Edge end model protection method and system based on model locking

Abstract

The invention discloses an edge end model protection method and system based on model locking. In the method, parameter replacement is performed on the rear half part of the model, so that the to-be-protected model has an authorization verification function, the unauthorized feature map cannot enable the network to operate normally, and the accuracy of the network is greatly degraded, thereby achieving the purpose of protecting the model, and meanwhile, improving the reliability of the model. According to the method, the authorization module is constructed and deployed in the trusted execution environment and used for adding authorization information to the features in the data processing process of the model, the authorized features can obtain the original features through operation of the verification layer, and normal use of the network is guaranteed. In addition, in order to realize the method smoothly, the invention further discloses an edge end model protection system based on the authorization verification mechanism. According to the method, the deep learning technology and the authorization authentication mechanism are utilized, effective and lightweight edge-end model protection can be realized, and intellectual property of the model in the edge-end equipment is guaranteed to a great extent.

Description

Technical Field

[0001] The present invention relates to the field of deep learning model intellectual property protection, and in particular to an edge model protection method and system based on model locking. Background Art

[0002] In recent years, with the popularity of edge devices, deploying models in user-controlled devices has effectively solved the problems of privacy leakage, high bandwidth cost and latency. However, this also brings new security challenges, especially the ability of high-privilege adversaries to easily access model architecture and weights, thereby implementing efficient model stealing (MS). If the core assets of model manufacturers are stolen in the deployment environment, it may lead to secondary training, resale and abuse.

[0003] Most current protection schemes are based on the Trusted Execution Environment (TEE), which defends against attacks by high-privilege adversaries by running some key parameters in a hardware-isolated environment. However, running the entire model in a TEE will significantly reduce the efficiency of inference. Therefore, some schemes use partial TEE shielded execution (PTSE) to place some parameters in the TEE, but these methods are difficult to balance between efficiency and security. Existing research has shown that even with PTSE protection, attackers can still recover model segments through reverse engineering and a small amount of training data, destroying the model protection effect [1].

[0004] To solve the problem of model theft, parameter obfuscation protection (PSP) has emerged. Its core is to execute linear transformation layers on the GPU and obfuscate the parameters so that unauthorized users cannot directly restore the model structure. The obfuscated parameters can only match the corresponding feature maps, thereby improving security. The feature obfuscation process is performed in the trusted execution environment (TEE), which ensures the security of the authorization process. However, the key problem of PSP lies in the frequent data transmission between TEE and GPU. For large language models, this transmission leads to significant performance overhead, especially on edge devices, which makes it difficult to meet real-time inference requirements. For example, to protect an LLaMA3-8B model, which contains 224 linear layers, using ShadowNet to protect the model will result in 448 TEE-CPU data transmissions to generate a single token (each linear layer requires 2 transmissions). Using TransLinkGuard to protect the model requires 5 TEE-CPU data transmissions for each individual Transformer block, which results in at least 160 data transmissions to generate a single token. Therefore, although PSP is effective in security, its high transmission cost limits its practical application.

[0005] In summary, current model protection solutions still face challenges in edge deployment scenarios. How to achieve effective protection while ensuring model performance is a key issue in model security deployment. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention proposes an edge model protection method and system based on model locking.

[0007] The technical solution adopted by the present invention is as follows:

[0008] An edge model protection method based on model locking includes the following steps:

[0009] 1) Determine an edge model to be protected, wherein the edge model to be protected includes M series-connected Transformer blocks and a token classification layer located after all Transformer blocks, wherein the Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence, and formulates and models the edge model to be protected;

[0010] 2) Obtain authorization information, and replace parameters of the last N Transformer blocks and token classification layer of the edge model based on the authorization information. The edge model after parameter replacement is the locked model;

[0011] 3) Based on the authorization information, the parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locking model are replaced, and the locking model after the parameter replacement is the final locking model; an authorization module is constructed based on the OTP technology and the authorization information, and the authorization module is used to add authorization information to the output of the (MN)th Transformer block of the final locking model during the data processing process;

[0012] 4) Deploy the final locking model on the GPU and deploy the authorization module in the trusted execution environment.

