A method and computer device for active IP protection of edge-deployed DNN

Abstract

The present invention relates to the field of IP protection, and in particular to an edge-deployed DNN active IP protection method and a computer device. The present invention achieves binding of a DNN model with a device that implements the training model and a publicly accessible owner identity by generating a unified credential and model obfuscation to ensure that the protected model can only be executed on a trusted platform and its authenticity is guaranteed. The credential combines weight parameters with a publicly accessible owner identity and an inherent device fingerprint generated locally by the device using PUF technology. The credential modulates the affine parameters of the selected standardized block so that when the correct owner identity is provided, the model is executed normally only on its designated hosting device. Any attempt to tamper with the device, forge ownership, or redeploy the extracted model to a different device will trigger obfuscation and render the model unusable. The present invention is suitable for IP protection.

Description

Technical Field

[0001] The present invention relates to the field of IP (Intellectual Property) protection, and in particular to an edge-deployed DNN (Deep Neural Networks) active IP protection method and a computer device. Background Art

[0002] In recent years, deep neural networks have achieved remarkable success in numerous fields. Deploying DNN models at the edge is increasingly popular due to the demand for real-time, high-performance, and privacy-conscious applications in healthcare, manufacturing, and transportation. Intellectual property protection is critical for model owners who have invested heavily in computing, data annotation, and domain expertise.

[0003] Unlike cloud-deployed DNNs, edge-deployed models face obvious challenges: once on-site, they are often publicly accessible and easy to redistribute, which makes them more vulnerable to model theft attacks. Watermarking and fingerprinting are two popular IP protection scheme models. Most of them are passive methods that aim to prove the ownership of suspicious models. Watermarking requires modifying model parameters to embed copyright information, while fingerprinting extracts intrinsic parameters that characterize the decision boundary of the classifier for ownership proof. Most watermarking and fingerprinting methods cannot avoid ownership fuzziness attacks, that is, attackers can also successfully forge the owner identity of the model to evade IP detection. The passport-based model IP protection method can avoid ownership fuzziness attacks, but the owner information extraction based on this method requires white-box access.

[0004] Additionally, for edge DNNs, having proof of ownership alone is not enough. Given the accessibility of edge devices, it is critical to prevent model tampering, unauthorized redirection of models to similar or different applications, and extraction of models for redeployment on new devices. Existing encryption or obfuscation methods that lock models with keys can only prevent reverse engineering by protecting the model during transmission or when it is stored in an insecure environment. After decryption or deobfuscation, the deployed model becomes completely transparent and vulnerable to various attacks by dishonest users or malicious attackers.

[0005] Therefore, existing DNN IP protection schemes lack consideration of hardware attack vectors and cannot meet the security requirements of edge DNNs. Summary of the invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and provide an edge-deployed DNN active IP protection method and computer device, which greatly improves the security of edge-deployed DNN active IP protection and significantly reduces the accuracy of all attacks.

[0007] The present invention adopts the following technical solutions to achieve the above-mentioned purpose. In a first aspect, the present invention provides an edge-deployed DNN active IP protection method, comprising:

[0008] S1. Generate unified voucher;

[0009] Create a unified credential by selecting a subset of weights of the response bits generated by the device’s PUF (Physical Unclonable Functions);

[0010] Create a unified credential by selecting a subset of weights of the response bits generated by the device’s PUF (Physical Unclonable Functions);

[0011] Specifically include: Generated by activating the PUF function bit response, where , , , to use R from a set of n weight parameters Select a subset of k weights from the PUF generated The bit response is divided into k integers, , i=0,1,...,k-1, each integer has m bits, each integer Choose a weight parameter , the sequential set of weights is selected to form a Vector ;

[0012] Will Convert to The matrix is ​​then randomly projected The matrix is ​​projected onto the space formed by the identities of the owners of the base models. In order to satisfy the conditions of random projection, the identity ID of the owner of the base model is hashed and each bit of the binary hash value Hash(ID) is used as The elements of the binary matrix H are randomly projected by matrix multiplication. , express matrix, express matrix, represents the matrix obtained by matrix multiplication, q represents the size of the same dimension of the selected weight and Hash (ID) matrices, and p and r are the values ​​obtained after reshaping the original data;

[0013] To avoid floating point addition, we convert The elements of are quantized into fixed-point numbers, and the resulting matrix Flatten, each element is converted to 0 or 1 bit according to the sign of its value, The bits are concatenated into a binary string and hashed into a fixed-length credential C;

[0014] S2, model confusion;

