TEE-based end-side deep neural network model protection method and system

Abstract

The invention discloses a TEE (Trusted Execution Environment)-based end-side deep neural network model protection method and system. The method comprises the following steps: executing weight confusion for L linear layers, needing to be deployed in a rich execution environment REE outside a TEE, of a protected pre-training model; storing an original weight of the pre-training model as a current weight; independently carrying out intra-layer search on L linear layers of the pre-training model; for the obtained L confusion models, calculating a loss function value based on a preset loss function, and using the weight of the confusion model with the maximum loss function value as the current weight of the pre-training model to continue iterative intra-layer search until the number of cross-layer search times is equal to a preset cross-layer search round, and determining a finally obtained confusion model and a noise weight thereof. The objective of the invention is to reduce the accuracy of the confusion model to a random guess degree and ensure that the accuracy of the recovered pre-training model is not affected only by modifying the minimum weight of the pre-training model.

Description

Technical Field

[0001] The present invention relates to data security and privacy protection technologies in the field of artificial intelligence, and specifically to a TEE-based end-side deep neural network model protection method and system. Background Art

[0002] With the rapid development of deep learning technology, neural network models play an important role in face recognition, autonomous driving, search engines and other fields. The training of neural network models often requires a large amount of data and computing resources, which is a valuable intellectual property for the model owner. In order to reduce the data privacy risks of users and cope with real-time tasks, more and more models are deployed on end-side devices for local reasoning. However, the models deployed on the end-side devices are easily directly extracted by attackers in the memory during operation, thereby reconstructing the entire model and damaging the intellectual property rights of the model owner.

[0003] Existing research proposes to implement confidential reasoning on devices to prevent unauthorized model extraction. The most promising method is to use TEE on the end-side device to isolate (part of) the model reasoning process to protect its confidentiality. Existing methods are mainly divided into four categories: 1) Use TEE to isolate the entire reasoning process; 2) Use TEE to isolate the calculation of some layers; 3) Perform linear transformation on the weights of the linear layer of the model and then offload it to a common computing environment (rich execution environment, REE) for calculation, correct the calculation results of the transformed linear layer in the TEE, and deploy the nonlinear layer to the TEE for reasoning; 4) Select some weights of the linear layer of the model for (noise) transformation, deploy the transformed linear layer to a common computing environment, remove the influence of obfuscated weight noise on the intermediate calculation results in the TEE, and deploy the nonlinear layer to the TEE for reasoning. Due to the limitations of TEE's memory and computing resources, the above methods 1) and 2) are difficult to meet the needs of models with large parameter quantities, such as VGG16. Method 3) requires transforming all weights. For convolutional neural networks, the memory overhead of the TEE is approximately equal to the number of convolutional layer parameters divided by the size of the convolution kernel. For networks with small convolution kernels, such as MobileNet-V2, the memory overhead is comparable to that of the original model. The technical route of this application follows the idea of ​​method 4). Since the attacker can obtain the obfuscated model, and the time complexity and space complexity of restoring the intermediate result calculation in the TEE are related to the number of obfuscated weights (the more obfuscated, the more complex the recovery calculation, and the greater the time and memory overhead), method 4) needs to meet the following requirements: the obfuscated weights are small enough to meet the memory limit of the TEE, the accuracy of the obfuscated model is low enough so that the attacker can only obtain a low-precision model, and the obfuscated weights are difficult for the attacker to detect. Currently, the most advanced technologies are Magnitude (Hou J, Liu H, Liu Y, et al. Model protection: Real-time privacy-preservinginference service for model privacy at the edge[J]. IEEE Transactions onDependable and Secure Computing, 2021, 19(6): 4270-4284.) and NNSplitter (Zhou T, Luo Y, Ren S, et al. NNSplitter: an active defense solution for DNN model via automated weight obfuscation[C] / / International Conference on Machine Learning. PMLR, 2023: 42614-42624.).

[0004] Based on the idea of ​​amplitude pruning, Magnitude selects the 1% of weights with the largest absolute value in the linear layer for obfuscation by adding random Gaussian noise. However, Magnitude only considers the weight selection criteria within one layer, ignoring that different layers have different importance for the inference results, and the weight ratios selected for each layer should not be the same. It also does not provide a more effective obfuscation method to reduce the accuracy of the model, resulting in the need to select too many weights for obfuscation. In addition, since the absolute maximum weight modified by Magnitude is at the boundary of the weight distribution, modifying these weights is more easily detected by attackers.

