Obfuscating inference operations of machine learning models

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for performing inference operations of machine learning models. One of the methods includes receiving, by a hardware device, data representing a machine learning model, the machine learning model including a plurality of model parameters for inference operations. A hardware device includes a set of computing units arranged in one or more processing elements. Instructions are obtained for performing an obfuscation operation configured to obfuscate one or more measurable characteristics of a machine learning model when the machine learning model is executed by one or more processing elements. A first portion of a set of computing elements is caused to perform an inference operation of a machine learning model, and a second portion of the set of computing elements is caused to perform an obfuscation operation concurrently with the first portion of the set of computing elements performing the inference operation.

Description

Technical Field

[0001] The present specification generally relates to a hardware device configured to perform inference operations of a machine learning model. In particular, the present specification describes techniques for obfuscating inference operations of a machine learning model compiled on a hardware device. Background Art

[0002] Artificial intelligence (AI) is intelligence exhibited by machines and represents the ability of a computer program or machine to think and learn. One or more computers can be used to perform calculations to train machine learning models for corresponding tasks. Neural networks belong to a subfield of machine learning models.

[0003] A neural network may employ one or more layers of nodes representing a variety of operations (e.g., vector or matrix operations). One or more computers may be configured to perform operations or calculations of the neural network to generate an output, such as a classification, prediction, or segmentation of a received input. In addition to the output layer, some neural networks also include one or more hidden layers. The output of each hidden layer is used as an input to the next layer in the network (i.e., the next hidden layer or output layer). Each layer of the network generates an output from the received input according to the current values ​​of the corresponding set of network parameters.

[0004] Specially designed hardware accelerators can perform specific functions and operations, including specified operations or calculations in neural networks, faster and more efficiently than operations run by a general-purpose central processing unit (CPU). Hardware accelerators can include graphics processing units (GPUs), tensor processing units (TPUs), video processing units (VPUs), field programmable gate arrays (FPGAs), or application-specific integrated circuits (ASICs). Summary of the invention

[0005] A machine learning model (e.g., a neural network) can be compiled and deployed on a hardware device after being properly trained, which is configured to perform inference operations to process input data. The inference operations are defined by parameters of the neural network that are updated during the training process. The parameters define (i) node operations (e.g., linear and nonlinear operations) for nodes in each network layer of the neural network and (ii) the structure of the neural network. For example, the parameters defining the node operations include parameters defining the activation function of each network layer and parameters defining the node weights of the nodes in the network layer. As another example, the parameters defining the structure (also referred to as hyperparameters) include at least one of the following: the number of nodes in the network layer, the number of network layers in the machine learning model (e.g., in the neural network), or node connections across adjacent layers (e.g., fully connected layers, convolutional layers, or transposed convolutional layers). For simplicity, the following description is described for a neural network, but may be applicable to other types of machine learning models.

[0006] Keeping the parameters of a trained neural network secret is critical. First, training a neural network, particularly a deep neural network, with satisfactory accuracy in generating predictions requires a significant amount of computational cost and time. Additionally, some neural networks have applications related to security-sensitive authentication, such as face unlocking tasks, where a neural network is configured to recognize a face to conveniently unlock a device. Therefore, it is critical to maintain the structure and parameters of the neural network undecipherable or at least difficult to decipher, in order to prevent a malicious actor from learning the parameters and using those parameters to perform unauthorized device unlocking.

[0007] However, different techniques can be applied to "decode" the trained neural network, especially when the neural network is implemented on a hardware device accessible to a third party (e.g., an edge device such as a smart phone, smart watch, smart tablet or other edge device). For example, a technique can measure the characteristics of the trained neural network when the hardware device performs an inference operation of the trained neural network. More specifically, the technique can collect data, such as power consumption, electromagnetic waves, or time, when the hardware device performs an inference operation, and determine the neural network parameters and structure by analyzing a characteristic profile generated based on the collected data. This technique is also called a side channel attack.

[0008] The techniques described in this specification can enhance the security of neural networks implemented on hardware devices (e.g., on edge hardware devices). For example, the described techniques defend against side channel attacks by using special hardware devices configured to concurrently perform obfuscation operations and inference operations of a deployed neural network. In this way, the described techniques can prevent side channel attacks or at least raise the threshold for the computational and / or time cost of using side channel attacks to decipher a deployed neural network.

[0009] The term "obfuscation operation" as used throughout this specification generally refers to an operation that, when performed by a hardware device concurrently with a machine learning operation (e.g., an inference operation) of a deployed neural network, causes a change in one or more measurable characteristics of the neural network, such that at least one parameter of the neural network (e.g., at least one of the number of network layers of the neural network, the number of nodes in a network layer, node operations for nodes in a network layer, or weights associated with nodes in a network layer) is obfuscated. It should be noted that different types of machine learning models include different types of parameters that define the models. The techniques described in this document can obfuscate any type of parameter that affects a measurable characteristic of a machine learning model.

[0010] The one or more measurable characteristics of a neural network generally refer to measurable data when a hardware device performs inference operations in the neural network. The measurable data may include data or profiles related to power consumption, time, electromagnetic radiation, or other measurable data, as described above.

[0011] The term "concurrently" used throughout this specification generally refers to a common time period during which both the obfuscation operation and the inference operation are performed by a hardware device. For example, the common time period may be exactly the same time period, substantially the same time period (e.g., within a threshold time period of each other), or two different time periods with an overlapping area.

[0012] Examples of obfuscation operations may be operations performed concurrently with node operations in a neural network, and may include linear or nonlinear operations of a suitable type that are different from the actual operations in the neural network. In some implementations, obfuscation operations may sometimes mimic actual operations. For example, obfuscation operations performed concurrently with node linear operations of a particular node may also be linear operations, such as addition, multiplication, and binary operations. As another example, obfuscation operations performed concurrently with node nonlinear operations of a particular node may also be nonlinear operations, such as activation functions, such as ReLU, Sigmoid, Tanh, or other suitable nonlinear operations. As another example, obfuscation operations may include tensor reduction operations that mimic action weight multiplications of network layers. Additional examples of obfuscation operations are described below.

[0013] In general, a special hardware device receives instruction data from a host or other device. The instruction data includes a compiled machine learning model having multiple model parameters for inference operations. The instruction data may include an instruction set for instructing a hardware device (e.g., one or more processors of a hardware device) to perform inference operations using a compiled machine learning model. The instruction set generally includes an inference operation specified by the machine learning model and corresponding instructions for a corresponding computing component in the hardware device to perform at least a portion of the inference operation. In some cases, the instructions may also include at least one instruction for the hardware device to perform an obfuscation operation concurrently with the inference operation. It should be noted that the received instructions may not include an obfuscation operation and a scheduling of the obfuscation operation. In this example, the hardware device may generate an obfuscation operation and a corresponding scheduling for performing the obfuscation operation on a computing unit in the hardware device in response to receiving an instruction set from the host.

[0014] The hardware device may include one or more processing elements configured to process portions of the inference operation. Each of the processing elements includes a plurality of computing units specifically arranged to perform machine learning calculations, for example, in a manner that accelerates the execution of machine learning operations. Details of the arrangement of computing units are described in more detail below.