[0015] Prepare training dataset ,in and They are training samples and their corresponding true labels;

[0016] Building the base model , and initialize the parameter set ;

[0017] Freeze some basic model parameters , ensuring that frozen parameters are not updated during training;

[0018] In the training set On the basic model Perform training and adjust the trainable parameters to minimize the loss function;

[0019] Use forward propagation to calculate predictions and backpropagation to update the underlying model parameters;

[0020] Introduce the PUF mechanism and the basic model owner identity ID to generate the obfuscated model , ensuring that the obfuscated model functions properly when a valid PUF response and the correct owner ID are present;

[0021] Evaluate the performance of the obfuscated model in the presence of a valid authorized PUF response and the base model owner identity ID, ensuring that the obfuscated model With the basic model quite, express In the test set The inference accuracy on

[0022] Evaluate the performance of the obfuscated model without a valid authorized PUF response or an incorrect base model owner ID, ensuring that the obfuscated model Significant decrease;

[0023] The goal is to freeze ,exist Retraining , so that the confused model In the presence of an authorized PUF response and the base model owner identity ID, the performance is similar to Equivalent, that is:

[0024] ;

[0025] ;

[0026] in and Represents two positive fractions that set the thresholds for maintaining and reducing accuracy respectively. If and For the obfuscated model , the goal is to ensure that the binary symbolic representation The sign of is related to the affine parameters of the selected normalization block and The sign matching is achieved, each binary bit pass Converted to −1 or 1, and pass Modulate as follows:

[0027] ;

[0028] C is divided into two equal parts, namely and , used to modulate a pair of affine parameters and .

[0029] Furthermore, step S2 further includes:

[0030] Introducing an additional voucher loss term , to maintain The size is higher than ,Right now:

[0031] .

[0032] Furthermore, step S2 further includes:

[0033] In order to maintain the performance of the original task, the following cross entropy loss is also included in the training process:

[0034] ;

[0035] in represents the cross entropy calculated by the model M on the output of input x and its true label y. and Merge into:

[0036] , where λ is the equilibrium and The weight factor of .

[0037] In a second aspect, the present invention provides a computer device, including a memory, wherein the memory stores program instructions, and when the program instructions are run, the above-mentioned edge-deployed DNN active IP protection method is executed.

[0038] The beneficial effects of the present invention are:

[0039] The present invention features publicly verifiable ownership and self-obfuscation. By enforcing a connection between model performance and immutable credentials, the integrity of the DNN model monolithically integrated in the edge device can be ensured. The credential combines the weight parameters with the publicly accessible owner identity and the inherent device fingerprint generated locally by the device using PUF technology. The credential modulates the affine parameters of the selected standardized block so that when the correct owner identity is provided, the model is executed normally only on its designated hosting device. Any attempt to tamper with the device, forge ownership, or redeploy the extracted model to a different device will trigger obfuscation and render the model unusable. Therefore, the security of active IP protection of edge-deployed DNNs is greatly improved, and the accuracy of all attacks is significantly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 It is a flow chart of a specific edge deployment DNN active IP protection method provided by an embodiment of the present invention;

[0041] Figure 2 This is a brief process of an edge-deployed DNN active IP protection method provided by an embodiment of the present invention;

[0042] Figure 3 is a schematic diagram of relative frequency distribution of reasoning accuracy of AlexNet (left column) and ResNet-18 (right column) trained on CIFAR-10, CIFAR-100, Caltech-101, and Caltech-256 under random and fuzzy attacks provided by an embodiment of the present invention;

[0043] Figure 4 It is a schematic diagram of an internal attack in the "A-C100-C10" scenario provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0045] like Figure 1 As shown in the figure, the edge deployment DNN active IP protection method flow provided by the present invention is shown, wherein the top convolution block represents the convolution block of the DNN to be protected. The goal of the present invention is to bind the DNN model to the device that implements the training model and the publicly accessible owner identity to ensure that the protected model can only be executed on a trusted platform and its authenticity is guaranteed. Figure 2 As shown, this goal is achieved through two processes: generating unified credentials and model obfuscation.

[0046] S1. Generate unified voucher;

[0047] When implementing pre-trained deep neural networks on hardware accelerator platforms, on-chip memory is inevitable. Depending on the implementation platform, different on-chip memory resources are used, such as dynamic random access memories (DRAMs), hybrid DRAM or non-volatile memory look-up tables (LUTs), block RAMs (BRAMs), and distributed FPGA memory to store weights and normalization parameters, and even parameters for piecewise linear approximations of DNN nonlinear activation functions.