[0013] The present invention also proposes an edge model protection system based on model locking, which is used to implement the above method.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] (1) The present invention proposes a locking solution based on parameter obfuscation, which avoids direct reliance on TEE for model protection and effectively solves the performance bottleneck problem in traditional solutions;

[0016] (2) The present invention ensures the security of the authorization process through parameter replacement and one-time password technology, guarantees lossless calculation of the model in the authorized state, and prevents unauthorized access;

[0017] (3) The present invention significantly reduces the number of TEE authorizations, and simplifies the traditional multiple authorization process (O(n)) to one (O(1)), significantly reducing the computational and transmission overheads, and improving the practical availability and feasibility of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of the edge model protection method based on model locking of the present invention;

[0019] Figure 2 A schematic diagram of the model locking process of parameter position replacement of the present invention;

[0020] Figure 3 A schematic diagram of the edge model locking security reasoning framework of the present invention;

[0021] Figure 4 Schematic diagram of the Transformer block structure of the model to be protected in one embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] In order to solve the problem of edge model intellectual property protection, the present invention proposes an edge model protection method and system based on an authorization verification mechanism, such as Figure 1 As shown, the specific steps are as follows:

[0024] (1) Determine the model to be protected and model its functions in a formalized manner. In this example, the standard Transformer model is used as an example.

[0025] The model to be protected includes M series-connected Transformer blocks and a token classification layer located after the Transformer block. The Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence, such as Figure 4 shown.

[0026] We first formulate a standard Transformer block. Let x and z∈R l×d denote its input and output respectively, where l is the sequence length (e.g., the number of tokens) and d is the model dimension. We define a Transformer block as a function f w :R l×d →R l×dThe weight parameter is w. A single Transformer layer, i.e. f w (x) = z, is calculated as follows:

[0027] Q = xW q ,K=xW k ,V=xW v ,

[0028]

[0029] a=ReLU(yW a ),

[0030] b=aW b ,

[0031]

[0032] Where k is a constant equal to d divided by the number of attention heads. The mask M∈R n×n In the encoder, it is an all-zero matrix, while in the decoder, its upper right corner is negative infinity. Q, K, V are the query, key, and value of the attention layer, x is the input of the attention layer, o is the output of the attention layer, y is the output of the first normalization layer, a and b are the outputs of the first and second linear layers of the MLP layer, and z is the output of the second normalization layer, which is also the output of the Transformer block. The weight parameter w includes the attention weight W q , W k , W v , W o ∈R d×d , the weights γ1 and β1∈R of the first normalization layer d , the weight W of the MLP a and W b ∈R d ×d , and the weights γ2 and β2∈R of the second normalization layer d , μ o+x and σ o+x are the mean and variance of the sum between o and x, μ y+b and σ y+b are the mean and variance of the sum of y and b, ⊙ represents the dot product, and ReLU(.) represents the activation function.

[0033] (2) Model locking based on parameter position replacement

[0034] (2.1) Parameter substitution

[0035] like Figure 2As shown in Figure 1, in order to achieve protection, we first obtain the authorization information, and then permute the parameters of the Transformer layer in the second half of the network based on the authorization information. The authorization information is expressed in the form of a permutation matrix π∈0,1 d×d in the form of I is the identity matrix, which is a property of permutation matrices. We permute the parameters w as follows:

[0036] W q ′=π T W q ,W k ′=π T W k ,W v ′=π T W v ,

[0037] W o ′=W o π,γ′1=γ1π,β′1=β1π,

[0038] W a ′=π T W a ,W b ′=W b π,

[0039] γ′2=γ2π, β′2=β2π.

[0040] (2.2) Representation and verification of Transformer layer functions after permutation.

[0041] Using the permuted weight (denoted as w′), and taking xπ as the authorization input, its function can be described as follows:

[0042] Q′=xππ T W q =xW q =Q,

[0043] K′=xππ T W k =xW k =K,

[0044] V′=xππTW v =xW v =V,

[0045]

[0046] a′=ReLU(yππ T W a )=a.

[0047] b′=a′W bπ=bπ,

[0048]

[0049] Therefore, the function of the permutation layer can be expressed as f w′ (x′)=zπ=f w (x), is only valid when x′=xπ, preventing unauthorized access (no π). However, when the permuted Transformer layer accepts the authorized input (xπ), its output (zπ) contains both the correct calculation result (z) and the authorization information (π), which also becomes the authorization information of the next layer, and this propagation remains consistent in all subsequent layers. In other words, authorization is only required in the first permuted layer. In particular, for the last token classification layer of the network, its parameter matrix is ​​multiplied by a π on the left. R , which makes π disappear after the last Transformer layer, ensuring that the output of the model is consistent with the original model (i.e., z).