[0015] The hardware device may determine new instructions that, based on the received instructions, cause one or more processing elements to concurrently perform inference operations of the machine learning model with obfuscation operations when executed by the hardware device. For example, the hardware device may be configured to determine the instructions by (i) modifying the instructions received from the host or (ii) generating additional instructions to be combined with the received instructions.

[0016] The hardware device may include a management component, such as an on-chip scheduler, controller, core manager, or other suitable management component, configured to determine instructions. The determined instructions may include instructions that, when executed by one or more processing elements, cause a first portion of the set of computing units to perform an inference operation of a neural network. Additionally, the determined instructions may include instructions that, when executed by one or more processing elements, cause a second portion of the set of computing units to perform an obfuscation operation concurrently with the execution of the inference operation.

[0017] In the case where the management component is configured to modify the instructions received from the host, the instructions generated by the host include scheduling data that assigns different parts of the inference operation to different processing elements. The management component generally reassigns the inference operation and the obfuscation operation to different computing units. For example, for a processing element having 16 computing units assigned to perform a first part of the inference operation indicated by the instruction received from the server, the management component modifies the received instruction and, for example, assigns one or more of the 16 computing units to perform the obfuscation operation, and reassigns the corresponding inference operation to a different computing unit, for example, located in one or more different processing elements. As another example, the processing element can modify the received instruction to instruct other components (e.g., a dedicated processing element) that are different from the processing unit to perform the obfuscation operation.

[0018] In the case where the management component is configured to generate a new instruction to be combined with the instruction received from the host. The received instruction does not include scheduling data regarding the assignment of the inference operation. Instead, the management component is configured to generate a new instruction, for example, the new instruction instructs the computing units of a first portion of the processing element to perform the inference operation of the neural network, and instructs the computing units of a second portion of the processing element that is different from the first portion to perform the obfuscation operation. In some implementations, the new instruction instructs the processing element to perform the corresponding inference operation, and instructs other components that are different from the processing element to perform the obfuscation operation. Details of modifying the instruction are described below.

[0019] The subject matter described in this specification can be implemented in specific embodiments to achieve one or more of the following advantages. Using a special hardware device to concurrently perform obfuscation operations and inference operations can effectively prevent the parameters of a deployed neural network in the hardware device from being deciphered. More specifically, the obfuscation operation can cause changes in one or more measurable characteristics of the neural network executed by the hardware device, making it difficult and more time-consuming and resource-intensive to decipher the corresponding neural network parameters based on the measurable characteristics. Therefore, the described technology enhances data security by preventing the leakage of potentially sensitive machine learning data.

[0020] The subject matter described in this specification is more advantageous from a model compilation perspective. For example, the described technology does not change existing compilation operations. The system or host does not need to modify existing neural networks and / or recompile previously compiled neural networks. Instead, previously compiled neural networks (e.g., machine-readable binary profiles) and corresponding instructions can be provided directly to the hardware device. In order to schedule and execute obfuscation operations on a special hardware device, the hardware device can adjust instructions for coordinating components in the hardware device at runtime to perform inference operations and obfuscation operations concurrently. In this way, the described technology saves a lot of research and development time for updating and compiling neural network models. This also prevents errors in machine learning models that may be introduced during the development process for including obfuscation operations.

[0021] Other implementations of this and other aspects include corresponding systems, devices, and computer programs configured to perform the actions of the method encoded on a computer storage device. A system of one or more computers may be so configured by virtue of software, firmware, hardware, or a combination thereof installed on the system that causes the system to perform the actions in operation. One or more computer programs may be so configured by virtue of having instructions that, when executed by a data processing device, cause the device to perform the actions.

[0022] Details of one or more implementations of the subject matter described in this specification are set forth in the accompanying drawings and the following description. Other potential features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 is a block diagram of an example system including hardware devices.

[0024] Figure 2 Example processing elements in a hardware device are shown.

[0025] Figure 3 An example assignment of compute units for concurrently performing inference operations and obfuscation operations is shown.

[0026] Figure 4 Another example assignment of compute units for concurrently performing inference operations and obfuscation operations is shown.

[0027] Figure 5 Another example assignment of compute units for concurrently performing inference operations and obfuscation operations is shown.

[0028] Figure 6 is an example flow chart of a process for obfuscating the inference operation of a machine learning model.

[0029] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0030] The subject matter described in this specification relates to a special hardware device having multiple computing units that are configured to accelerate machine learning operations (e.g., inference operations) of a machine learning model and to obfuscate the inference operations by performing obfuscation operations concurrently with the inference operations. The described hardware device can be a hardware processor, such as a hardware accelerator, deployed on an edge device (e.g., a smart phone, a smart tablet, a smart watch, or other suitable edge device). The hardware device can include one or more processing elements, and each processing element can include one or more computing units. The hardware device can schedule obfuscation operations and inference operations to be performed by different processing elements in the hardware device or different parts of computing units in each processing element. Each computing unit of the hardware computing system is self-contained and can independently perform at least a portion of the computations required for a given layer of a multi-layer neural network.

[0031] An example machine learning model can be a neural network trained to perform an inference task. The trained neural network includes multiple parameters defining the neural network and inference operations in the neural network. The parameters of the neural network may include the number of network layers in the neural network, the number of nodes in the neural network, node operations for each node, and / or node weights for each node. The neural network calculates inferences for processing inputs by performing inference operations of the neural network. In particular, the layers of the neural network each have a plurality of nodes, and the plurality of nodes have corresponding node operations and weights. Node operations may include linear operations (e.g., multiplication and addition) or nonlinear operations (e.g., activation operations, including ReLu activation functions, Tanh functions, and Sigmoid functions). In some implementations, the parameters also include data determining node connections between adjacent network layers (e.g., fully connected layers, convolutional layers, or transposed convolutional layers).

[0032] The hardware device can perform inference computations for a neural network by distributing or assigning different portions of the inference operations over multiple computational units. An example of a computational unit is a tile that each has a computational unit or processing engine and / or one or more caches and switches. An example computation process performed for a neural network layer may include multiplying an input tensor including input activations with a parameter tensor including weights. This computation includes multiplying the input activations with the weights over one or more cycles and performing accumulation of the products over many cycles. The computation results for the network layer may be written to an output bus and stored in memory.

[0033] When performing inference operations of a deployed neural network, the hardware device generates one or more measurable characteristics of the neural network. Different techniques (such as side channel attacks) can be used to reverse engineer the parameters of the trained neural network. In the case where the hardware device is included in an edge device (such as a smart phone, smart watch, smart tablet or other suitable edge device), the hardware device can be used to repeatedly perform test operations and determine the parameters of the neural network.

[0034] It is desirable to keep neural network parameters confidential for different reasons. One example is from a security perspective. A neural network can be configured to perform face recognition tasks to conveniently unlock a device. If a third party successfully reverse engineers the neural network and finds a way to trick the face unlock mechanism, then using the face unlock mechanism would be unsafe. For example, a malicious actor could use an adversarial attack to trick the neural network into unlocking a device that the actor does not have authorization for.