[0048] In-memory physical unclonable functions (PUFs) are one of the most intensively studied PUF technologies and have been demonstrated to work as unique device identifiers in many commercially available products, including Xilinx FPGA chips. In commercially available and custom DNN hardware accelerators, with megabytes or gigabytes of on-chip memory, a large number of reliable PUF response bits can be easily extracted from these memory cells without additional area overhead for stabilization.

[0049] Algorithm 1 shows the proposed unified credential generation algorithm, which includes the following steps:

[0050] Step 1: Input: PUF(), ID, W;

[0051] Step 2: Output: C;

[0052] Step 3: ;

[0053] Step 4: ;

[0054] Step 5: ;

[0055] Step 6: ;

[0056] Step 7: ;

[0057] Step 8: Return ;

[0058] Specifically, in order to achieve that the accuracy of the model trained on the edge device depends on the device, the present invention takes the device memory PUF as an example to generate response bits to select a weight subset to create a unified credential.

[0059] A feasible implementation of the above scheme is: Generated by activating the PUF function bit response, where , , , to use R from a set of n weight parameters Select a subset of k weights from the PUF generated The bit response is divided into k integers, , i=0,1,...,k-1, each integer has m bits, each integer Choose a weight parameter , the sequential set of weights is selected to form a Vector ;

[0060] Will Convert to The matrix is ​​then randomly projected The matrix is ​​projected onto the space formed by the identities of the owners of the base models. In order to satisfy the conditions of random projection, the identity ID of the owner of the base model is hashed and each bit of the binary hash value Hash(ID) is used as The elements of the binary matrix H are randomly projected by matrix multiplication. , express matrix, express matrix, represents the matrix obtained by matrix multiplication, q represents the size of the same dimension of the selected weight and Hash(ID) matrices, and p and r are the values ​​obtained after reshaping the original data. For example, if a vector W with a length of 1000 is converted into a 20*50 matrix, and a Hash(ID) with a length of 1500 is converted into a 50*30 matrix, then p=20, q=50, and r=30.

[0061] To avoid floating point addition, we convert The elements of are quantized into fixed-point numbers, and then the resulting matrix Flatten, each element is converted to 0 or 1 bit according to the sign of its value, The bits are concatenated into a binary string and hashed into a fixed-length credential C.

[0062] S2, model confusion;

[0063] Prepare training dataset ,in and They are training samples and their corresponding true labels;

[0064] Building the base model , and initialize the parameter set ;

[0065] Freeze some basic model parameters , ensuring that frozen parameters are not updated during training;

[0066] In the training set On the basic model Perform training and adjust the trainable parameters to minimize the loss function;

[0067] Use forward propagation to calculate predictions and backpropagation to update the underlying model parameters;

[0068] Introduce the PUF mechanism and the basic model owner identity ID to generate the obfuscated model , ensuring that the obfuscated model functions properly when a valid PUF response and the correct underlying owner ID are present;

[0069] Evaluate the performance of the obfuscated model in the presence of a valid authorized PUF response and the base model owner identity ID to ensure that the obfuscated model With the basic model quite, express In the test set The inference accuracy on

[0070] Evaluate the performance of the obfuscated model in the absence of a valid authorized PUF response or an erroneous base owner ID, ensuring that the obfuscated model Significant decrease;

[0071] The goal is to freeze ,exist Retraining , so that the confused model In the presence of an authorized PUF response and the base model owner identity ID, the performance is similar to Equivalent, that is:

[0072] ;

[0073] ;

[0074] in and Represents two positive fractions that set the thresholds for maintaining and reducing accuracy respectively. If and For the obfuscated model , the goal is to ensure that the binary symbolic representation The sign of is related to the affine parameters of the selected normalization block and The sign matching is achieved, each binary bit pass Converted to −1 or 1, and pass Modulate as follows:

[0075] ;

[0076] C is divided into two equal parts, namely and , used to modulate a pair of affine parameters and .

[0077] Introducing an additional voucher loss term , to maintain The size is higher than ,Right now:

[0078] .

[0079] In order to maintain the performance of the original task, the following cross entropy loss is also included in the training process:

[0080] ;

[0081] in represents the cross entropy calculated by the model M on the output of input x and its true label y. and Merge into:

[0082] , where λ is the equilibrium and The weight factor of .

