Machine learning model encryption method and decryption method based on control flow

Abstract

The invention discloses a machine learning model encryption method and decryption method based on control flow, which are used for improving the security of a machine learning model and reducing the risk that the machine learning model is stolen. The scheme provided by the invention comprises the following steps: acquiring control flow information of a to-be-encrypted machine learning model, wherein the control flow information comprises information of a plurality of operator nodes and information of a control flow relationship among the plurality of operator nodes; constructing a node set comprising a plurality of operator nodes and at least one confusion node based on the control flow information, and generating a mapping relation record; encrypting the mapping relation record to obtain a ciphertext relation record; and constructing a confusion encryption model based on the ciphertext relation record and each node in the node set, wherein the confusion encryption model carries the ciphertext relation record. Through the scheme provided by the invention, the original machine learning model is difficult to restore even if the confusion encryption model is leaked, so that the security of the machine learning model is improved, and the risk that the machine learning model is stolen is reduced.

Description

Technical Field

[0001] The present application relates to the field of machine learning, and in particular to a control flow-based machine learning model encryption method and decryption method. Background Art

[0002] In the process of applying machine learning models, machine learning models are often stored in plain text in memory, which may be leaked and even stolen. Machine learning models are often composed of multiple operator nodes based on certain control flow relationships. Once the operator nodes of the machine learning model are leaked, the control flow relationships between multiple operator nodes may also be reconstructed through reverse reasoning.

[0003] How to improve the security of machine learning models and reduce the risk of machine learning models being misused is the technical problem to be solved by this application. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a control flow-based machine learning model encryption method and decryption method to improve the security of the machine learning model and reduce the risk of the machine learning model being stolen.

[0005] In a first aspect, a control flow-based machine learning model encryption method is provided, comprising: Acquire control flow information of the machine learning model to be encrypted, wherein the control flow information includes information of multiple operator nodes and information of control flow relationships between the multiple operator nodes; Constructing a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, and generating a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set; Encrypting the mapping relationship record to obtain a ciphertext relationship record; An obfuscated encryption model is constructed based on the ciphertext relationship record and each node in the node set, and the obfuscated encryption model carries the ciphertext relationship record.

[0006] In a second aspect, a control flow-based machine learning model decryption method is provided, comprising: Obtain the obfuscated encryption model that carries the ciphertext relationship record; Extracting nodes in the obfuscated encryption model to construct a node set; Decrypting the ciphertext relationship record to obtain a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between an operator node in a control flow relationship of a machine learning model and an operator node in a node set; The operator nodes in the node set are constructed into a machine learning model based on the control flow relationship according to the mapping relationship record.

[0007] In a third aspect, a control flow-based machine learning model encryption device is provided, comprising: A first acquisition module is used to acquire control flow information of a machine learning model to be encrypted, wherein the control flow information includes information of multiple operator nodes and information of control flow relationships between the multiple operator nodes; A first generating module constructs a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, and generates a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set; A first encryption module encrypts the mapping relationship record to obtain a ciphertext relationship record; The first construction module constructs an obfuscated encryption model based on the ciphertext relationship record and each node in the node set, wherein the obfuscated encryption model carries the ciphertext relationship record.

[0008] In a fourth aspect, a control flow-based machine learning model decryption device is provided, comprising: The second acquisition module acquires the obfuscated encryption model carrying the ciphertext relationship record; A second extraction module extracts nodes in the obfuscated encryption model to construct a node set; A second decryption module performs decryption on the ciphertext relationship record to obtain a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between an operator node in a control flow relationship of a machine learning model and an operator node in a node set; The second construction module constructs the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record.

[0009] In a fifth aspect, an electronic device is provided, which includes a processor, a memory, and a computer program stored in the memory and executable on the processor, and when the computer program is executed by the processor, the steps of the method of the first aspect or the second aspect are implemented.

[0010] In a sixth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method of the first aspect or the second aspect are implemented.

[0011] In a seventh aspect, a computer program product is provided, which includes a non-transitory computer-readable storage medium storing a computer program, wherein the computer program is operable to cause a computer to execute part or all of the steps of the method of the first aspect or the second aspect.