[0050] (3) Secure authorization based on one-time password

[0051] Since the first permuted Transformer block needs to construct an authorization input (xπ), in order to ensure security, the present invention binds this process to the previous MLP block of the first permuted Transformer block to introduce more parameters in the authorization process, thereby increasing the difficulty for potential attackers to crack the authorization process and improving the security of the authorization process.

[0052] (3.1) MLP block formulation modeling

[0053] The MLP block formulation modeling has been completed in step (1). In this embodiment, an MLP block includes two linear layers, and the function of an MLP block can be expressed as follows:

[0054] a=ReLU(yW a ),

[0055] b=aW b

[0056]

[0057] Among them, the parameters include the weight W of MLP a and W b ∈R d×d , and the weights γ2 and β2∈R of the first normalization layer d .

[0058] (3.2) First, the parameters of the MLP are permuted to match the authorization:

[0059]

[0060] (3.3) Functional representation of the authorization process

[0061] Because W a There is no transformation, so the first linear layer of the MLP block remains unchanged:

[0062] a=ReLU(yW a ).

[0063] However, since the second linear layer (W b ′) is permuted, so the content input to this permutation layer must be authorized by the Trusted Execution Environment (TEE), which is vulnerable to input-output speculation attacks. To solve this problem, a one-time password (OTP) is introduced. OTP encrypts the features within the TEE to hide the permutation order (π) and avoid the risk of input-output speculation:

[0064] a′=aπ+mπ,

[0065] Among them, a′ is the encrypted permutation feature, and m is the random mask matrix generated by OTP. The principle of OTP ensures that since m is different each time, even for the same a, the generated a′ will be different, thus protecting π from being cracked.

[0066] Subsequently, the permuted feature a′ can be passed through the permuted second linear layer W on the GPU b ' to calculate correctly:

[0067] b′=a′π T W b =(aπ+mπ)π T W b =b+nW b ,

[0068] Among them, b′ remains encrypted (through nW b ). However, if the OTP noise (i.e. mW b ) are not eliminated, the functionality of the network will be impaired.

[0069] Therefore, in order to decrypt b′, it is transferred to the TEE. The decrypted features are then permuted to complete the authorization. Since the second normalization layer takes both b and y as input, y also needs to be permuted for correct calculation. The whole process is performed as follows:

[0070] b″=(b′-mW b )π=bπ,

[0071] y′=yπ,

[0072]

[0073] Among them, z′ (i.e., zπ) is the authorized feature, which will be used as the input of the subsequent permuted Transformer layer. b The computation of can be performed by the model provider or in the offline phase within the TEE. Both strategies do not increase the overhead of online inference nor affect its efficiency.

[0074] (4) Edge Model Locking Security Reasoning Framework

[0075] like Figure 3 As shown in the figure, this step deploys the locked model obtained in the previous steps on the GPU and deploys the authorization module in the TEE. After the deployment is completed, the operation process of the locked model can be safely inferred to ensure that the locked model can achieve the same functions as the original model. The overall process of secure reasoning is as follows:

[0076] (4.1) The model operates normally until the last MLP block before the second half of the locked transformer layer.

[0077] (4.2) The calculated intermediate feature vector (y) is input into the first linear layer and activation layer of the current MLP block, and the calculation result is input into TEE.

[0078] (4.3) TEE accepts the feature vector and encrypts it according to the random mask generated by OTP. The encrypted result is permuted according to the permutation matrix (π).

[0079] (4.4) The permuted result is returned to the GPU and the second linear layer for calculation, and the calculation result is returned to the TEE.

[0080] (4.5) TEE decrypts the features based on the mask generated by OTP. The decrypted features and the input (y) of the MLP block are permuted, residually connected and normalized, and the results are returned to the GPU to complete the authorization of the subsequent locking layer.

[0081] The present invention uses authorization for locked models to isolate the right to use the model, thereby protecting the intellectual property rights of the model. In the case of authorized use, the locked model can have almost the same accuracy as the model before locking. In the case of unauthorized use, the accuracy of the locked model will be greatly degraded. The protection scheme proposed by the present invention achieves effective protection of the intellectual property rights of the edge model with minimal additional computing overhead.