[0083] Retrained model When implemented on a given device, it will have high inference accuracy, as in the formula The device is equipped with a PUF that performs the intended task and inputs the model owner ID that is exposed to the user. When implemented on an unauthorized device or without the correct owner ID, the trained model produces random predictions, as shown in the formula The performance fidelity when using the correct owner ID on a given device implicitly proves the ownership of the model and guarantees the user the integrity of the model through its provenance. In fact, any attempt to fine-tune the deployed model or tamper with the device will result in the corruption of the unified credential C and render the deployed inference machine unusable.

[0084] S3, evaluation;

[0085] The proposed method is evaluated on popular image classification tasks. Four widely used datasets: CIFAR-10, CIFAR-100, Caltech-101 and Caltech-256 are assumed to be used for model training. Two well-known networks: AlexNet and ResNet-18, which are pre-trained on the above four datasets with batch normalization (BatchNorm) layers, are used as target models.

[0086] and H The dimensions are set to p=64, q=32, r=8, the PUF response length l=2048×22, and the bit length of C is set to 256 for AlexNet and 512 for ResNet-18. C is embedded in the last two batch normalization layers of the target model. In addition, all experiments are performed more than 10 times to obtain the average inference performance.

[0087] Relative frequency distribution of inference accuracy of AlexNet (left column) and ResNet-18 (right column) trained on CIFAR-10, CIFAR-100, Caltech-101, and Caltech-256 (arranged from top to bottom) under random and ambiguous attacks. Figure 3 The x-axis and y-axis in the figure represent the model accuracy and percentage frequency respectively.

[0088] S4, performance fidelity test;

[0089] Table I lists the prediction accuracy of the original training model without credential embedding. , and the prediction accuracy of the encoded model with voucher embedding , both separated by ' / '. The results show that the inference performance of the protected models either exceeds or is comparable to the original trained models, with the maximum accuracy drop of 0.63% for ResNet-18 and 0.69% for AlexNet in all datasets.

[0090] Table I. Performance fidelity between non-encoding and encoding models

[0091] CIFAR-10 CIFAR-100 Caltech-101 Caltech-256 ResNet-18 93.34 / 92.93 71.20 / 71.16 74.59 / 73.96 57.00 / 57.00 AlexNet 89.74 / 90.91 69.40 / 68.71 68.38 / 68.00 52.46 / 52.81

[0092] S5, attack performance;

[0093] Random Attacks: An attacker may attempt to claim ownership of a deployed model, or extract the model (e.g., from a reconfigurable bitstream if the designated device of the protected model is an FPGA) and implement it on another device. Both attacks will produce false credentials C. For each of the eight target models, we randomly generated 10 forged owner IDs and simulated 10 different PUFs of the attacker to represent 10 different devices. Figure 3 It is shown that using a different ID or deploying the model on an incorrect device will lead to random inference results.

[0094] Fuzzy attack: The attacker's goal is to forge another available owner ID and / or device by fine-tuning the model to restore prediction accuracy. The attacker tries to guess the PUF response and retrain the model with his own ID on the correct or wrong device. The present invention assumes that the attacker has a proportion of the original dataset α. Usually, α is assumed to be less than 0.1, but the present invention chooses α = 0.1 and 0.4, which are more favorable to the attacker in this evaluation, to prove that the present invention is still effective even under the premise that the attacker has strong capabilities. Figure 3 As shown in Figure 2, under the reasonable assumption of α = 0.1, all target models suffer significant accuracy loss under this attack. Even with 40% of the original dataset, the attacker's model will lose at least 5.05% accuracy (AlexNet trained on CIFAR-10 loses 5.05% accuracy in this case). For more complex datasets (Caltech-101 and Caltech-256), the performance degradation of the fuzzy attack is more significant.

[0095] Insider attack: We assume a dishonest insider who has the right equipment and accurate model parameters, including hyperparameters, and tries to retarget the model to a different application by fine-tuning. We denote the fine-tuning of model M pre-trained on dataset D1 (application D1) to dataset D2 (application D2) as “M-D1-D2”. We evaluate the following insider attack scenarios: R18-C10-C100, R18-C100-C10, R18-CT101-CT256, R18-CT256-CT101, A-C10-C100, A-C100-C10, A-CT101-CT256, and A-CT256-CT101, where ResNet-18, AlexNet, CIFAR, and Caltech are abbreviated as R, A, C, and CT, respectively.

[0096] Figure 4 The experimental results of the “A-C100-C10” internal attack are shown. It can be seen that the model failed to converge, and the average accuracy was only about 53% even after fine-tuning for 200 epochs. It is important to note that the same trend of convergence failure is consistent in all eight cases tested. An epoch refers to the process of training the model once through the entire training dataset.