[0035] The described technology can solve the above-mentioned security problems by obfuscating the inference operation of the neural network. More specifically, the hardware device is configured to issue instructions, which, when executed by the hardware device, cause different components in the hardware device to perform the inference operation in the neural network concurrently with the obfuscation operation. By performing the obfuscation operation concurrently, the hardware device can change at least one of the multiple measurable characteristics of the neural network. In this way, the hardware can effectively hide or mask the measurable characteristics of the actual machine learning operation being performed by the hardware device, and make the deciphering process impossible, impractical, or ultimately more difficult by analyzing the masked or changed measurable characteristics. The details of performing the obfuscation operation are described below.

[0036] Figure 11 is a block diagram of an example system 100 including a hardware device 102. The hardware device 102 is communicatively coupled to a host 108, for example, via one or more networks. In general, the hardware device 102 is configured to receive instructions or data from the host 108 and provide data back to the host 108. In general, the host is configured to compile the trained machine learning model into a machine-readable program (e.g., binary code). The binary code generally includes all parameters that define the trained machine learning model. The binary code specifies, for example, the number of network layers in the compiled neural network, the type of each network layer, the number of nodes in each network layer, the node operations for each node in each network layer, the node weights determined for each node in each network layer, and the inter-layer connectivity. The binary code may include any other parameters of the machine learning model.

[0037] The host 108 also generates instructions that, when executed by the hardware device 102, cause the hardware device 102 to perform the inference operation specified by the binary code. In some implementations, the host 108 may generate a schedule for performing the inference operation, for example, data indicating the assignment of the inference operation to different computing components in the hardware device 102 and the order in which the inference operation is performed. In general, the instructions generated by the host 102 may not include specific obfuscation operations for obfuscating the parameters of the machine learning model. Instead, the obfuscation operation is determined, scheduled, and executed by the hardware device 102, and the hardware device modifies the received instructions from the host 108 or generates new instructions including the obfuscation operation to be performed concurrently with the inference operation.

[0038] In some implementations, the instruction data generated by the host 108 and sent to the hardware device 102 may include an instruction set that includes at least one instruction for the hardware device to perform an obfuscation operation concurrently with the inference operation. For example, the at least one instruction may instruct the hardware device to perform an inference operation of the machine learning model in a "safe mode", where the hardware device performs one or more obfuscation operations concurrently with the inference operation performed by the hardware device. As another example, after receiving the at least one instruction, the hardware device may be notified that one or more applications using the machine learning model deployed on the hardware device may request to perform the inference operation of the machine learning model in a safe mode. The hardware device 102 may determine the specific obfuscation operation after receiving the request from the application.

[0039] In some implementations, the instruction data generated by the host 108 and sent to the hardware device 102 may include a machine learning model without instructions for performing an obfuscation operation. In this example, the hardware device 102 may determine whether to perform an obfuscation operation concurrently with the inference operation as described herein.

[0040] After performing the inference operations specified by the received instructions from the host 108, the hardware device 102 may provide data, such as computation results, to the host 108. The computation results may include at least a portion of a layer output in a network layer, or layer outputs of two or more network layers.

[0041] The hardware device may be a hardware processor, for example, a hardware accelerator, such as a graphics processing unit (GPU), a visual processing unit (VPU), a tensor processing unit (TPU), or other suitable hardware accelerator. In order to accelerate the execution of the inference operation, the hardware device 102 includes one or more processing elements 104A to 104N, and each processing element 104A to 104N includes one or more computing units 106A to 106N, which are also referred to as computing units 106 for simplicity. The computing units 106 are each a self-contained unit for performing the assigned inference operation (e.g., a linear or nonlinear operation for a node in or across a network layer). The number of processing elements 104A to 104N and the corresponding computing units of each processing element may vary based on different computing requirements. For example, the hardware device 102 may include 4, 8, 16 or more processing elements, each of which has 4, 8, 16 or more computing units. In addition, different hardware devices 102 may have different arrangements and interconnections for processing elements 104A to 104N.

[0042] After receiving instructions and / or data from the host 108, the hardware device 102 may store data representing parameters of the assigned inference operation in the neural network in the memory 110. Details of the memory 110 are described below. The parameters may include the number of nodes and the number of network layers assigned to the hardware device 102, the node weights, and the corresponding input activations from the previous network layer. In some implementations, the hardware device 102 may store instructions in the memory 110.

[0043] The management component 114 is configured to determine whether to perform the inference operation in a "standard mode" or a "safe mode". The management component 114 can determine different modes for performing operations based on the nature or application of the neural network. In other words, the management component 114 can choose to use a safe mode or a regular mode for the machine learning model to perform the operation of the machine learning mode. For example, if the neural network is a giant deep neural network that requires a lot of time and cost (e.g., the computational cost for training) and the hardware device 102 is located inside the edge device, the management component 114 can determine to perform the operation in a safe mode. In this example, the management component 114 can select a mode based on size (e.g., by comparing the size of the model with a threshold) and / or based on training time (e.g., by comparing the time taken to train the model with a threshold, and such information can be included in metadata transmitted to the management component 114, for example). As another example, if the neural network is used for security-sensitive applications, such as face unlocking, voice unlocking, signature verification, personal information access or prediction using a machine learning model, or other security-sensitive applications, the management component 114 can determine to perform the operation of the neural network in a safe mode. In this example, an application using a security-sensitive machine learning model can request that the hardware device operate in a secure mode when performing operations of these machine learning models. In some implementations, the request sent to the management component 114 can include a label or metadata indicating whether the machine learning model is sensitive, or indicating which mode (e.g., secure mode or normal mode) to use to perform operations of the machine learning model. On the other hand, the management component 114 can include an application programming interface (API) configured to receive the request and determine the mode (e.g., secure or normal) for performing operations of one or more machine learning models.

[0044] The term "standard mode" as used throughout this specification generally refers to a mode in which hardware device 102 does not perform obfuscation operations to hide or mask measurable characteristics of a designated portion of a neural network. The term "secure mode" as used throughout this specification generally refers to a mode in which hardware device 102 performs obfuscation operations to hide or mask measurable characteristics of a designated portion of a neural network. Figure 3 Describes an example of obfuscation operation.

[0045] If the management component 114 determines to perform the inference operation in standard mode, the management component 114 can broadcast the received instruction (e.g., without making any modifications to the received instruction) to the different processing elements 104A. The instruction and parameters for the inference operation are broadcast along the data bus to each computing unit 106 in each processing element 104A. Figure 2The details of transmitting instructions and data across different computing units 106A to 106N in processing elements 104A to 104N are described. In general, all available computing units 106 in processing elements 104 typically perform corresponding portions of the inference operation to maximize the computing power of the processing elements and the speed at which the operations are performed. However, in some implementations, an instruction or schedule from host 108 (or from management component 114) may specify a portion (e.g., one or more) of computing units 106 in one or more processing elements 104 to perform the inference operation.

[0046] If the management component 114 determines to perform the inference operation in a "safe mode", the management component 114 can modify the received instructions to generate modified instructions that, when executed by the hardware device 102, cause one or more computing units in the hardware device 102 to perform the obfuscation operation. To modify the received instructions, the management component 114 can first determine whether there is a schedule in the received instructions from the host 108.