[0012] In an embodiment of the present application, first, the control flow information of the machine learning model to be encrypted is obtained, and the control flow information includes information of multiple operator nodes and information of control flow relationships between multiple operator nodes. Then, a node set including multiple operator nodes and at least one obfuscated node is constructed based on the control flow information, and a mapping relationship record is generated, and the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set. Among them, the obfuscated node plays an obfuscating role in the node set. Even if the node set is leaked, it is difficult to identify which are the real operator nodes contained in the machine learning model from the node set, thereby avoiding model leakage caused by reverse reconstruction of the model based on the real operator node. Then, the mapping relationship record is encrypted to obtain a ciphertext relationship record. The ciphertext relationship record can effectively store the real control flow relationship between the operator nodes, ensure that the machine learning model can be accurately reconstructed, and avoid the loss of the relationship between the nodes. Finally, a confused encryption model is constructed based on the ciphertext relationship record and each node in the node set, and the confused encryption model carries the ciphertext relationship record. The obfuscated encryption model constructed by the solution provided in the embodiment of the present application contains obfuscated nodes. Even if the obfuscated encryption model is leaked, it is difficult to restore the original machine learning model, thereby improving the security of the machine learning model and reducing the risk of the machine learning model being stolen. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1a This is one of the flowcharts of a control flow-based machine learning model encryption method in an embodiment of the present application; Figure 1b It is a schematic diagram of the local structure of a machine learning model of an embodiment of the present application; Figure 1c is a schematic diagram of the properties of an activation function in a machine learning model of an embodiment of the present application; Figure 2 This is a second flowchart of a control flow-based machine learning model encryption method in an embodiment of the present application; Figure 3a This is a flowchart of a control flow-based machine learning model encryption method according to an embodiment of the present application; Figure 3bIt is a schematic diagram of the original model and node superset structure in a control flow-based machine learning model encryption method in an embodiment of the present application; Figure 4a This is a fourth flowchart of a control flow-based machine learning model encryption method in an embodiment of the present application; Figure 4b It is a schematic diagram of the structure of the original model, node superset and obfuscated identification pair in a control flow-based machine learning model encryption method in an embodiment of the present application; Figure 5 This is a flowchart of a control flow-based machine learning model encryption method according to an embodiment of the present application; Figure 6a This is a flowchart of a control flow-based machine learning model encryption method according to an embodiment of the present application; Figure 6b It is a schematic diagram of a reconstructed model structure of a control flow-based machine learning model encryption method according to an embodiment of the present application; Figure 7 This is one of the flowcharts of a control flow-based machine learning model decryption method according to an embodiment of the present application; Figure 8 This is a second flowchart of a control flow-based machine learning model decryption method according to an embodiment of the present application; Fig. 9 This is a flowchart of a control flow-based machine learning model decryption method according to an embodiment of the present application; Fig.10 This is a fourth flowchart of a control flow-based machine learning model decryption method according to an embodiment of the present application; Fig.11 It is a structural diagram of a control flow-based machine learning model encryption device in one embodiment of the present application; Fig.12 It is a structural diagram of a control flow-based machine learning model decryption device according to an embodiment of the present application. DETAILED DESCRIPTION

[0014] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application. The numbering of the drawings in this application is only used to distinguish the various steps in the scheme, and is not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0015] In the field of machine learning, encrypting machine learning models can effectively improve the security of machine learning models. Encrypted machine learning models are often not viewable and parseable through conventional visualization tools such as Netron. Encryption can effectively protect the internal structure and logic of machine learning models and reduce the risk of machine learning models being stolen.

[0016] The present application embodiment provides a method for encrypting a machine learning model based on control flow, such as Figure 1a As shown, including: S11: Obtain control flow information of the machine learning model to be encrypted, where the control flow information includes information of multiple operator nodes and information of control flow relationships between the multiple operator nodes.

[0017] Machine learning models are often composed of multiple operator nodes, which have specific directed connections between them. This connection is called a control flow relationship.

[0018] Figure 1b A schematic diagram of the local structure of a machine learning model is shown, which includes multiple operator nodes. The directed arrows between the operator nodes are used to indicate the direction of data flow, that is, the directed control flow relationship between the operator nodes. Figure 1b The local structure of the model shown contains a variety of operator nodes, including activation function Relu, convolution function Conv, and normalization function Batch Normalization.

[0019] Any operator node can include its own attributes. For example, the attributes of the activation function Relu are as follows: Figure 1c The attributes of an operator node may include, for example, the node type, model, name, input parameters, output parameters, etc. of the operator node. In practical applications, the attributes of different operator nodes are often different and can be flexibly set according to actual needs.

[0020] In this step, the encrypted machine learning model is parsed, each operator node in the machine learning model is extracted to generate information of multiple operator nodes in the control flow information, and the control flow relationship between the multiple operator nodes is extracted to generate information of the control flow relationship in the control flow information.

[0021] Optionally, the attributes of any operator node can be stored in the operator node information.

[0022] S12: constructing a node set including the multiple operator nodes and at least one obfuscation node based on the control flow information, and generating a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set.