[0005] NNSplitter uses reinforcement learning to select a certain number of filters and shuffle the weights in those filters, which are located at , where the hyperparameters and Depending on the distribution of weights, for the obfuscation method, NNSplitter retrains to update only the selected weights, and reduces the accuracy of the obfuscated model by setting the objective function to increase the loss function value. However, for NNSplitter, the entire obfuscation algorithm is too complicated, and the cost of executing the obfuscation algorithm is huge for the model owner (2 to 4 times the training cost), and the hyperparameters are and Relying on the prior knowledge of experts does not generalize well to different models and datasets. Therefore, it is necessary to design a lightweight obfuscation method that has low overhead and meets the above security and performance requirements: a small number of obfuscation weights, low obfuscation model accuracy, and obfuscated weights that are difficult to detect. Summary of the invention

[0006] Technical problem to be solved by the present invention: In view of the above-mentioned problems in the prior art, a method and system for protecting a terminal deep neural network model based on TEE are provided. The present invention aims to reduce the accuracy of the obfuscated model to the level of random guessing by only modifying the weights of the pre-trained model minimally and ensure that the accuracy of the restored pre-trained model is not affected.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is: A method for protecting a terminal-side deep neural network model based on TEE, including: L A linear layer performs weight confusion: S1, save the original weights of the pre-trained model as the current weights; S2, respectively for the pre-trained model LThe intra-layer search of each linear layer is performed independently. The intra-layer search of any linear layer includes: using the current weight of the pre-trained model and the training data set to calculate the absolute value of the weight gradient for the linear layer and sorting and selecting a specified number of current weights with the largest absolute value of the weight gradient, adding noise weights to the selected current weights, and repeating the preset intra-layer search rounds for the linear layer to obtain a confusion model after only confusing the weights of the linear layer; S3, perform cross-layer search for the pre-trained model: if the number of cross-layer searches is equal to the preset number of cross-layer search rounds, jump to step S4, otherwise L The confusion models calculate the loss function value based on the preset loss function, use the weight of the confusion model with the largest loss function value as the current weight of the pre-trained model, and jump to step S2; S4, taking the confusion model with the largest loss function value as the final confusion model, and subtracting the original weight of the pre-trained model from the weight of the confusion model to obtain the noise weight of the confusion model, and outputting the confusion model and its noise weight.

[0008] Optionally, in step S2, the function expression of using the current weights of the pre-trained model and the training data set to calculate the absolute value of the weight gradient for the linear layer and sorting and selecting a specified number of current weights with the largest absolute value of the weight gradient is: , In the above formula, For the The current weights of the linear layer The specified number of current weights with the largest absolute value of weight gradient, Indicates selecting the maximum specified number The current weight, For the The current weights of the linear layer The weight gradient of For pre-trained models Use the current weight set For training data The loss function value is For pre-trained models Use the current weight set For the training set data Output.

[0009] Optionally, after adding noise to the current weight selected in step S2, the selected current weight is further truncated to the nearest boundary if the new current weight exceeds a preset range according to the following formula: , In the above formula, The truncation parameter is used to truncate the data, and To control the parameters, and To represent the The current weights of the linear layer The maximum and minimum values ​​of ; is a positive number used as noise weight; It is a sign function, which outputs 1 when the input is greater than 0, -1 when the input is less than 0, and 0 when the input is equal to 0; for The weight gradient of .

[0010] Optionally, after step S4, the following steps are further included: S101, deploying the obfuscation model on the edge device, including: deploying the linear layer of the pre-trained model in the rich execution environment REE of the edge device, deploying the remaining layers in the trusted execution environment TEE of the edge device, weight-filling the linear layer with obfuscation weights, inserting a denoising layer between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, and inserting a noise layer between the linear layer and the previous layer in the trusted execution environment TEE to add weight noise to the input data of the linear layer; S102, input the input data into the obfuscation model deployed on the edge device, perform reasoning calculations layer by layer through the obfuscation model, and finally find the label of the result in the trusted execution environment TEE and return it to the rich execution environment REE.