[0047] In response to determining that a schedule does not exist, management component 114 can generate a schedule that specifies that the computing units 106 of the first portion of processing elements 104 perform the assigned inference operation and specifies that the computing units 106 of the second portion of processing elements 104 perform the obfuscation operation. In some implementations, the schedule generated by management component 114 can specify other computing components other than the computing units to perform the obfuscation operation. The other computing components can be multiplexers, logic units, adders, multiplication units, or other computing components.

[0048] In response to determining that there is an existing schedule in the received instruction, the management component 114 can modify the schedule by reassigning one or more computing units 106 that were originally scheduled to perform the corresponding inference operation according to the received instruction to perform the obfuscation operation, and reassigning the corresponding inference operation to be performed by other computing units 106 in one or more other processing elements 104. In some implementations, the processing element or the computing unit of the processing element can be an additional element added to the hardware device or to an edge device that includes the hardware device and is dedicated to performing the obfuscation operation. The term "dedicated" generally refers to one or more processing elements or computing units that are additionally incorporated into the hardware device (e.g., in addition to other elements or units in the hardware device for performing the inference operation) and are configured to substantially only perform the obfuscation operation without performing the inference operation associated with the deployed machine learning model. The processing element or computing unit dedicated to performing the obfuscation operation may include, for example, a processor, a multiplication unit, a multiplexer, a vector reduction unit, a logic gate, or other suitable processing element or computing unit.

[0049] The modified instructions are broadcast to the corresponding processing elements 104A to 104N by the management component 114. The modified instructions, when executed by the corresponding computing units 106A to 106N in the processing elements 104A to 104N, may cause the computing units of the first portion to perform inference operations and cause the computing units of the second portion to perform obfuscation operations concurrently with the first portion of the set of computing units performing inference operations.

[0050] In general, an obfuscation operation may be any operation that may hide or mask a measurable characteristic of a neural network. In other words, an obfuscation operation may include an operation that causes hardware device 102 and / or an edge device including hardware device 102 to generate or adjust one or more measurable characteristics.

[0051] Measurable characteristics include electromagnetic profiles for one or more inference operations, time profiles for performing one or more inference operations, or power consumption profiles for a computing unit performing inference operations. In some implementations, measurable characteristics may include sound profiles and / or temperature profiles for performing one or more inference operations. The electromagnetic profile may, for example, represent a measure of electromagnetic radiation that charges a capacitor on a hardware device as the hardware device is performing operations of a machine learning model. In some implementations, the characteristic profile may be represented by a graph having a horizontal axis representing time and a vertical axis representing a specific characteristic (e.g., electromagnetic radiation, power consumption, sound, or temperature). Other representations of changes in these characteristics over time during the execution of the machine learning model may also be used to represent the profile, for example in the form of a table, vector, or the like.

[0052] In some implementations, the obfuscation operation may mimic a corresponding inference operation that is concurrently performed during a time period. As an example, when one or more assigned computing units are using a node activation function to compute an output activation of a machine learning model, the modified instructions may instruct one or more other computing units to concurrently execute a different obfuscation activation function to obfuscate measurable characteristics of the computing units that compute the output activation of the machine learning model. Both the inference operation and the obfuscation operation are associated with different activation functions, so that the combined data profile (e.g., power consumption profile) is different from the data profile of performing only the inference operation. Therefore, the measurable characteristics are deviated from the true measurable characteristics of the neural network, and any reverse-engineered neural network parameters may be different from the true neural network parameters.

[0053] In some implementations, the obfuscation operation may be unrelated to a corresponding inference operation that is concurrently executed during a certain period of time (e.g., independent of the thrust operation), but performing the obfuscation operation may render meaningless any measurable data from the hardware device 102. For example, when the inference operation is related to matrix reduction, the obfuscation operation may be a specific logical operation or scalar addition or multiplication such that the true measurable profile is altered to lose a pattern or feature that becomes meaningless for determining the true parameters of the neural network.

[0054] The computation results of the inference operation are stored in the memory 110 and provided to the host 108 for use in other inference operations that depend on the computation results. However, the computation results for the obfuscation operation are not used by any of the inference operations. In some implementations, the obfuscated results are discarded and not written to any memory. Alternatively, the obfuscated results are written to the memory unit so that other computation components used for the inference operation do not receive any data stored in the memory unit.

[0055] Figure 2 An example processing element 200 in a hardware device is shown. The processing element 200 is configured to process at least a portion of an inference operation of a compiled neural network.

[0056] like Figure 2 As shown, processing element 200 generally includes management component 202 (e.g., controller / scheduler / core manager) and a plurality of blocks 220 to 234 including a first set of blocks 212 and a second set of blocks 214. Management component 202 is configured to execute instructions received from a host and optionally modify the received instructions to be executed. Management component 202 may be equivalent to Figure 1 The management component 202 may be a master management component that determines instructions for all computing components located on a hardware device, such as Figure 1 As shown. Alternatively or additionally, each processing element (e.g., processing element 200) may have a corresponding controller configured to determine instructions for scheduling operations to be performed in the processing element. For simplicity, management component 202 is also referred to as controller 202 in the following description.

[0057] The plurality of blocks 220 to 234 are communicatively coupled to each other in sequence via a data bus 218. The data bus 218 includes different types of data buses for communicating respective instructions indicating different operations performed on different blocks, input data for performing operations on different blocks, and results generated on different blocks for the input data. For example, the data bus 218 may include a ring bus that starts at the controller 202 and provides a communication coupling through a bus data path that sequentially connects the blocks 112, 114 in a ring back to the controller 102. In some implementations, the data bus 218 may include a mesh bus that provides a communication path that couples or connects each block to its corresponding adjacent block in both horizontal and vertical dimensions. The mesh bus may be used to transmit input activation quantities between one or more memory cells in adjacent blocks.

[0058] Generally speaking, blocks 220, 222, 224, 226, 228, 230, 232, or 234 are core components within processing element 200 and are focal points for performing inference computations. Each block is a self-contained computational component for performing assigned inference operations. One or more of these blocks in processing element 200 perform inference operations assigned to processing element 200 according to received instructions. For example, in order to maximize the utilization of computational units in a processing element, each block collaborates with other blocks in processing element 200 to accelerate computations across one or more layers of a multi-layer neural network. Although for ease of illustration, as shown in FIG. Figure 2 Processing element 200 is shown having eight computing units (e.g., blocks 220, 222, 224, 226, 228, 230, 232, 234) coupled to each other via data bus 218, but processing element 200 may include a different number of computing units coupled to each other, e.g., 4, 16, 32, or other suitable number.

[0059] The controller 202 is configured to modify the received instructions or add new instructions to be combined with the received instructions, so that when the modified instructions are executed by the processing element 200, one or more computing units (e.g., blocks) in some processing elements perform obfuscation operations and one or more other computing units perform inference operations in the neural network. For example, the blocks 220 and 224 in the first block set 212 can be instructed by the controller 202 to perform obfuscation operations, and the other blocks 222, 226, 228, 230, 232, and 234 can be instructed by the controller 202 to perform inference operations of the neural network. Figures 3 to 5 Assigning computing components (eg, blocks or other components) to perform obfuscation operations is described in greater detail.