[0097] In summary, the present invention provides a novel active IP protection scheme for edge-deployed deep neural networks. The scheme achieves self-obfuscation and publicly verifiable ownership by modifying the affine parameters in selected normalization blocks using a unified credential that binds the model weights to its owner ID and the intrinsic PUF response of its host device.

[0098] Extensive random attacks, fuzzy attacks, and internal attacks were conducted on the obfuscated AlexNet and ResNet-18 models on four different datasets. The results show that the protected models, after being deployed on designated devices, can prevent unauthorized access and physical attacks, and automatically lock the model functions when unauthorized operations are performed on the model.

[0099] Since access to a deployed model is authorized by providing a valid and public owner ID, ownership can be proven via black-box inspection (without knowing the model internal parameters). Future work will explore user tracking and extend this approach to the protection of generated models.

[0100] The above is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or the technology or knowledge of the relevant field. The changes and modifications made by those skilled in the art shall not deviate from the spirit and scope of the present invention, and shall be within the scope of protection of the claims attached to the present invention.

Claims

1. An edge-deployed DNN active IP protection method, characterized in that: include: S1. Generate unified voucher; Create a unified credential by selecting a subset of weights through the response bits generated by the device’s PUF; Specifically include: Generated by activating the PUF function bit response, where , , , to use R from a set of n weight parameters Select a subset of k weights from The bit response is divided into k integers, , i=0,1,...,k-1, each integer has m bits, each integer Choose a weight parameter , the sequential set of weights is selected to form a Vector ; Will Convert to The matrix is ​​then randomly projected The matrix is ​​projected onto the space formed by the identity of the owner of the base model, and the identity ID of the owner of the base model is hashed, and each bit of the binary hash value Hash(ID) is used as The elements of the binary matrix H are then randomly projected by matrix multiplication, , express matrix, express matrix, represents the matrix obtained by matrix multiplication, q represents the size of the same dimension in the selected weight and Hash (ID) matrices, and p and r are the values ​​obtained after reshaping the original data; Before random projection The elements of are quantized into fixed-point numbers, and then the resulting matrix Flatten, each element is converted to 0 or 1 bit according to the sign of its value, The bits are concatenated into a binary string and hashed into a fixed-length credential C; S2, model confusion; Prepare training dataset ,in and are the i-th training sample and its corresponding true label; Building the base model , and initialize the parameter set ; Freeze some basic model parameters to ensure that the frozen parameters are not updated during the training process; In the training set On the basic model Perform training and adjust the trainable parameters to minimize the loss function; Use forward propagation to calculate predictions and backpropagation to update the underlying model parameters; Introduce PUF mechanism and model owner identity ID to generate obfuscated model , ensuring that the obfuscated model operates properly when there is a valid PUF response and the correct owner ID; Evaluate the performance of the obfuscated model in the presence of a valid authorized PUF response and the model owner identity ID to ensure that the obfuscated model With the basic model Comparable performance, express In the test set The inference accuracy on Evaluate the performance of the obfuscated model in the absence of a valid authorized PUF response or an incorrect owner ID, ensuring that the obfuscated model Performance degrades significantly.

2. The edge deployment DNN active IP protection method according to claim 1 is characterized in that: Step S2 specifically includes: The goal is to freeze ,exist Retraining , so that the confused model In the presence of an authorized PUF response and the base model owner identity ID, the performance is similar to Equivalent, that is: ； ； in and Represents two positive fractions that set the thresholds for maintaining and reducing accuracy respectively. If and For the obfuscated model , the goal is to ensure that the binary symbolic representation The sign of is related to the affine parameter of the selected normalization block and Each binary bit is matched pass Convert to or 1, and pass Modulate as follows: ； C is divided into two equal parts, namely and , used to modulate a pair of affine parameters and .

3. The edge deployment DNN active IP protection method according to claim 2 is characterized in that: Step S2 specifically also includes: Introducing an additional voucher loss term , to maintain The size is higher than ,Right now: 。 4. The edge deployment DNN active IP protection method according to claim 3 is characterized in that: Step S2 also includes: The following cross entropy loss is also included in the training process: ； in represents the cross entropy calculated by the model M on the output of input x and its true label y. and Merge into: , where λ is the equilibrium and The weight factor of .

5. A computer device, comprising a memory, wherein the memory stores program instructions, characterized in that: When the program instructions are executed, the edge-deployed DNN active IP protection method as described in any one of claims 1 to 4 is executed.

Images