[0011] Optionally, when a denoising layer is inserted between the linear layer and the next layer in the trusted execution environment TEE in step S101 to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, if there is no noise layer before the linear layer, the function expression of the denoising layer is: , In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation results are: is the operator corresponding to the linear layer before the denoising layer, and ,in is the confusion weight of the linear layer before the denoising layer, is the original weight of the linear layer before the denoising layer; If there is a noise layer before the linear layer, the function expression of the denoising layer is: , In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation results are: Using operators for denoising layers Based on the original weights of the linear layer before the denoising layer For input noise data The calculation results are: Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input noise data The calculation results are: is the operator corresponding to the linear layer before the denoising layer, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

[0012] Optionally, when a noise adding layer is inserted between the linear layer and the upper layer in the trusted execution environment TEE in step S101 to add weight noise to the input data of the linear layer, the function expression of the noise adding layer is: , In the above formula, is the output of the noise layer and the input of the linear layer after the noise layer, For input data, is the input noise data, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

[0013] Optionally, the pre-trained model in this embodiment is a convolutional neural network model, the linear layer is a convolutional layer, and the input data of the pre-trained model is a picture to be classified and identified.

[0014] In addition, the present invention also provides a TEE-based end-side deep neural network model protection system, comprising an interconnected microprocessor and a memory, wherein the microprocessor is programmed or configured to execute the TEE-based end-side deep neural network model protection method.

[0015] In addition, the present invention also provides a computer-readable storage medium, which stores a computer program or instruction, and the computer program or instruction is programmed or configured to execute the TEE-based end-side deep neural network model protection method through a processor.

[0016] In addition, the present invention also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TEE-based end-side deep neural network model protection method through a processor.

[0017] Compared with the prior art, the present invention has the following advantages: the present invention includes a method for deploying protected pre-trained models in a rich execution environment (REE) outside a trusted execution environment (TEE). L The linear layers perform weight confusion: save the original weights of the pre-trained model as the current weights; L The linear layers perform intra-layer search independently; for the obtained L A confusion model calculates a loss function value based on a preset loss function, uses the weight of the confusion model with the largest loss function value as the current weight of the pre-trained model, and continues to iterate the intra-layer search until the number of cross-layer searches is equal to the preset cross-layer search rounds, and determines the final confusion model and its noise weight. Compared with the prior art, the present invention only needs to modify the minimum weights of the pre-trained model to reduce the accuracy of the confusion model to the level of random guessing and ensure that the accuracy of the restored pre-trained model is not affected, and has the advantages of safety, reliability, good generalization, and low execution overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Schematic diagram of the basic process of weight confusion in an embodiment of the present invention.

[0019] Figure 2 Schematic diagram of the basic principle of weight confusion in an embodiment of the present invention.

[0020] Figure 3 The figure is a schematic diagram of a specific process of weight confusion in an embodiment of the present invention.

[0021] Figure 4 Schematic diagram of deployment of the obfuscation model in an embodiment of the present invention.

[0022] Figure 5 Schematic diagram of the framework structure of the terminal side device in an embodiment of the present invention. DETAILED DESCRIPTION

[0023] Before deploying the protected pre-trained model, the model owner needs to perform a pre-processing process to perform an obfuscation transformation on the pre-trained model and save the obfuscation weights (obfuscation model) and noise weights for subsequent model inference. Figure 1 As shown, the end-side deep neural network model protection method based on TEE in this embodiment includes the following steps: L A linear layer performs weight confusion: S1, save the original weights of the pre-trained model as the current weights; S2, respectively for the pre-trained model L The intra-layer search of each linear layer is performed independently. The intra-layer search of any linear layer includes: using the current weight of the pre-trained model and the training data set to calculate the absolute value of the weight gradient for the linear layer and sorting and selecting a specified number of current weights with the largest absolute value of the weight gradient, adding noise weights to the selected current weights, and repeating the preset intra-layer search rounds for the linear layer to obtain a confusion model after only confusing the weights of the linear layer; S3, perform cross-layer search for the pre-trained model: If the number of cross-layer searches is equal to the preset cross-layer search round number inter cross Then jump to step S4, otherwise for the obtained L The confusion model calculates the loss function value based on the preset loss function, uses the weight of the confusion model with the largest loss function value as the current weight of the pre-trained model, increases the number of cross-layer searches by 1, and jumps to step S2; S4, taking the confusion model with the largest loss function value as the final confusion model, and subtracting the original weight of the pre-trained model from the weight of the confusion model to obtain the noise weight of the confusion model, and outputting the confusion model and its noise weight.