[0023] In this step, a node set is constructed based on information of multiple operator nodes in the control flow information, and a mapping relationship record is generated based on information of control flow relationships in the control flow information.

[0024] The set generated in this step includes every operator node and at least one obfuscated node included in the original machine learning model. Among them, the obfuscated node can be a false node generated based on the real operator node in the machine learning model. The attributes in multiple real operator nodes can be spliced, modified, etc. to generate the attributes of the obfuscated node, so that the generated obfuscated node is close to the real operator node, reducing the difference between the obfuscated node and the real operator node. The node set generated by this step contains obfuscated nodes that do not exist in the machine learning model. The obfuscated nodes are similar to the real operator nodes and can play an obfuscating role in the node set. Even if the node set is leaked, it is difficult to distinguish which are the real operator nodes in the machine learning model, reducing the possibility of reconstructing the machine learning model by reverse reasoning from the operator nodes.

[0025] The mapping relationship record in this step is generated based on the control flow relationship between operator nodes and the node set in the machine learning model. The mapping relationship record specifically includes the mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set.

[0026] On the one hand, the mapping relationship record can indicate which nodes in the node set are the real operator nodes in the machine learning model. On the other hand, the mapping relationship record can indicate the control flow relationship of the operator nodes in the node set in the machine learning model. The mapping relationship record can be used to extract the real operator nodes from the node set and reconstruct the original machine learning model according to the control flow relationship.

[0027] S13: Encrypt the mapping relationship record to obtain a ciphertext relationship record.

[0028] In this step, the mapping relationship record can be encrypted based on a preset encryption rule, which can be flexibly set according to actual needs. Encryption can protect the content in the mapping relationship record. If the ciphertext relationship record is leaked, encryption protection can reduce the probability of cracking and protect the control flow relationship of machine learning.

[0029] S14: constructing an obfuscated encryption model based on the ciphertext relationship record and each node in the node set, wherein the obfuscated encryption model carries the ciphertext relationship record.

[0030] In this step, the above-mentioned ciphertext relationship record and node set combination can be stored as an obfuscated encryption model. Among them, the node set contains obfuscated nodes, and even if the node set is leaked, it is difficult to extract the real operator nodes of the machine learning model from it. The ciphertext relationship record is encrypted and presented in ciphertext form, which can avoid the leakage of the real control flow relationship of the machine learning model on the basis of recording the node mapping relationship. The scheme provided by the embodiment of the present application realizes encryption in both operator nodes and control flow relationships, which increases the difficulty of model reverse engineering. Even if some information is leaked, it is difficult to crack the machine learning model before encryption, thereby enhancing the security of the machine learning model.

[0031] In an embodiment of the present application, first, the control flow information of the machine learning model to be encrypted is obtained, and the control flow information includes information of multiple operator nodes and information of control flow relationships between multiple operator nodes. Then, a node set including multiple operator nodes and at least one obfuscated node is constructed based on the control flow information, and a mapping relationship record is generated, and the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set. Among them, the obfuscated node plays an obfuscating role in the node set. Even if the node set is leaked, it is difficult to identify which are the real operator nodes contained in the machine learning model from the node set, thereby avoiding model leakage caused by reverse reconstruction of the model based on the real operator node. Then, the mapping relationship record is encrypted to obtain a ciphertext relationship record. The ciphertext relationship record can effectively store the real control flow relationship between the operator nodes, ensure that the machine learning model can be accurately reconstructed, and avoid the loss of the relationship between the nodes. Finally, a confused encryption model is constructed based on the ciphertext relationship record and each node in the node set, and the confused encryption model carries the ciphertext relationship record. The obfuscated encryption model constructed by the solution provided in the embodiment of the present application contains obfuscated nodes. Even if the obfuscated encryption model is leaked, it is difficult to restore the original machine learning model, thereby improving the security of the machine learning model and reducing the risk of the machine learning model being stolen.

[0032] Based on the solution provided in the above embodiment, optionally, Figure 2 As shown, in the above steps, in the above step S12, a node set including the multiple operator nodes and at least one obfuscation node is constructed based on the control flow information, including: S21: Taking each operator node in the control flow information as an element, an operator set is constructed.

[0033] S22: constructing a superset of the operator set as the node set, wherein a difference set between the node set and the operator set includes an element corresponding to at least one confusion node.

[0034] In this example, each operator node in the control flow information is first used as an element to construct an operator set containing all real operator nodes. Then a superset is constructed based on the operator set so that the node set contains more elements than the operator set. The difference between the above node set and the operator set is the element corresponding to at least one obfuscated node.

