, in addition to restoring the nodes and connections that the first model has more than the second model to the second model, some additional nodes and connections can also be added to the second model.
[0035] The goal of retraining the third model is to make the model inference accuracy lower than a preset threshold; the goal of the preset threshold is to ensure that the inference accuracy of the fourth model is low enough, preferably to an unusable level.
[0036] Optionally, retrain the third model to obtain the fourth model. During retraining, update the third model and the restoration record by adding or deleting some restored nodes and connections, and update the weights of the restored connections in the model; the goal of retraining is to make the model inference accuracy lower than a preset threshold.
[0037] In this way, the partial restoration process of the second model is also included in the training process, and multiple third models and corresponding fourth models, as well as corresponding restoration records, can be obtained.
[0038] Optionally, obtain multiple fourth models with different computational graphs and their corresponding restoration records through retraining, and use different fourth models for different applications or users respectively.
[0039] The third model is retrained, and the training data can be selected from data similar to that used in training the first model or the second model. Since the goal of retraining is different from that of ordinary model training, the training process also needs to be modified accordingly, such as modifying the objective function, or modifying the accuracy goal during training, or modifying the direction of gradient descent, etc.
[0040] Preferably, a model execution file corresponding to the fourth model is released, and the model execution file includes a replenishment record.
[0041] Preferably, the model execution file also includes a corresponding security execution strategy for security verification of the fourth model. For example, the security execution strategy can perform security verification of the fourth model by comparing the hash value of the fourth model when it is executed with the hash value of the second model.
[0042] Preferably, cryptographic technology can be used to protect the replenishment records to further improve the security of the model.
[0043] The model execution file corresponding to the fourth model can be released through a secure channel, for example, security can be ensured by encryption, identity authentication, etc.
[0044] In this technical solution, the fourth model is published or stored in plain text, and only the model execution file corresponding to the fourth model needs to be protected. After the opponent obtains the fourth model, it cannot get the correct result when running it, nor can it know the true structure of the model. When using the fourth model, it is not necessary to perform a large number of cryptographic operations on the fourth model, and the operation efficiency is high. Therefore, the security of the model can be greatly improved on the basis of protecting the reasoning performance of the AI model.
[0045] Embodiment 2: Based on the same inventive concept, this embodiment also provides a system for protecting model security. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations of one or more system embodiments for protecting model security provided below can refer to the limitations of the method above, and will not be repeated here.
[0046] This embodiment provides a system for protecting model security and a system for using the system. Figure 2 As shown, the system for protecting model security includes a model protection unit; the model protection unit includes a model acquisition module, a model pruning module, a model replenishment module, and a model retraining module; The model acquisition module is used to acquire the first model; The model pruning module is used to perform model pruning processing on the first model to obtain a second model; The model filling module is used to fill in part or all of the pruned nodes and connections of the second model to obtain a third model, and record the position of the filled-in part in the calculation graph of the third model to form a filling record; The model retraining module trains the third model to obtain a fourth model for publishing to users; wherein, during the retraining, only the weights and / or biases of the nodes and connections that are replenished in the third model are updated, and the training goal is to make the model reasoning accuracy lower than a preset threshold; The model using system includes a model using unit; the model using unit presets a fourth model, and when using the fourth model, deletes corresponding nodes and connections in the fourth model according to the replenishment records.
[0047] Preferably, the system for protecting model security further comprises a model publishing module, and the model publishing module is used to publish a model execution file corresponding to the fourth model, and the model execution file comprises a replenishment record.
[0048] Preferably, the model retraining module retrains the third model to obtain a fourth model, wherein during the retraining, the third model and the replenishment record are updated by adding or deleting some of the replenished nodes and connections in the third model, and the weights and / or biases of the replenished connections in the model are updated; the goal of the retraining is to make the model reasoning accuracy lower than a preset threshold.