[0024] The model obfuscation algorithm in this embodiment (i.e., steps S1 to S4) can be executed by the owner of the pre-trained model. Its input is the pre-trained model and part of the data set (usually a BatchSize of data in the training set), and its output is the obfuscated model and the relevant information of the noise weight (including the position and size). The model obfuscation algorithm in this embodiment is divided into two parts: intra-layer search and cross-layer search. The intra-layer search will independently perform weight obfuscation on each linear layer, and finally only use the layer with the largest model loss function value after obfuscation. Specifically, for an owner L Pre-trained model with 100 linear layers , the model confusion algorithm in this embodiment performs intra-layer search independently on the 1st, 2nd, ..., Lth layers. Using the pre-trained model Calculate the absolute value of the weight gradient based on the training data set, sort the weights according to the absolute value of the weight gradient, and select the largest specified number in the layer The weights add noise, and the positive and negative signs of the noise are consistent with the gradient values ​​corresponding to the weights, and its absolute value is a random small positive number. Figure 2 The first linear layer (1 st ) to get the current weight The weight gradient , in the specified number In the case of , select the maximum specified number in the layer The weights added with noise are Figure 2 The current weight corresponding to the value of -0.512 adds noise; according to Figure 2 The second linear layer (2 rd ) to obtain the current weight The weight gradient , in the specified number In the case of , select the maximum specified number in the layer The weights added with noise are Figure 2 The value of -0.712 in the above example adds noise to the current weight. After adding noise, the gradient is recalculated using the obfuscated model, and the preset intra-layer search rounds are repeated iter BIM After the round, record the confusion model. At this time, the models corresponding to the confusion of different layers are After the intra-layer search is completed, perform a cross-layer search and use the obtained L The confusion model calculates the loss function value , compare the size of the loss function value, use the model corresponding to the largest loss function value to update the original model, re-execute the intra-layer search, and repeat the preset cross-layer search round iter cross After the round, the final confusion model is obtained. The noise information can be obtained by using the confusion model and the original pre-trained model. The noise weight can be obtained by subtracting the original weight from the confusion weight layer by layer. The non-zero value in the noise weight is the noise added to the selected weight, and the zero value is the unselected weight (noise is 0). Recording the coordinate information and value size corresponding to these non-zero values ​​can obtain the noise information required for inference.

[0025] A key innovation of this embodiment is that adding noise weights to a linear layer does not mean adding noise weights to all weight parameters of the linear layer, but rather selecting some weight parameters to add noise weights, so that only the minimum weights of the pre-trained model need to be modified to reduce the accuracy of the obfuscated model to the level of random guessing and ensure that the accuracy of the restored pre-trained model is not affected. As an optional implementation, in step S2 of this embodiment, the current weights of the pre-trained model and the training data set are used to calculate the absolute value of the weight gradient for the linear layer and sort and select the specified number of current weights with the largest absolute value of the weight gradient. The function expression is: , In the above formula, For the The current weights of the linear layer The specified number of current weights with the largest absolute value of weight gradient, Indicates selecting the maximum specified number The current weight, For the The current weights of the linear layer The weight gradient of For pre-trained models Use the current weight set For training data The loss function value is For pre-trained models Use the current weight set For the training set data Based on the above function expression, we can know that That is the The current weights of the linear layer A subset of .

[0026] After adding noise weight to the selected current weight, the weight after adding noise weight may exceed the preset range [ a , b ], truncating it to the nearest boundary a or b , the process can be expressed as: , In the above formula, The truncation parameter is used to truncate the value exceeding [ a , b ] to the nearest boundary a or b , is a positive number used as noise weight; It is a sign function, which outputs 1 when the input is greater than 0, -1 when the input is less than 0, and 0 when the input is equal to 0; for The weight gradient of . The above preset range [ a , b ] can be taken according to actual needs. For example, as an optional implementation, after adding noise to the current weight selected in step S2 of this embodiment, the selected current weight is also included in the following formula. If the new current weight exceeds the preset range, it is truncated to the nearest boundary: , In the above formula, The truncation parameter is used to truncate the data, and To control the parameters, and To represent the The current weights of the linear layer The maximum and minimum values ​​of ; is a positive number used as noise weight; It is a sign function, which outputs 1 when the input is greater than 0, -1 when the input is less than 0, and 0 when the input is equal to 0; for The weight gradient of .

