A method and system for edge model protection based on model locking

Abstract

The application discloses an edge model protection method and system based on model locking. In the method, the authorized verification function is added to the to-be-protected model by parameter substitution on the latter half of the model, so that the un-authorized feature map cannot make the network normally run, and the accuracy of the network will be greatly degraded, which plays a role in protecting the model. Meanwhile, the authorization module is constructed and deployed in the trusted execution environment, which is used for adding authorization information to the feature in the data processing process of the model. The authorized feature can obtain the original feature through the operation of the verification layer, which guarantees the normal use of the network. In addition, in order to smoothly realize the method, the application also discloses an edge model protection system based on the authorization verification mechanism. The application can realize effective and light edge model protection by using the deep learning technology and the authorization authentication mechanism, and to a great extent, the intellectual property right of the model in the edge device is guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of intellectual property protection of deep learning models, and in particular to an edge model protection method and system based on model locking. Background Art

[0002] With the recent proliferation of edge devices, deploying models on user-controlled devices has effectively addressed privacy concerns, high bandwidth costs, and latency. However, this also presents new security challenges, particularly the ability of high-privilege adversaries to easily access model architecture and weights, enabling efficient model theft (MS). If core assets of model vendors are stolen in the deployment environment, they can be easily retrained, resold, and abused.

[0003] Most current protection schemes are based on a Trusted Execution Environment (TEE), which defends against attacks by high-privilege adversaries by running some key parameters in a hardware-isolated environment. However, running the entire model in a TEE significantly reduces inference efficiency. Therefore, some schemes use Partial TEE Shielded Execution (PTSE), placing some parameters inside the TEE, but these methods are difficult to balance between efficiency and security. Existing research has shown that even with PTSE protection, attackers can still recover model segments through reverse engineering and a small amount of training data, thus undermining the model's protection effect [1].

[0004] To address the problem of model theft, parameter obfuscation protection (PSP) has emerged. Its core approach is to execute linear transformation layers on the GPU and obfuscate the parameters, preventing unauthorized users from directly recovering the model structure. The obfuscated parameters can only be matched with the corresponding feature maps, thereby improving security. The feature obfuscation process is performed within a trusted execution environment (TEE), ensuring the security of the authorization process. However, a key issue with PSP lies in the frequent data transfers between the TEE and the GPU. For large language models, this transfer incurs significant performance overhead, especially on edge devices, making it difficult to meet the requirements of real-time inference. For example, protecting an LLaMA3-8B model with 224 linear layers using ShadowNet would require 448 TEE-CPU data transfers to generate a single token (two transfers per linear layer). Protecting the model using TransLinkGuard requires five TEE-CPU data transfers for each individual Transformer block, resulting in at least 160 data transfers to generate a single token. Therefore, while PSP is effective in terms of security, its high transmission cost limits its practical application.

[0005] In summary, current model protection solutions still face challenges in edge deployment scenarios. How to achieve effective protection while ensuring model performance is a key issue in model security deployment. Summary of the Invention

[0006] In view of the deficiencies in the prior art, the present invention proposes an edge model protection method and system based on model locking.

[0007] The technical solution adopted in the present invention is as follows:

[0008] A method for protecting edge models based on model locking includes the following steps:

[0009] 1) Determine the edge model to be protected. The edge model to be protected includes M series-connected Transformer blocks and a token classification layer located after all Transformer blocks. The Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence. Formulate and model the edge model to be protected.

[0010] 2) Obtain authorization information and perform parameter replacement on the last N Transformer blocks and token classification layer of the edge model based on the authorization information. The edge model after parameter replacement is the locked model;

[0011] 3) Based on the authorization information, parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locking model are permuted. The locking model after parameter permutation is the final locking model; an authorization module is constructed based on the OTP technology and the authorization information. The authorization module is used to add authorization information to the output of the (MN)th Transformer block of the final locking model during data processing;

[0012] 4) Deploy the final locking model on the GPU and deploy the authorization module in the trusted execution environment.