[0060] In some implementations, the instructions generated by the host include a schedule for performing the inference operation using different component units (e.g., different blocks). For example, the received instructions may include a set of non-overlapping portions of the inference operation and a set of processing units and corresponding computing units assigned to perform the corresponding non-overlapping portions. In these cases, the controller 202 may determine that one or more blocks in a specific processing element that were originally assigned by the received instruction to perform the corresponding inference operation perform the obfuscation operation. The controller 220 may also determine that other idle blocks in one or more processing elements different from the specific processing element perform the corresponding inference operation initially assigned to the one or more blocks. For example, the controller reassigns blocks 228 to 234 to perform the obfuscation operation, and assigns idle blocks in other processing elements to perform the corresponding inference operation initially assigned to blocks 228 to 234. Alternatively, the controller 202 does not reassign the blocks that were initially assigned by the received instruction to perform the inference operation to perform the obfuscation operation. Instead, the controller 2020 determines that an idle computing component (such as an idle processing element, a multiplication unit, a logic unit, or other suitable unit) performs the obfuscation operation. For example, blocks 220 to 234 continue to perform inference operations, and the hardware device instructs other computing components to perform obfuscation operations.

[0061] In some implementations, the instructions generated by the host do not include scheduling information, such as which computing units perform what inference operations when. In these cases, the controller 202 can generate new instructions for scheduling the blocks to perform corresponding operations. The controller 202 can combine the new instructions with the instructions received from the host and issue the instructions to different blocks along the data bus 218. For example and as described above, the modified instructions can reassign the blocks of the first part to perform the obfuscation operation when executed, and determine that other idle blocks perform the corresponding inference operations originally assigned to the blocks of the first part. Alternatively or in addition, the modified instructions can cause the blocks to maintain the execution of the assigned inference operations when executed, and cause other idle computing components (e.g., adders, multiplication units, logic units, or other processing elements) to perform the obfuscation operation.

[0062] Processing element 200 also includes one or more memory units. For example, the memory unit may include data memory 204 and instruction memory 206. Figure 2As shown. The instruction memory 206 may store one or more machine-readable instructions that may be executed by one or more processors of the controller 202. The data memory 204 may be any of a variety of data storage media for storing and subsequently accessing a variety of data related to the computations occurring within the system processing element 200, for example, parameters of a neural network for performing assigned inference operations, and one or more computational results for processing a particular input. In some implementations, the data memory 204 and the instruction memory 206 are one or more volatile memory units. In some other implementations, the data memory 204 and the instruction memory 206 are one or more non-volatile memory units. The data memory 204 and the instruction memory 206 may also be another form of computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device or a tape device, a flash memory or another similar solid-state memory device, or a device array including devices in a storage area network or other configuration.

[0063] Figure 3 An example assignment 300 of computing units for concurrently performing inference operations and obfuscation operations is shown. The assignment 300 can be determined by one or more computers located at one or more different locations. For simplicity, the assignment 300 can be determined by a management component (e.g., Figure 1 The management component 114) is determined, and the management component can generate instructions for determining the assignment 300 when appropriately programmed.

[0064] like Figure 3 As shown, the modified instructions are executed by a hardware device (e.g., Figure 1 The hardware device 102 shown in the figure can execute the computing unit of the first part of the processing element (for example, Figure 2 The illustrated blocks 220 to 234) perform the inference operation and cause the computing units of the second portion of the processing elements to perform the obfuscation operation concurrently with the execution of the inference operation.

[0065] An example assignment 300 indicates that computation units 306A-306J of a first portion 314 in processing element 302A are instructed to perform corresponding inference operations, and computation units 306K-306N of a second portion 316 in processing element 302A are instructed to perform obfuscation operations concurrently with the inference operations performed by computation units 306A-306J of first portion 314. In some implementations, the assignment may instruct computation units 306A-306N of a different portion in one or more processing elements 302A-302N and each of the one or more processing elements 302A-302N to perform obfuscation operations. For example, the computing units 306A to 306G of the first portion 318 are instructed to perform corresponding inference operations, the computing units 306H to 306N of the second portion 320 are instructed to concurrently perform obfuscation operations, the computing units 306A to 306E of the first portion 322 are instructed to perform corresponding inference operations, and the computing units 306F to 306N of the second portion 324 are instructed to concurrently perform obfuscation operations. The number of computing units used to perform obfuscation operations and the number of computing units used to perform inference operations may vary between different processing elements 302A to 302N. The instructions may also reassign corresponding inference operations from the computing units of the portions that are instructed to perform obfuscation operations to other idle computing units in other processing elements.

[0066] It should be noted that Figure 3 , the number of processing elements 302A to 302N, the number of computing units 306A to 306N in each processing element 302A to 302N, and the number of computing units 306A to 306N in each section are illustrative. It should be understood that these numbers and / or arrangements of computing units and processing elements may vary based on different obfuscation requirements. For example, any number of computing units of any number of processing elements may be assigned to perform obfuscation operations.

[0067] Figure 4 Another example assignment 400 of computing units for concurrently performing inference operations and obfuscation operations is shown. The assignment 400 can be determined by one or more computers located at one or more different locations. For simplicity, the assignment 400 can be determined by a management component (e.g., Figure 1 The management component 114) is determined, and the management component can generate instructions for determining the assignment 400 when appropriately programmed.

[0068] like Figure 4 As shown, the modified instructions are executed by a hardware device (e.g., Figure 1When the hardware device 102 shown in FIG. 1 is executed, the processing elements 402A to 402K of the first part 410 may be caused to perform inference operations, and the processing elements 402L to 402N of the second part may be caused to perform obfuscation operations concurrently with the execution of the inference operations. In this case, one or more computing elements 406A to 406N of the processing elements 402A to 402K of the first part 410 perform inference operations, and no computing element in the first part performs obfuscation operations. In the case where the instruction received from the host includes a schedule to assign the inference operation to the computing unit, these computing units in the first part will continue to perform the assigned inference operation. The management component determines that the computing unit in other processing elements (e.g., the second part 420) different from the first part performs the obfuscation operation.

[0069] Example assignment 400 can be combined with example assignment 300 to instruct computing units to perform corresponding operations. For example, the instructions can cause one or more first processing units to perform an obfuscation operation, and cause one or more second processing units different from the first processing unit to perform both the obfuscation operation and the inference operation. For example, computing units of a first portion of one or more second processing units are instructed to perform corresponding inference operations, and computing units of a second portion of one or more second processing units are instructed to perform corresponding obfuscation operations.

[0070] Likewise, it should be noted that Figure 4 4, the number of processing elements 402A to 402N, the number of computing units 406A to 406N in each processing element 402A to 402N, and the number of computing units 406A to 406N in each section are illustrative. It should be understood that these numbers and / or arrangements of computing units and processing elements can vary based on different obfuscation requirements.

[0071] Figure 5 Another example assignment 500 of computing units for concurrently performing inference operations and obfuscation operations is shown. The assignment 500 can be determined by one or more computers located at one or more different locations. For simplicity, the assignment 500 can be determined by a management component (e.g., Figure 1 The management component 114) is determined, and the management component can generate instructions for determining the assignment 500 when appropriately programmed.