[0027] like Figure 3 As shown, the model confusion algorithm in this embodiment specifically includes: S1.1, input protected pre-trained model The weight set and training data of the training set data ,in ~ They are the protected pre-trained models No.1~ L The original weights of the linear layers, For input data, is the label data; S1.2, Initialize loop variables is 1; S1.3, initialize the loss function array Empty, weight array is empty; S1.4, Initialize loop variables is 1; S1.5, save the model at this time The weight set for , save the The weights of the linear layer Weight , that is, save the original weights of the pre-trained model as the current weights; S1.6, Initialize loop variables is 1; S1.7, using the current weights of the pre-trained model and the training dataset for the The linear layers calculate the absolute value of the weight gradient and sort and select the specified number of current weights with the largest absolute value of the weight gradient : , The current weight of the selection Generate a random positive number As the size of the weight noise, the positive and negative signs of the weight noise and the weight gradient The sign of is the same as that of The current weights of the linear layer And truncate the value that exceeds the preset range; S1.8, determine the loop variable The value is less than the preset number of layer search iterations Is it true? If so, the loop variable The value of is increased by 1, and the process jumps to step S1.7; otherwise, The weights after the linear layer confusion (adding weight noise) Append to weights array In the example, the weight set after adding noise is ,according to Update obfuscation The loss function value after the weights of the linear layer , and the loss function value Append to the loss function array In, restore The weights of the linear layer The weight saved before this round of confusion ; S1.9, determine the loop variable The value of is less than the total number of linear layers of the protected pre-trained model L Is it true? If so, the loop variable The value of is increased by 1, and the process jumps to step S1.5; otherwise, according to From the loss function array Remove the maximum loss function value The index value is used as the loop variable The value of Update Linear layer weights ,in is the weight array The first weights; S1.10, determine the loop variable The value is less than the preset number of cross-layer search iterations Is it true? If not, output the weight set , end and jump to step S2; otherwise, the loop variable Add 1 to the value and jump to step S1.3.

[0028] In addition, in this embodiment, after step S4, the following steps are also included: S101, deploying the obfuscation model on the edge device, including: deploying the linear layer of the pre-trained model in the rich execution environment REE of the edge device, deploying the remaining layers in the trusted execution environment TEE of the edge device, weight-filling the linear layer with obfuscation weights, inserting a denoising layer between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, and inserting a noise layer between the linear layer and the previous layer in the trusted execution environment TEE to add weight noise to the input data of the linear layer; S102, input the input data into the obfuscation model deployed on the edge device, perform reasoning calculations layer by layer through the obfuscation model, and finally find the label of the result in the trusted execution environment TEE and return it to the rich execution environment REE.

[0029] After obtaining the obfuscation model and noise weights, they need to be securely deployed to the edge device. The noise weights are encrypted by the model owner, and the key is obtained through asymmetric key exchange with the trusted execution environment TEE of the edge device. After the obfuscation model and encrypted noise information are downloaded by the edge device, they are loaded into the rich execution environment REE. The noise information is forwarded from the rich execution environment REE to the trusted execution environment TEE for decryption and use. After the model is installed, the client program loads the model file and obfuscation weights. After the linear layer is built, the obfuscation weights are used to fill the weights and are deployed to the rich execution environment REE. The remaining layers are built and weighted on the trusted execution environment TEE side by calling the trusted application through the client program. In this embodiment, when the obfuscation model is deployed on the edge device, the input is the model file of the pre-trained model and the obfuscation weight (the two constitute the obfuscation model). The model file of the pre-trained model and the obfuscation weight are loaded into the rich execution environment REE and the trusted execution environment TEE respectively. The linear layer of the obfuscation model is deployed in the rich execution environment REE, and the nonlinear layer is deployed in the trusted execution environment TEE. At the same time, the denoising layer used to restore the intermediate reasoning results is deployed in the trusted execution environment TEE. In order to prevent attackers from inferring the original weight size by observing the intermediate input and intermediate output of the trusted execution environment TEE, it is necessary to add noise to the results restored by the trusted execution environment TEE and then forward them to the rich execution environment REE. Therefore, the recovery calculation is divided into two cases: 1) Recovery of the calculation results of the first obfuscation layer: only the influence of noise in the weight needs to be removed; 2) Recovery of the calculation results of the remaining obfuscation layers: the influence of noise in the weight and input needs to be removed. Through layer-by-layer calculation, the final reasoning result is returned by the trusted execution environment TEE. In order to defend against member reasoning attacks based on confidence scores, the trusted execution environment TEE only returns the result label to the rich execution environment REE, but does not return the confidence score and probability vector.