[0013] The present invention also proposes an edge model protection system based on model locking, which is used to implement the above method.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] (1) This paper proposes a locking solution based on parameter obfuscation, which avoids direct reliance on TEE for model protection and effectively solves the performance bottleneck problem in traditional solutions;

[0016] (2) The present invention ensures the security of the authorization process through parameter replacement and one-time password technology, guarantees lossless calculation of the model in the authorized state, and prevents unauthorized access;

[0017] (3) The present invention significantly reduces the number of TEE authorizations, simplifying the traditional multiple authorization process (O(n)) to one (O(1)), significantly reducing the computational and transmission overhead, and improving the practical usability and feasibility of the solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flow chart of the edge model protection method based on model locking of the present invention;

[0019] Figure 2 Schematic diagram of the model locking process of parameter position replacement of the present invention;

[0020] Figure 3 This is a schematic diagram of the edge model locking security reasoning framework of the present invention;

[0021] Figure 4 Schematic diagram of the Transformer block structure of the model to be protected in one embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] In order to solve the problem of edge model intellectual property protection, the present invention proposes an edge model protection method and system based on the authorization verification mechanism, such as Figure 1 The specific steps are as follows:

[0024] (1) Determine the model to be protected and formulate its functions. In this example, the standard Transformer model is used as an example.

[0025] The model to be protected includes M series-connected Transformer blocks and a token classification layer located after the Transformer block. The Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence, such as Figure 4 shown.

[0026] We first formulate a standard Transformer block. Let x and z ∈ R l×d denote its input and output respectively, where l is the sequence length (e.g., the number of tokens) and d is the model dimension. We define a Transformer block as a function f w :R l×d →R l×dThe weight parameter is w. A single Transformer layer, i.e. f w (x) = z, is calculated as follows:

[0027] Q=xW q ,K=xW k ,V=xW v ,

[0028]

[0029] a=ReLU(yW a ),

[0030] b=aW b ,

[0031]

[0032] Where k is a constant equal to d divided by the number of attention heads. n×n In the encoder, it is an all-zero matrix, while in the decoder, its upper right corner is negative infinity. Q, K, V are the query, key, and value of the attention layer, x is the input of the attention layer, o is the output of the attention layer, y is the output of the first normalization layer, a and b are the outputs of the first and second linear layers of the MLP layer, and z is the output of the second normalization layer, which is also the output of the Transformer block. The weight parameter w includes the attention weight W q 、W k 、W v 、W o ∈R d×d , the weights γ1 and β1∈R of the first normalization layer d , the weight W of MLP a and W b ∈R d ×d , and the weights γ2 and β2∈R of the second normalization layer d , μ o+x and σ o+x are the mean and variance of the sum between o and x, μ y+b and σ y+b are the mean and variance of the sum between y and b, ⊙ represents the dot product, and ReLU(.) represents the activation function.

[0033] (2) Model locking based on parameter position replacement

[0034] (2.1) Parameter substitution

[0035] like Figure 2As shown in Figure 1, in order to achieve protection, we first obtain the authorization information, and then permute the parameters of the Transformer layer in the second half of the network based on the authorization information. The authorization information is expressed as a permutation matrix π∈0,1 d×d in the form of I is the identity matrix, which is a property of permutation matrices. We permute the parameters w as follows:

[0036] W q ′=π T W q ,W k ′=π T W k ,W v ′=π T W v ,

[0037] W o ′=W o π,γ′1=γ1π,β′1=β1π,

[0038] W a ′=π T W a ,W b ′=W b π,

[0039] γ′2=γ2π, β′2=β2π.

[0040] (2.2) Functional representation and verification of the Transformer layer after permutation.

[0041] Using the permuted weight (denoted as w′), and taking xπ as the authorization input, its function can be described as follows:

[0042] Q′=xππ T W q =xW q =Q,

[0043] K′=xππ T W k =xW k =K,

[0044] V′=xππTW v =xW v =V,

[0045]

[0046] a′=ReLU(yππ T W a )=a.

[0047] b′=a′W bπ=bπ,

[0048]

[0049] Therefore, the function of the permutation layer can be expressed as f w′ (x′)=zπ=f w (x), is only valid when x′=xπ, preventing unauthorized access (without π). However, when the permuted Transformer layer accepts the authorized input (xπ), its output (zπ) contains both the correct calculation result (z) and the authorization information (π), which also becomes the authorization information of the next layer. This propagation remains consistent in all subsequent layers. In other words, authorization is only required in the first permutation layer. In particular, for the last token classification layer of the network, its parameter matrix is ​​multiplied by a π on the left. R , which makes π disappear after the last Transformer layer, ensuring that the output of the model is consistent with the original model (i.e., z).