[0072] like Figure 5 As shown, the modified instructions are executed by a hardware device (e.g., Figure 1When executed by the hardware device 102 shown in FIG. 1 , the processing elements 402A to 402K of the first portion 410 may be caused to perform inference operations and the second group of components 520 having other computing components 508A to 508N may be caused to perform obfuscation operations concurrently with the execution of the inference operations. In some implementations, a special hardware device is designed to include one or more computing components 508A to 508N for performing different types of obfuscation operations. One or more computing components may include different types of units, such as logic units, multiplier-accumulator units, multiplexers, or other types of processing elements (e.g., GPU units) with different types and arrangements of computing units.

[0073] Likewise, it should be noted that Figure 5 508A to 508N are illustrative. It should be understood that these numbers and / or arrangements of computing units, processing elements, and computing components may vary based on different obfuscation requirements.

[0074] Figure 6 is an example flow chart of a process 600 for obfuscating inference operations of a machine learning model. For convenience, process 600 is described as being performed by a system of one or more computers located in one or more locations. For example, process 600 may be performed by a hardware device (e.g., Figure 1 The process 600 is performed by the hardware device 102 shown. The order of the steps in the process 600 is illustrative only and can be performed in a different order. In some implementations, the process 600 may include additional steps, fewer steps, or some of the steps may be divided into multiple steps.

[0075] The system receives data representing a machine learning model by a hardware device (610). The machine learning model may include multiple model parameters for inference operations. As described above, the machine learning model may include a neural network having multiple parameters that define the neural network. These parameters may include, for example, the number of network layers of the neural network, the number of nodes in each network layer of the neural network, node operations for each node in each network layer of the neural network, and / or weight values ​​associated with each node in each network layer of the neural network. Different types of machine learning models include different types of parameters that define the model. The techniques described in this document can obfuscate any type of parameter that affects a measurable characteristic of a machine learning model.

[0076] The system or hardware device may include multiple processing elements, and each processing element may include multiple computing units. The set of computing units in the hardware device may be configured to process corresponding inference operations of the neural network deployed on the hardware device.

[0077] The system obtains instructions for performing an obfuscation operation (620). The obfuscation operation, when executed by the hardware device, is configured to obfuscate one or more measurable characteristics of the machine learning model. More specifically, the system can determine whether to perform inference operations of the neural network in a "safe mode." Criteria for such a determination can be based on the nature or application of the neural network (e.g., whether the neural network takes a lot of time and resources to train, or whether the neural network is applied to a security-sensitive application), as described above.

[0078] Upon determining that the system will perform inference operations of a neural network in a "safe mode," the system modifies received instructions from the host or adds new instructions to received instructions to obtain modified instructions that, when executed by the hardware device, cause the hardware device to concurrently perform inference operations and obfuscation operations. In some cases, the system assigns obfuscation operations to one or more processing elements that also perform inference operations of one or more machine learning models; and reassigns a subset of inference operations from the one or more processing elements to other processing elements of the hardware device. Details of generating the modified instructions are described above.

[0079] The obfuscation operation may change at least one or more measurable characteristics of the neural network. The measurable characteristics may include at least one of a power profile, an electromagnetic profile, or a time profile. Once the measurable characteristics change, it becomes more difficult to determine the parameters of the neural network based on the measurable characteristics. The obfuscation operation may include operations similar to inference operations performed within a common time period, such as activation operations, tensor multiplications, and reductions. For example, the obfuscation operation may include an obfuscated node operation for a specific node to be performed concurrently with a corresponding node operation for the specific node in a network layer. The node operation may be a node addition or a node multiplication. Alternatively, the obfuscated node operation may specify an activation function for a specific node that is different from an actual activation function for the specific node that is performed concurrently with the obfuscated node operation.

[0080] In some implementations, the obfuscation operation may include operations that are unrelated and / or different from the inference operations performed during the common time period. Further details related to the obfuscation operation are described above.

[0081] The system causes a first portion of the set of computing units to perform inference operations of the machine learning model (630). The computing units of the first portion can be located within one or more processing elements in a hardware device.

[0082] The system causes a second portion of the set of computing units to perform an obfuscation operation concurrently with the first portion of the set of computing units performing an inference operation (640). The computing units of the second portion may be located within one or more processing elements in a hardware device.

[0083] In some implementations, the system may determine that a first portion of computing units in the common processing element performs an inference operation, and determine that a second portion of computing units in the common processing element performs a corresponding obfuscation operation. Figure 3 One example of these implementations is shown and described.More generally, an instruction may specify that at least a subset of a first portion of a set of computational units and a corresponding subset of a second portion of the set of computational units are located within a common processing element.

[0084] In some implementations, the system can determine that a computational unit for performing an inference operation is in a first processing element, and a computational unit for performing a corresponding obfuscation operation is in a second processing element. The second processing element is different from the first processing element. Figure 4 One example of these implementations is shown and described.More generally, an instruction may specify that at least a subset of a first portion of a set of computational units is located in a processing element and specify that at least a subset of a second portion of the set of computational units is located in a second processing element different from the first processing element.

[0085] Alternatively, the system may determine one or more other computing components for performing the obfuscation operation. The one or more other computing components are not initially assigned to perform any inference operation. The one or more other computing components may be specifically designed for the hardware device to perform the obfuscation operation. The system may assign the obfuscation operation to the other computing components and maintain the corresponding processing elements and computing units to perform the inference operation in the neural network.

[0086] This specification uses the term "configured to" in connection with systems, devices, and computer program components. A system of one or more computers to be configured to perform a particular operation or action means that the system has installed thereon software, firmware, hardware, or a combination thereof that, in operation, causes the system to perform those operations or actions. One or more computer programs to be configured to perform a particular operation or action means that the one or more programs include instructions that, when executed by a data processing device, cause the device to perform those operations or actions. A dedicated logic circuit system to be configured to perform a particular operation or action means that the circuit system has electronic logic to perform the operation or action.

[0087] The term "data processing equipment" refers to data processing hardware and encompasses all kinds of equipment, devices and machines for processing data, including, for example, a programmable processor, a computer or a plurality of processors or computers. The equipment may also be or include a dedicated logic circuit system, for example, an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the equipment may also optionally include code that creates an execution environment for a computer program, for example, code constituting processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0088] A computer program, which may also be referred to or described as a program, software, software application, module, software module, script, or code, may be written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or code portions). A computer program may be deployed to execute on one computer or on multiple computers located at one site or distributed over multiple sites and interconnected by a communication network.

[0089] The processes and logic flows described in this specification may be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows may also be performed by, and the apparatus may also be implemented as, a special purpose logic circuit system, such as an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit).

[0090] For example, a computer suitable for executing a computer program includes a general or special microprocessor or both, or any other kind of central processing unit. Generally, the central processing unit will receive instructions and data from a read-only memory or a random access memory or both. The basic element of a computer is a central processing unit for performing or executing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include one or more large-capacity storage devices for storing data, such as a disk, a magneto-optical disk or an optical disk, or be operatively coupled to receive data from it or transfer data to it or both. However, a computer does not have to have such a device. In addition, a computer can be embedded in another device, such as a mobile phone, a smart phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver or a portable storage device, such as a universal serial bus (USB) flash drive, to name a few.

[0091] Computer-readable media suitable for storing computer program instructions and data include all forms of nonvolatile memory, media, and memory devices, including, for example, semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices); magnetic disks (e.g., internal hard disks or removable disks); magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and memory may be supplemented by, or incorporated in, special purpose logic circuitry.