[0030] In step S101 of this embodiment, when a denoising layer is inserted between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, if there is no noise layer before the linear layer, the function expression of the denoising layer is: , In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation results are: is the operator corresponding to the linear layer before the denoising layer, and ,in is the confusion weight of the linear layer before the denoising layer, is the original weight of the linear layer before the denoising layer; If there is a noise layer before the linear layer, the function expression of the denoising layer is: , In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation results are: Using operators for denoising layers Based on the original weights of the linear layer before the denoising layer For input noise data The calculation results are: Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input noise data The calculation results are: is the operator corresponding to the linear layer before the denoising layer, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

[0031] In step S101 of this embodiment, when a noise adding layer is inserted between the linear layer and the upper layer in the trusted execution environment TEE to add weight noise to the input data of the linear layer, the function expression of the noise adding layer is: , In the above formula, is the output of the noise layer and the input of the linear layer after the noise layer, For input data, is the input noise data, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

[0032] The pre-trained model in this embodiment is a convolutional neural network model, the linear layer is a convolutional layer, and the input data of the pre-trained model is a picture to be classified and identified. Figure 4The figure shows an example of a convolutional neural network model in this embodiment, where the convolutional neural network model consists of a first convolutional layer Conv1, a first ReLU activation function layer (ReLU 1), a second convolutional layer Conv2, a second ReLU activation function layer (ReLU 2), and a Softmax activation function layer connected in sequence, and the confusion model consists of a first convolutional layer Conv1, a first denoising layer, a first ReLU activation function layer, a noise adding layer, a second convolutional layer Conv2, a second denoising layer, a second ReLU activation function layer, and a Softmax activation function layer connected in sequence, and wherein the first convolutional layer Conv1 and the second convolutional layer Conv2 are deployed in the rich execution environment REE of the edge device and are weighted using confusion weights, the first denoising layer, the first ReLU activation function layer, the noise adding layer, the second denoising layer, the second ReLU activation function layer, and the Softmax activation function layer are all deployed in the trusted execution environment TEE of the edge device, and the first denoising layer only eliminates the influence of the weight noise of the linear layer; the second and subsequent denoising layers need to eliminate the influence of the noise of the linear layer and the previous noise adding layer on the result. In this embodiment, the user issues an inference request and hands the input image to the client program, which converts the image data into the input format required by the model and then performs inference layer by layer. When it is necessary to switch from the layer of the rich execution environment REE to the trusted execution environment TEE or from the layer of the trusted execution environment TEE back to the rich execution environment REE, the client program and the trusted application transfer input and output through shared memory. Figure 4 Take the convolutional neural network model in as an example. After the image is processed by the client program, it is forwarded to the model. At this time, the first convolution layer Conv1 in the rich execution environment REE accepts the input, and after calculation, the calculation result and the input before calculation are forwarded to the denoising layer in the trusted execution environment TEE. The denoising layer calculates to obtain the correct result after denoising, and then forwards the result to the first ReLU activation function layer ReLU1. After the first ReLU activation function layer ReLU1 completes the calculation, it forwards the result to the denoising layer. The denoising layer adds a layer of mask (noise) to the input and forwards it to the rich execution environment REE. The second convolutional layer Conv2, then the second convolutional layer Conv2 performs convolution calculations and forwards the calculation results and the input of the second convolutional layer Conv2 to the denoising layer in the trusted execution environment TEE. At this time, the denoising layer also needs to request the pre-calculated results from the trusted execution environment TEE, and use the results forwarded by Conv2 to subtract the pre-calculated results and the convolution calculation results with parameters as noise information and input as the input of the second convolutional layer Conv2. The calculated results are forwarded to the next layer to complete the calculation of the second ReLU activation function layer ReLU2 layer, and then forwarded to the Softmax activation function layer. Calculations are performed layer by layer, and finally the trusted execution environment TEE obtains the calculation results, which are probability vectors. For example, for the handwritten digit recognition task, after Figure 2After the Softmax activation function layer is calculated, a vector is finally obtained. At this time, the trusted execution environment TEE does not return the result to the rich execution environment REE, but returns the index value of the largest element in the vector to the rich execution environment REE, for example At most, the trusted execution environment TEE returns the index value 3 to the rich execution environment REE, and the label corresponding to the index value 3 can be obtained by the rich execution environment REE by querying the label index.

[0033] like Figure 5 As shown, in this embodiment, when the obfuscation model is deployed on the edge device, the model is first constructed in the rich execution environment REE and the trusted execution environment TEE, including layer construction and weight filling according to the model file and obfuscation weight of the input pre-trained model, and the model construction is realized by using the client program in the rich execution environment REE. Model construction includes: deploying the linear layer of the pre-trained model in the rich execution environment REE of the edge device, deploying the remaining layers in the trusted execution environment TEE of the edge device, filling the linear layer with obfuscation weights, inserting a denoising layer between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, and inserting a noise layer between the linear layer and the upper layer in the trusted execution environment TEE to add weight noise to the input data of the linear layer. Then, the client program can be used to load data, including loading external input images. If necessary, other preprocessing such as image deformation can be performed on the loaded images. Then, the obfuscation model constructed in the rich execution environment REE and the trusted execution environment TEE can be used for reasoning to realize result prediction and output the index with the highest probability.