[0050] (3) Secure authorization based on one-time password

[0051] Since the first permuted Transformer block needs to construct an authorization input (xπ), in order to ensure security, the present invention binds this process with the previous MLP block of the first permuted Transformer block to introduce more parameters in the authorization process, thereby increasing the difficulty for potential attackers to crack the authorization process and improving the security of the authorization process.

[0052] (3.1) MLP block formulation modeling

[0053] The MLP block formulation modeling has been completed in step (1). In this embodiment, an MLP block includes two linear layers, and the function of an MLP block can be expressed as follows:

[0054] a=ReLU(yW a ),

[0055] b=aW b

[0056]

[0057] Among them, the parameters include the weight W of MLP a and W b ∈R d×d , and the weights γ2 and β2∈R of the first normalization layer d .

[0058] (3.2) First, replace the parameters of MLP to match the authorization:

[0059]

[0060] (3.3) Functional representation of the authorization process

[0061] Because W a No transformation is done, so the first linear layer of the MLP block remains unchanged:

[0062] a=ReLU(yW a ).

[0063] However, since the second linear layer (W b ′) is permuted, so the content input to this permutation layer must be authorized by the Trusted Execution Environment (TEE), which is vulnerable to input and output speculation attacks. To address this problem, a one-time password (OTP) is introduced. OTP encrypts the signature within the TEE, thereby hiding the permutation order (π) and avoiding the risk of input and output speculation:

[0064] a′=aπ+mπ,

[0065] Where a′ is the encrypted permutation signature, and m is the random mask matrix generated by the OTP. The OTP principle ensures that since m is different each time, even for the same a, the generated a′ will also be different, thus protecting π from being cracked.

[0066] Subsequently, the permuted feature a′ can be passed through the permuted second linear layer W on the GPU b ' to calculate correctly:

[0067] b′=a′π T W b =(aπ+mπ)π T W b =b+nW b ,

[0068] Among them, b′ remains encrypted (through nW b However, if the OTP noise (i.e. mW b ) are not eliminated, the functionality of the network will be impaired.

[0069] Therefore, in order to decrypt b′, it is transmitted to the TEE. The decrypted features are then permuted to complete the authorization. Since the second normalization layer takes both b and y as input, y also needs to be permuted for correct calculation. The entire process is performed as follows:

[0070] b″=(b′-mW b )π=bπ,

[0071] y′=yπ,

[0072]

[0073] Among them, z′ (i.e. zπ) is the authorized feature, which will be used as the input of the subsequent permuted Transformer layer. b The computation of can be performed by the model provider or in the offline phase within the TEE. Both strategies do not increase the overhead of online inference nor affect its efficiency.

[0074] (4) Edge Model Locking Security Inference Framework

[0075] like Figure 3 As shown, this step deploys the locked model obtained in the previous steps on the GPU and the authorization module in the TEE. After deployment, the calculation process of the locked model can be securely reasoned to ensure that the locked model can achieve the same functions as the original model. The overall process of secure reasoning is as follows:

[0076] (4.1) The model operates normally until the last MLP block before the second half of the locked transformer layer.

[0077] (4.2) The calculated intermediate feature vector (y) is input into the first linear layer and activation layer of the current MLP block, and the result of the operation is input into TEE.

[0078] (4.3) TEE accepts the feature vector and encrypts it according to the random mask generated by OTP. The encrypted result is permuted according to the permutation matrix (π).

[0079] (4.4) The permuted result is returned to the GPU and the second linear layer for calculation, and the calculation result is returned to the TEE.

[0080] (4.5) TEE decrypts the features based on the mask generated by the OTP. The decrypted features and the input (y) of the MLP block are permuted, residually connected, and normalized. Finally, the results are returned to the GPU to complete the authorization of the subsequent locking layer.

[0081] This invention uses authorization for locked models to isolate model usage rights and protect the model's intellectual property. Under authorized use, the locked model can achieve nearly the same accuracy as the unlocked model. Without authorization, the locked model's accuracy will significantly degrade. This proposed protection scheme effectively protects the intellectual property of edge models with minimal additional computational overhead.