[0082] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for protecting edge models based on model locking, comprising the following steps: 1) Determine an edge model to be protected, wherein the edge model to be protected includes M series-connected Transformer blocks and a token classification layer located after all Transformer blocks, wherein the Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence, and formulates and models the edge model to be protected; 2) Obtain authorization information, and replace parameters of the last N Transformer blocks and token classification layer of the edge model based on the authorization information. The edge model after parameter replacement is the locked model; 3) Based on the authorization information, the parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locking model are replaced, and the locking model after the parameter replacement is the final locking model; an authorization module is constructed based on the OTP technology and the authorization information, and the authorization module is used to add authorization information to the output of the (MN)th Transformer block of the final locking model during the data processing process; 4) Deploy the final locking model on the GPU and deploy the authorization module in the trusted execution environment.

2. The edge model protection method based on model locking according to claim 1 is characterized in that: The MLP layer includes a first linear layer and a second linear layer in sequence.

3. The edge model protection method based on model locking according to claim 2 is characterized in that: The step 1) of formulating the edge model to be protected is as follows: for each Transformer block of the edge model to be protected, the calculation formula is constructed as follows: Q=xW q ,K=xW k ,V=xW v a=ReLU(yW a ) b=aW b Where Q, K, V are the query, key, and value of the attention layer, x is the input of the attention layer, o is the output of the attention layer, M is the mask matrix, y is the output of the first normalization layer, a and b are the outputs of the first and second linear layers of the MLP layer, z is the output of the second normalization layer, which is also the output of the Transformer block, and W q , W k , W v , W o is the weight parameter of the attention layer, γ1 and β1 are the weight parameters of the first normalization layer, μ o+x and σ o+x are the mean and variance of the sum between o and x, respectively, W a and W b is the weight parameter of the MLP layer, γ2 and β2 are the weight parameters of the second normalization layer, μ y+b and σ y+b are the mean and variance of the sum between y and b, ⊙ represents the dot product, and ReLU(.) represents the activation function.

4. The edge model protection method based on model locking according to claim 1 is characterized in that: The authorization information is a permutation matrix π, ππ T =I, where I is the identity matrix.

5. The edge model protection method based on model locking according to claim 3 is characterized in that: In step 2), the parameters of the last N Transformer blocks of the edge model are replaced by replacing the weight parameters in the Transformer blocks as follows: IN' q =π T IN q ,IN' k =π T IN k ,IN' v =π T IN v , W′ o =W o π,γ′1=γ1π,β′1=β1π, IN' a =π T IN a ,IN' b =In b π, γ′2=γ2π,β′2=β2π Among them, π is the authorization information, W′ q , W′ k , W′ v , W′ o ,γ′1,β′1,W′ a , W′ b , γ′2 and β′2 are all weight parameters after permutation.

6. The edge model protection method and system based on model locking according to claim 1 is characterized in that: In step 2), the parameters of the token classification layer are permuted as follows: multiply the parameter matrix of the token classification layer by π on the left. T , where π is the authorization information.

7. The edge model protection method based on model locking according to claim 3 is characterized in that: In step 3), the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locked model are parameter-permuted based on the authorization information, specifically: Among them, π is the authorization information, and is the weight parameter after permutation.

8. The edge model protection method based on model locking according to claim 3 is characterized in that: In the data processing process of the (MN)th Transformer block of the final locking model, authorization information is added to its output, specifically: Generate a random mask matrix m through OTP technology, and use the authorization information π and the random mask matrix m to encrypt and replace the intermediate variables a, b and y of the (MN)th Transformer block: a′=aπ+mπ b″=(b′-mW b )p y′=yπ Where b′=b+mW b is the output of the second linear layer of the MLP layer after parameter permutation, a′, b″ and y′ are the encrypted and permuted variables; The output of the (MN)th Transformer block after encryption and permutation is z′=zπ.

9. An edge model protection system based on model locking, which is used to implement the method of claim 1, the system comprising: Model building module, used for formulating modeling of the model to be protected; The model locking module is used to replace the parameters of the last N Transformer blocks and the token classification layer of the model based on the authorization information, and is also used to replace the parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locked model; An authorization module, used to add authorization information to the output of the (MN)th Transformer block; Deployment module, used to deploy locking model and authorization module.

Images