[0092] Embodiments of the subject matter described in this specification may be implemented in a computing system that includes a back-end component (e.g., as a data server), or includes a middleware component (e.g., an application server), or includes a front-end component (e.g., a client computer with a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks (LANs) and wide area networks (WANs), such as the Internet.

[0093] A computing system may include a client and a server. The client and the server are usually remote from each other and typically interact through a communication network. The relationship between the client and the server is generated by computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server sends data (e.g., a hypertext markup language (HTML) page) to a user device, for example, to display data to a user interacting with a user device acting as a client and to receive user input therefrom. Data generated at the user device, for example, the result of a user interaction, can be received from the device at the server.

[0094] In addition to the embodiments described above, the following embodiments are also innovative:

[0095] Embodiment 1 is a method, comprising: receiving, by a hardware device, data representing a machine learning model, the machine learning model comprising a plurality of model parameters for an inference operation, wherein the hardware device comprises a set of computing units arranged in one or more processing elements; obtaining instructions for performing an obfuscation operation, the obfuscation operation being configured to obfuscate one or more measurable characteristics of the machine learning model when the machine learning model is executed by the one or more processing elements; causing a first portion of the set of computing units to perform the inference operation of the machine learning model; and causing a second portion of the set of computing units to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation.

[0096] Embodiment 2 is the method of embodiment 1, wherein the machine learning model is a neural network, wherein the obfuscation operation is configured to obfuscate at least one of the number of network layers of the neural network, the number of nodes in the network layers of the neural network, node operations for nodes in the network layers of the neural network, or weight values ​​associated with nodes in the network layers of the neural network.

[0097] Embodiment 3 is the method of embodiment 1 or 2, wherein the one or more measurable characteristics of the machine learning model include at least one of a power profile, an electromagnetic profile, or a time profile.

[0098] Embodiment 4 is the method of any one of embodiments 1 to 3, wherein at least a subset of the first portion of the set of computing units and a corresponding subset of the second portion of the set of computing units are located within a common processing element.

[0099] Embodiment 5 is the method of any one of embodiments 1 to 4, wherein at least a subset of the first portion of the set of computing units is located in a processing element, and at least a subset of the second portion of the set of computing units is located in a second processing element different from the first processing element.

[0100] Embodiment 6 is the method of any one of embodiments 2 to 5, wherein the obfuscation operation comprises an obfuscation node operation for a specific node to be performed concurrently with a corresponding node operation for the specific node in a network layer.

[0101] Embodiment 7 is the method of embodiment 6, wherein the obfuscation node operation specifies an activation function of the specific node, and the activation function is different from an actual activation function of the specific node.

[0102] Embodiment 8 is the method of any one of embodiments 1 to 7, wherein causing the second portion of the set of computing units to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation comprises assigning the obfuscation operation to a dedicated processing element that performs the obfuscation operation.

[0103] Embodiment 9 is the method of embodiment 8, wherein the dedicated processing element comprises one or more processing elements or computing units additionally incorporated into the hardware device and configured to substantially only perform the corresponding obfuscation operation.

[0104] Embodiment 10 is a method of any one of embodiments 1 to 9, wherein causing the second portion of the set of computing units to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation includes: assigning the obfuscation operation to one or more processing elements that also perform inference operations of one or more machine learning models; and reassigning a subset of the inference operations from the one or more processing elements to other processing elements of the hardware device.

[0105] Embodiment 11 is the method of any one of embodiments 2 to 10, wherein the neural network is configured to perform a facial recognition task for unlocking the device.

[0106] Embodiment 12 is a system comprising one or more computers and one or more storage devices, wherein the one or more storage devices store instructions, and when the instructions are executed by the one or more computers, the one or more computers perform corresponding operations, and the operations include any one of the methods of embodiments 1 to 11.

[0107] Embodiment 13 is one or more computer-readable storage media, wherein the one or more computer-readable storage media store instructions, which, when executed by one or more computers, cause the one or more computers to perform corresponding operations, wherein the corresponding operations include the method of any one of embodiments 1 to 11.

[0108] Embodiment 14 is a method, comprising: receiving an instruction set at a processor for performing an inference operation with a machine learning model, wherein the instruction set includes at least one instruction for performing an obfuscation operation concurrently with the inference operation; performing the inference operation with the machine learning model at the processor; and performing the obfuscation operation concurrently with the inference operation at the processor.

[0109] Embodiment 15 is the method of embodiment 14, wherein the obfuscation operation is configured to obfuscate one or more measurable characteristics of the machine learning model when the obfuscation operation is performed by the processor concurrently with the inference operation.

[0110] Embodiment 16 is the method of embodiment 15, wherein the one or more measurable characteristics of the machine learning model include at least one of a power profile, an electromagnetic profile, or a time profile.

[0111] Embodiment 17 is the method of any one of embodiments 14 to 16, wherein the machine learning model is a neural network, wherein the obfuscation operation is configured to obfuscate at least one of the number of network layers of the neural network, the number of nodes in the network layers of the neural network, node operations for nodes in the network layers of the neural network, or weight values ​​associated with nodes in the network layers of the neural network.

[0112] Embodiment 18 is the method of embodiment 17, wherein the neural network is configured to perform a facial recognition task for unlocking the device.

[0113] Embodiment 19 is the method of embodiment 17 or 18, wherein the obfuscation operation comprises an obfuscation node operation for a specific node to be performed concurrently with a corresponding node operation for the specific node in a network layer.

[0114] Embodiment 20 is the method of embodiment 19, wherein the obfuscation node operation specifies an activation function for the particular node, and the activation function is different from an actual activation function of the particular node.

[0115] Embodiment 21 is the method of any one of embodiments 14 to 20, wherein the processor is configured to assign a first portion of the set of computing units in the processor to perform the inference operation of the machine learning model, and assign a second portion of the set of computing units in the processor to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation.

[0116] Embodiment 22 is the method of embodiment 21, wherein at least a subset of the first portion of the set of computing units is located in a first processing element of the processor, and at least a subset of the second portion of the set of computing units is located in the same processing element or in a second processing element different from the first processing element.

[0117] Embodiment 23 is the method of embodiment 21 or 22, wherein the second portion of the set of computing units includes one or more computing units located in a dedicated processing element in the processor that performs the obfuscation operation.

[0118] Embodiment 24 is the method of embodiment 23, wherein the dedicated processing element comprises one or more processing elements or computing units additionally incorporated into the processor and configured to substantially only perform corresponding obfuscation operations.

[0119] Embodiment 25 is the method of any one of embodiments 14 to 24, wherein performing the obfuscation operation concurrently with the inference operation includes: assigning the obfuscation operation to one or more processing elements in the processor that also perform inference operations of one or more machine learning models; and reassigning a subset of the inference operations from the one or more processing elements to other processing elements of the processor.

[0120] Embodiment 26 is a system comprising one or more computers and one or more storage devices, wherein the one or more storage devices store instructions, and when the instructions are executed by the one or more computers, the one or more computers perform corresponding operations, and the operations include any one of the methods of embodiments 14 to 25.