[0082] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for protecting edge models based on model locking, comprising the following steps: 1) Determine the edge model to be protected. The edge model to be protected includes M series-connected Transformer blocks and a token classification layer located after all Transformer blocks. The Transformer block includes an attention layer, a first normalization layer, an MLP layer, and a second normalization layer in sequence. Formulate the edge model to be protected. The MLP layer includes a first linear layer and a second linear layer in sequence. The formulaic modeling of the edge model to be protected is specifically as follows: for each Transformer block of the edge model to be protected, the calculation formula is constructed as follows: Q=xW q ,K=xW k ,V=xW v a=ReLU(yW a ) b=aW b Where Q, K, and V are the query, key, and value of the attention layer, x is the input of the attention layer, o is the output of the attention layer, M is the mask matrix, y is the output of the first normalization layer, a and b are the outputs of the first and second linear layers of the MLP layer, z is the output of the second normalization layer, which is also the output of the Transformer block, and W q 、W k 、W v 、W o is the weight parameter of the attention layer, γ1 and β1 are the weight parameters of the first normalization layer, μ o+x and σ o+x are the mean and variance of the sum between o and x, W a and W b is the weight parameter of the MLP layer, γ2 and β2 are the weight parameters of the second normalization layer, μ y+b and σ y+b are the mean and variance of the sum of y and b, ⊙ represents the dot product, and ReLU(.) represents the activation function; 2) Obtain authorization information and perform parameter replacement on the last N Transformer blocks and token classification layer of the edge model based on the authorization information. The edge model after parameter replacement is the locked model; In step 2), the parameters of the last N Transformer blocks of the edge model are permuted by permuting the weight parameters in the Transformer blocks as follows: IN' q =π T IN q ,IN' k =π T IN k ,IN' v =π T IN v , W′ o =W o π,γ′1=γ1π,β′1=β1π, IN' a =π T IN a ,IN' b =In b π, γ′2=γ2π,β′2=β2π Among them, π is the authorization information, W′ q , W′ k , W′ v , W′ o ,γ′1,β′1,W′ a , W′ b , γ′2 and β′2 are the weight parameters after permutation; 3) Based on the authorization information, parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locking model are permuted. The locking model after parameter permutation is the final locking model; an authorization module is constructed based on the OTP technology and the authorization information. The authorization module is used to add authorization information to the output of the (MN)th Transformer block of the final locking model during data processing; 4) Deploy the final locking model on the GPU and deploy the authorization module in the trusted execution environment.

2. The edge model protection method based on model locking according to claim 1 is characterized in that: The authorization information is a permutation matrix π, ππ T =I, where I is the identity matrix.

3. The edge model protection method and system based on model locking according to claim 1 is characterized in that: In step 2), the parameter permutation of the token classification layer is as follows: multiply the parameter matrix of the token classification layer by π on the left. T , where π is the authorization information.

4. The edge model protection method based on model locking according to claim 1 is characterized in that: In step 3), the parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locked model are replaced based on the authorization information, specifically: Among them, π is the authorization information, and is the weight parameter after permutation.

5. The edge model protection method based on model locking according to claim 1 is characterized in that: The authorization information is added to the output of the (MN)th Transformer block in the final locking model during data processing, specifically: Generate a random mask matrix m through OTP technology, and use the authorization information π and the random mask matrix m to encrypt and replace the intermediate variables a, b, and y of the (MN)th Transformer block: a′=aπ+mπ b″=(b′-mW b )p y′=yπ Where b′=b+mW b is the output of the second linear layer of the MLP layer after parameter permutation, a′, b″, and y′ are the encrypted and permuted variables; The output of the (MN)th Transformer block after encryption and permutation is z′=zπ.

6. An edge model protection system based on model locking, which is used to implement the method of claim 1, the system comprising: Model building module, used for formulating modeling of the model to be protected; The model locking module is used to replace the parameters of the last N Transformer blocks and token classification layer of the model based on the authorization information. It is also used to replace the parameters of the last MLP layer and the second normalization layer in the (MN)th Transformer block of the locked model; Authorization module, used to add authorization information to the output of the (MN)th Transformer block; Deployment module, used to deploy locking model and authorization module.

Images