[0034] The complete processing of the pre-trained model in the method of this embodiment includes: 1) before the pre-trained model is deployed, the model obfuscation algorithm in this embodiment (i.e., steps S1 to S4) is executed to obtain the obfuscated model, and the noise weight is obtained by subtracting the original weight from the obfuscated weight, and the noise weight and the obfuscation model are saved for subsequent deployment; 2) the obfuscation model and the encrypted noise weight information are loaded into the rich execution environment REE, and the rich execution environment REE forwards the noise information to the trusted execution environment TEE and decrypts it in the trusted execution environment TEE; 3) the client program is executed to build the model, the linear layer is deployed to the rich execution environment REE, and the nonlinear layer, the denoising layer, and the noise adding layer are built in the trusted execution environment TEE by the rich execution environment REE calling the trusted application in the trusted execution environment TEE; 4) the inference request is processed, and the inference calculation is performed layer by layer; 5) the inference result is processed, and the trusted execution environment TEE searches for the label of the result and returns it to the rich execution environment REE.

[0035] In order to verify the method of this embodiment, the method of this embodiment and the existing NNSplitter and Magnitude were compared on four pre-trained models of VGG-16, ResNet-18, MobileNet-V2 and DenseNet-121 respectively based on the existing CIFAR-10, CIFAR-100 and ImageNet data sets. The experimental results are shown in Table 1.

[0036] Table 1: Experimental results of the method of this embodiment and the existing method

[0037] As shown in Table 1, compared with the existing NNSplitter and Magnitude methods, the number and proportion of the obfuscation weights of this embodiment are significantly better than the existing NNSplitter method, and the "Top-1 / Top-5 accuracy of the obfuscation model" index of this embodiment is better than the existing NNSplitter and Magnitude methods. Moreover, for the three data sets of CIFAR-10, CIFAR-100 and ImageNet and the four pre-trained models of VGG-16, ResNet-18, MobileNet-V2 and DenseNet-121, the method of this embodiment has achieved a good recovery result accuracy, especially on the CIFAR-10 data set, the four pre-trained models of VGG-16, ResNet-18, MobileNet-V2 and DenseNet-121 have achieved very good recovery result accuracy. It can be seen that the method of this embodiment can reduce the accuracy of the obfuscation model to the level of random guessing, and the accuracy of the result is not affected after the recovery algorithm is restored, and it has the advantages of low memory overhead and additional computing overhead of the trusted execution environment TEE and high security.

[0038] In addition, this embodiment also provides a TEE-based end-side deep neural network model protection system, including an interconnected microprocessor and a memory, wherein the microprocessor is programmed or configured to execute the TEE-based end-side deep neural network model protection method.

[0039] In addition, this embodiment also provides a computer-readable storage medium, which stores a computer program or instructions, and the computer program or instructions are programmed or configured to execute the TEE-based end-side deep neural network model protection method through a processor.

[0040] In addition, this embodiment also provides a computer program product, including a computer program or instructions, which are programmed or configured to execute the TEE-based end-side deep neural network model protection method through a processor.

[0041] Those skilled in the art should understand that the technical solutions provided by the embodiments of the present application may be in the form of methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0042] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A TEE-based end-side deep neural network model protection method, characterized in that: Including the protected pre-trained model that needs to be deployed in the rich execution environment REE outside the trusted execution environment TEE L A linear layer performs weight confusion: S1, save the original weights of the pre-trained model as the current weights; S2, respectively for the pre-trained model L The intra-layer search of each linear layer is performed independently. The intra-layer search of any linear layer includes: using the current weight of the pre-trained model and the training data set to calculate the absolute value of the weight gradient for the linear layer and sorting and selecting a specified number of current weights with the largest absolute value of the weight gradient, adding noise weights to the selected current weights, and repeating the preset intra-layer search rounds for the linear layer to obtain a confusion model after only confusing the weights of the linear layer; S3, perform cross-layer search for the pre-trained model: if the number of cross-layer searches is equal to the preset number of cross-layer search rounds, jump to step S4, otherwise L The confusion models calculate the loss function value based on the preset loss function, use the weight of the confusion model with the largest loss function value as the current weight of the pre-trained model, and jump to step S2; S4, taking the confusion model with the largest loss function value as the final confusion model, and subtracting the original weight of the pre-trained model from the weight of the confusion model to obtain the noise weight of the confusion model, and outputting the confusion model and its noise weight.