[0035] In the solution provided in the embodiment of the present application, a node set containing obfuscated nodes is generated by constructing a superset, thereby confusing the operator nodes in the original machine learning model, improving the security of the machine learning model, and reducing the risk of the machine learning model being stolen.

[0036] Based on the solution provided in the above embodiment, optionally, Figure 3a As shown, in the above step S12, a node set including the multiple operator nodes and at least one obfuscation node is constructed based on the control flow information, and a mapping relationship record is generated, including: S31: Create corresponding obfuscation identifiers for the multiple operator nodes and the at least one obfuscation node respectively.

[0037] In this step, a corresponding obfuscation identifier is created for each node, and the obfuscation identifier is used to distinguish each node. The obfuscation identifier can be an ordered identifier, such as assigning identifiers to each node according to letters, numbers, etc. Alternatively, the obfuscation identifier can also be a non-ordered identifier, such as random characters.

[0038] The expression forms of the identifiers of the operator nodes and the obfuscation nodes can be similar, so as to achieve the effect of obfuscation. For example, the operator nodes and the obfuscation nodes are shuffled, and an identification method is used to assign obfuscation identifiers to each node after the shuffle. In this way, the obfuscation identifiers corresponding to the operator nodes and the obfuscation identifiers corresponding to the obfuscation nodes can be similar in expression form, achieve the effect of obfuscation, and improve security.

[0039] S32: constructing the obfuscation identifier and the corresponding node into elements of the node set to obtain the node set, wherein the obfuscation identifier in any element is unique in the node set.

[0040] In this step, the obfuscated identifier and the node are constructed into elements based on the corresponding relationship, thereby generating a node set. In the node set, the obfuscated identifier in any element is unique, and the obfuscated identifier can be used to find the unique corresponding node in the set.

[0041] S33: The obfuscation identifiers corresponding to the multiple operator nodes are stored in association with each other according to the control flow relationship to obtain the mapping relationship record.

[0042] In this step, the control flow relationship of the operator nodes is stored as a mapping relationship record. Wherein, any operator node corresponds to a unique obfuscation identifier. In this step, each operator node in the control flow relationship is replaced with the corresponding obfuscation identifier, and then these obfuscation identifiers are associated and stored as a mapping relationship record according to the control flow relationship.

[0043] Since the obfuscation identifiers correspond to the operator nodes one by one, and each obfuscation identifier is stored as a mapping relationship record according to the control flow relationship, the mapping relationship record can effectively store the control flow relationship of each operator node. On the one hand, the obfuscation identifier is stored in the mapping relationship record, which can hide the corresponding operator node and play an encryption role. On the other hand, the mapping relationship record effectively stores the control flow relationship. Based on the mapping relationship record, the original machine learning model can be fully reconstructed to avoid the loss of logical relationships.

[0044] The present invention is further described below with reference to an example.

[0045] First, each operator node in the original machine learning model is randomly mapped to a larger node set, and corresponding obfuscation identifiers are created for the mapped new nodes. Randomly generated obfuscation nodes are filled in the unmapped positions in the new set to form a superset that includes the real operator nodes in the original machine learning model and the randomly generated obfuscation nodes.

[0046] See also Figure 3b In the step of creating the obfuscation mark, all the operator nodes of the original model can be mapped randomly first, that is, the n nodes (such as A, B, C) in the original model are shuffled and mapped to a (n+m) node set in a larger set space to form a new node mark (such as 1, 2, 3, 4, 5...). In the original machine learning model, the order of the operator nodes in the control flow relationship is A→B→C..., then, the above operator nodes are shuffled and mapped to a larger set space, for example, A is mapped to 3, B is mapped to 9, and C is mapped to 4. For the unmapped positions 1, 2, 5, 6, 7, 8..., fill in the randomly generated obfuscation nodes as a node superset.

[0047] Through the solution provided in the embodiment of the present application, each node in the model is obfuscated and encrypted, the complexity of reconstructing the original machine learning model is increased, and the security of the original machine learning model is improved. The connection relationship between nodes is effectively saved by recording the mapping relationship, avoiding the loss of the model's logical relationship and ensuring the integrity and functionality of the reconstructed model.

[0048] Based on the solution provided in the above embodiment, optionally, Figure 4a As shown, in the above step S33, the obfuscation identifiers corresponding to the multiple operator nodes are stored in association with each other according to the control flow relationship to obtain the mapping relationship record, including: S41: Generate an obfuscation identifier corresponding to a first operator node and an obfuscation identifier corresponding to a second operator node into an obfuscation identifier pair, wherein the first operator node directly points to the second operator node in the control flow relationship.