[0121] Embodiment 27 is one or more computer-readable storage media, wherein the one or more computer-readable storage media store instructions, which, when executed by one or more computers, cause the one or more computers to perform corresponding operations, wherein the corresponding operations include the method of any one of embodiments 14 to 25.

[0122] Although this specification contains many specific implementation details, these details should not be interpreted as limitations on the scope of what may be claimed, but rather as descriptions of features that may be peculiar to a particular embodiment. Certain features described in the context of a separate embodiment in this specification may also be implemented in combination in a single embodiment. On the contrary, the various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments. In addition, although features may be described above as acting in certain combinations and even initially claimed as such, in some cases, one or more features from the claimed combination may be deleted from the combination, and the claimed combination may involve a sub-combination or a change in the sub-combination.

[0123] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that such operations be performed in the particular order shown or in a sequential order, or that all of the operations shown be performed to achieve the desired result. In some contexts, multitasking and parallel processing can be advantageous. In addition, the separation of various system modules and components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0124] In each instance where an HTML file is mentioned, other file types or formats may be substituted. For example, an HTML file may be replaced by XML, JSON, plain text, or other types of files. In addition, where a table or hash table is mentioned, other data structures (such as a spreadsheet, a relational database, or a structured file) may also be used.

[0125] Certain embodiments of the invention have been described. Other embodiments are within the scope of the following claims. For example, the steps set forth in the claims, described in the specification, or depicted in the drawings can be performed in a different order and still achieve the desired results. In some cases, multitasking and parallel processing may be advantageous.

Claims

1. A method comprising: receiving, by a hardware device, data representing a machine learning model, the machine learning model comprising a plurality of model parameters for an inference operation, wherein the hardware device comprises a set of computational units arranged in one or more processing elements; obtaining instructions for performing an obfuscation operation configured to obfuscate one or more measurable characteristics of the machine learning model when the machine learning model is executed by the one or more processing elements; causing a first portion of the set of computing units to perform the inference operation of the machine learning model; as well as A second portion of the set of computing units is caused to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation.

2. The method of claim 1, wherein the machine learning model is a neural network, wherein the obfuscation operation is configured to obfuscate at least one of: the number of network layers of the neural network, the number of nodes in a network layer of the neural network, node operations for nodes in a network layer of the neural network, or weight values ​​associated with nodes in a network layer of the neural network.

3. A method as claimed in claim 1 or 2, wherein the one or more measurable characteristics of the machine learning model include at least one of the following: a power profile, an electromagnetic profile, or a time profile.

4. The method of any one of claims 1 to 3, wherein at least a subset of the first portion of the set of computing units and a corresponding subset of the second portion of the set of computing units are located within a common processing element.

5. The method of any one of claims 1 to 4, wherein at least a subset of the first portion of the set of computing units is located in a first processing element, and at least a subset of the second portion of the set of computing units is located in a second processing element different from the first processing element.

6. The method of any one of claims 2 to 5, wherein the obfuscation operation comprises an obfuscation node operation for a specific node to be performed concurrently with a corresponding node operation for the specific node in a network layer.

7. The method of claim 6, wherein the obfuscation node operation specifies an activation function for the specific node, the activation function being different from an actual activation function of the specific node.

8. The method of any one of claims 1 to 7, wherein causing the second portion of the set of computing units to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation comprises assigning the obfuscation operation to a dedicated processing element that performs the obfuscation operation.

9. The method of claim 8, wherein the dedicated processing element comprises one or more processing elements or computing units additionally incorporated into a hardware device and configured to substantially only perform the corresponding obfuscation operation.

10. The method of any one of claims 1 to 9, wherein causing the second portion of the set of computing units to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation comprises: assigning the obfuscation operation to one or more processing elements that also perform inference operations of one or more machine learning models; as well as A subset of the inference operations is reassigned from the one or more processing elements to other processing elements of the hardware device.

11. The method of any one of claims 2 to 10, wherein the neural network is configured to perform a facial recognition task for unlocking the device.

12. A system comprising one or more computers and one or more storage devices, wherein the one or more storage devices store instructions, and when the instructions are executed by the one or more computers, the one or more computers perform corresponding operations, wherein the operations include the method according to any one of claims 1 to 11.

13. One or more computer-readable storage media storing instructions which, when executed by one or more computers, cause the one or more computers to perform corresponding operations, the corresponding operations comprising the method of any one of claims 1 to 11.

14. A method comprising: receiving, at a processor, an instruction set for performing an inference operation with a machine learning model, wherein the instruction set includes at least one instruction for performing an obfuscation operation concurrently with the inference operation; performing the inference operation with the machine learning model at the processor; as well as An obfuscation operation is performed at the processor concurrently with the inference operation.

15. The method of claim 14, wherein the obfuscation operation is configured to obfuscate one or more measurable characteristics of the machine learning model when the obfuscation operation is performed concurrently with the inference operation.

16. The method of claim 14 or 15, wherein the one or more measurable characteristics of the machine learning model include at least one of: a power profile, an electromagnetic profile, or a time profile.

17. The method of any one of claims 14 to 16, wherein the machine learning model is a neural network, wherein the obfuscation operation is configured to obfuscate at least one of: the number of network layers of the neural network, the number of nodes in a network layer of the neural network, node operations for nodes in a network layer of the neural network, or weight values ​​associated with nodes in a network layer of the neural network.

18. The method of claim 17, wherein the neural network is configured to perform a facial recognition task for unlocking the device.

19. The method of claim 17 or 18, wherein the obfuscation operation comprises an obfuscation node operation for a specific node to be performed concurrently with a corresponding node operation for the specific node in a network layer.

20. The method of claim 19, wherein the obfuscation node operation specifies an activation function for the particular node, the activation function being different from an actual activation function of the particular node.

21. A method as described in any one of claims 14 to 20, wherein the processor is configured to assign a first portion of the set of computing units in the processor to perform the inference operation of the machine learning model, and assign a second portion of the set of computing units in the processor to perform the obfuscation operation concurrently with the first portion of the set of computing units performing the inference operation.

22. The method of claim 21, wherein at least a subset of the first portion of the set of computing units is located in a first processing element of the processor, and at least a subset of the second portion of the set of computing units is located in the same processing element or in a second processing element different from the first processing element.

23. The method of claim 21 or 22, wherein the second portion of the set of computational units comprises one or more computational units located in a dedicated processing element in the processor that performs the obfuscation operation.

24. The method of claim 23, wherein the dedicated processing element comprises one or more processing elements or computing units additionally incorporated into the processor and configured to perform substantially only the corresponding obfuscation operation.

25. The method of any one of claims 14 to 24, wherein performing the obfuscation operation concurrently with the inference operation comprises: assigning the obfuscation operation to one or more processing elements of the processor that also perform inference operations of one or more machine learning models; as well as A subset of the inference operations is reassigned from the one or more processing elements to other processing elements of the processor.

26. A system comprising one or more computers and one or more storage devices, wherein the one or more storage devices store instructions, which when executed by the one or more computers cause the one or more computers to perform corresponding operations, wherein the operations include the method according to any one of claims 14 to 25.

27. One or more computer-readable storage media storing instructions which, when executed by one or more computers, cause the one or more computers to perform corresponding operations, the corresponding operations comprising the method of any one of claims 14 to 25.

Images