2. The TEE-based end-side deep neural network model protection method according to claim 1 is characterized in that: In step S2, the current weights of the pre-trained model and the training data set are used to calculate the absolute value of the weight gradient for the linear layer and sort and select the specified number of current weights with the largest absolute value of the weight gradient: ， In the above formula, For the The current weights of the linear layer The specified number of current weights with the largest absolute value of weight gradient, Indicates selecting the maximum specified number The current weight, For the The current weights of the linear layer The weight gradient of For pre-trained models Use the current weight set For training data The loss function value is For pre-trained models Use the current weight set For the training set data Output.

3. The TEE-based end-side deep neural network model protection method according to claim 2 is characterized in that: After adding noise to the current weight selected in step S2, the selected current weight is further truncated to the nearest boundary if the new current weight exceeds the preset range according to the following formula: ， In the above formula, The truncation parameter is used to truncate the data, and To control the parameters, and To represent the The current weights of the linear layer The maximum and minimum values ​​of ; is a positive number used as noise weight; It is a sign function, which outputs 1 when the input is greater than 0, -1 when the input is less than 0, and 0 when the input is equal to 0; for The weight gradient of .

4. The method for protecting a terminal-side deep neural network model based on TEE according to any one of claims 1 to 3, characterized in that: After step S4, the following steps are also included: S101, deploying the obfuscation model on the edge device, including: deploying the linear layer of the pre-trained model in the rich execution environment REE of the edge device, deploying the remaining layers in the trusted execution environment TEE of the edge device, weight-filling the linear layer with obfuscation weights, inserting a denoising layer between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, and inserting a noise layer between the linear layer and the previous layer in the trusted execution environment TEE to add weight noise to the input data of the linear layer; S102, input the input data into the obfuscation model deployed on the edge device, perform reasoning calculations layer by layer through the obfuscation model, and finally find the label of the result in the trusted execution environment TEE and return it to the rich execution environment REE.

5. The TEE-based end-side deep neural network model protection method according to claim 4 is characterized in that: In step S101, when a denoising layer is inserted between the linear layer and the next layer in the trusted execution environment TEE to eliminate the weight noise of the linear layer and the influence of the noise layer before the linear layer on the result, if there is no noise layer before the linear layer, the function expression of the denoising layer is: ， In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation result is is the operator corresponding to the linear layer before the denoising layer, and ,in is the confusion weight of the linear layer before the denoising layer, is the original weight of the linear layer before the denoising layer; If there is a noise layer before the linear layer, the function expression of the denoising layer is: ， In the above formula, is the output result of the denoising layer, is the calculation result of the linear layer before the denoising layer based on the confusion weight calculation output, Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input data The calculation result is Using operators for denoising layers Based on the original weights of the linear layer before the denoising layer For input noise data The calculation result is Using operators for denoising layers Weighted noise based on the linear layer before the denoising layer For input noise data The calculation result is is the operator corresponding to the linear layer before the denoising layer, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

6. The method for protecting a terminal-side deep neural network model based on TEE according to claim 5 is characterized in that: When a noise adding layer is inserted between the linear layer and the upper layer in the trusted execution environment TEE in step S101 to add weight noise to the input data of the linear layer, the function expression of the noise adding layer is: ， In the above formula, is the output of the noise layer and the input of the linear layer after the noise layer, For input data, is the input noise data, where the input noise data When the obfuscation model is deployed on the edge device, it is randomly generated by the trusted execution environment TEE and saved in the trusted execution environment TEE. The shape and size are the same as the input data Same tensor.

7. The method for protecting a terminal-side deep neural network model based on TEE according to claim 1, characterized in that: The pre-trained model is a convolutional neural network model, the linear layer is a convolutional layer, and the input data of the pre-trained model is a picture to be classified and identified.

8. A TEE-based end-side deep neural network model protection system, comprising an interconnected microprocessor and a memory, characterized in that: The microprocessor is programmed or configured to execute the TEE-based end-side deep neural network model protection method described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program or instruction stored therein, characterized in that: The computer program or instruction is programmed or configured to execute the TEE-based end-side deep neural network model protection method described in any one of claims 1 to 7 through a processor.

10. A computer program product comprising a computer program or instructions, characterized in that The computer program or instruction is programmed or configured to execute the TEE-based end-side deep neural network model protection method described in any one of claims 1 to 7 through a processor.

Images