[0049] Optionally, the model protection unit and the model use unit are connected in communication, and the model use unit obtains the fourth model and the corresponding model execution file by communicating with the model protection unit. The model use unit may also obtain the fourth model from the model protection unit in other ways.
[0050] The model protection unit and the model use unit may also be in the same device. After obtaining the fourth model, the model protection unit may also destroy the first model and the second model or apply cryptographic technology to protect them.
[0051] Each module in the above system can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.
[0052] Example 3 A computer device is provided, which may be a terminal. Figure 3As shown, the computer device also includes a processor, a memory, an input / output interface, a display unit and an input / output device. The processor, the memory and the input / output interface are connected through a system bus, and the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. When the computer program is executed by the processor, the steps of the method for protecting the security of the model are implemented; and / or the steps of the method for using the model are implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, a trackball or a touch pad set on the shell of the computer device, or an external keyboard, touch pad or mouse, etc.
[0053] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0054] Example 4 A computer program product is provided, wherein the computer program product stores instructions, which, when executed by a computer, enable the computer to implement the method for protecting the security of a model; and / or the method for using a model.
[0055] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by controlling the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0056] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0057] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art who is familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.
Claims
1. A method for protecting model security, characterized in that: include: Obtain a first model, and obtain a second model through model pruning; According to the calculation graph of the first model, partially or completely fill in the pruned nodes and connections of the second model to obtain a third model, and record the position of the pruned part in the calculation graph of the third model to form a filling record; The third model is retrained to obtain a fourth model for publishing to users; wherein, during the retraining, only the weights and / or biases of the nodes and connections that are supplemented in the third model are updated, and the training goal is to make the inference accuracy of the fourth model lower than a preset threshold.
2. The method for protecting model security according to claim 1, characterized in that: The method of partially or completely replenishing the pruned nodes and connections of the second model includes: setting a model replenishment ratio coefficient k, and replenishing the nodes and connections of the first model that are more than the second model according to the calculation graph of the first model and the second model according to the ratio coefficient k, wherein 0 <k≤1。 3. The method for protecting model security according to claim 1, characterized in that: A model execution file corresponding to the fourth model is released, wherein the model execution file includes a replenishment record.
4. The method for protecting model security according to claim 3, characterized in that: The model execution file also includes a corresponding security execution strategy for performing security verification on the fourth model.
5. The method for protecting model security according to claim 1, characterized in that: Through retraining, multiple fourth models with different calculation graphs and their corresponding replenishment records are obtained, and different fourth models are used for different applications or users respectively.
6. A method for using a model, characterized in that: When the fourth model is obtained by using the method for protecting model security according to any one of claims 1 to 5, the corresponding nodes and connections in the fourth model are deleted according to the replenishment records.
7. A system for protecting model security, characterized in that: Including a model protection unit; the model protection unit includes a model acquisition module, a model pruning module, a model replenishment module, and a model retraining module; The model acquisition module is used to acquire the first model; The model pruning module is used to perform model pruning processing on the first model to obtain a second model; The model filling module is used to fill in part or all of the pruned nodes and connections of the second model to obtain a third model, and record the position of the filled-in part in the calculation graph of the third model to form a filling record; The model retraining module trains the third model to obtain a fourth model for publishing to users; wherein, during retraining, only the weights and / or biases of the nodes and connections that are replenished in the third model are updated, and the training goal is to make the reasoning accuracy of the fourth model lower than a preset threshold.
8. A model using system, characterized in that: It includes a model using unit, which presets the fourth model output by the system for protecting model security as described in claim 7, and when using the fourth model, deletes the corresponding nodes and connections in the fourth model according to the replenishment record.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for protecting model security described in any one of claims 1 to 5 are implemented; and / or Implement the steps of the model use method described in claim 6.
10. A computer program product, characterized in that The computer program product stores instructions, which, when executed by a computer, enable the computer to implement the method for protecting model security according to any one of claims 1 to 5; and / or the model using method according to claim 6.