[0049] In the solution provided in the embodiment of the present application, a pair of operator nodes directly connected in the control flow relationship is stored in the form of a pair of obfuscated identifiers. Wherein, the first operator node in the control flow relationship directly points to the second operator node, which specifically means that the data flow is directly used as the input of the second operator node after being output from the first operator node, that is, the data flow does not pass through other operator nodes between the first operator node and the second operator node. Wherein, if the output of the first operator node is used as the input of multiple second operator nodes, then multiple pairs of obfuscated identifiers pointing from the first operator node to each second operator node can be generated respectively, so as to effectively store the control flow relationship in which the first operator node points to each second operator node respectively.

[0050] In this example, all inter-node relationships in the control flow relationship are traversed to ensure that all direct pointing relationships between nodes are stored as obfuscated identification pairs.

[0051] By generating obfuscated identification pairs through this step, the direct connection relationship between operators can be effectively stored, so that complex control flow relationships can be stored in the form of small-grained node pairs, which can achieve effective storage of control flow relationships.

[0052] S42: The obfuscated identification pairs generated based on the multiple operator nodes are stored as the mapping relationship records.

[0053] In this step, the multiple obfuscation identification pairs generated in the above step may be shuffled, and the randomly ordered multiple obfuscation identification pairs may be stored as ordered mapping relationship records. Alternatively, the discrete multiple obfuscation identification pairs may be stored as unordered mapping relationship records.

[0054] Through the solution provided by the embodiment of the present application, the obfuscated identification pairs are stored as mapping relationship records, which can effectively store the real control flow relationship between multiple operator nodes and avoid the loss of logical relationship between operator nodes. The integrity of the reconstructed machine learning model is guaranteed, and the performance of the reconstructed machine learning model is ensured.

[0055] The present invention is further described below with reference to an example.

[0056] based on Figure 3b For the example shown, see Figure 4bIn this example, the obfuscation identification pair is generated according to the control flow relationship of the operator node. Specifically, in the original model, node A directly points to node B, the obfuscation identification corresponding to node A is 3, and the obfuscation identification corresponding to node B is 9. Then, based on the control flow relationship that node A directly points to node B, the generated obfuscation identification pair is "39", which is used to indicate that the node corresponding to obfuscation identification 3 directly points to the node corresponding to obfuscation identification 9, thereby storing the control flow relationship that node A directly points to node B.

[0057] Similarly, for the control flow relationship where node B directly points to node C, the generated obfuscated identifier pair is "94".

[0058] Through the solution provided in the embodiment of the present application, corresponding obfuscation identification pairs are generated based on the control flow relationship and stored as mapping relationship records, which can effectively preserve the relationship between nodes in the original machine learning model, avoid the loss of logical relationships, and ensure that the machine learning model can be reconstructed.

[0059] Based on the solution provided in the above embodiment, optionally, Figure 5 As shown, step S13, encrypting the mapping relationship record to obtain a ciphertext relationship record, includes: S51: Encrypting each obfuscation identification pair in the mapping relationship record based on a preset encryption rule to obtain encrypted obfuscation identification pairs corresponding to each obfuscation identification pair.

[0060] In this example, encryption is performed on the mapping relationship record to further improve the security of the control flow relationship. Specifically, each obfuscated identifier pair in the mapping relationship record is encrypted separately to obtain multiple ciphertexts. Among them, encryption can be performed based on a preset encryption rule, and the preset encryption rule can be flexibly set according to actual needs. For example, see Figure 4b , encrypt the obfuscated identifier "39" to obtain the ciphertext 39, and encrypt the obfuscated identifier "94" to obtain the ciphertext 94.

[0061] S52: storing the encrypted obfuscation identification pairs corresponding to the respective obfuscation identification pairs as ciphertext relationship records.

[0062] In this step, the encrypted obfuscation identification pairs are stored as ciphertext relationship records, and each encrypted obfuscation identification pair can be stored as a ciphertext relationship record in an ordered or unordered manner. Optionally, the encrypted obfuscation identification pairs can also be encoded as ciphertext relationship records in a specific manner, and the actual storage rules can be flexibly set according to requirements.

[0063] Through the solution provided in the embodiment of the present application, encryption is performed on the mapping relationship records, which can effectively improve the security of the control flow relationship.

[0064] Based on the solution provided in the above embodiment, optionally, Figure 6aAs shown, in the above step S31, corresponding obfuscation identifiers are created for the multiple operator nodes and the at least one obfuscation node, respectively, including: S61: Randomly sort the multiple operator nodes and the at least one obfuscation node, and create ordered obfuscation identifiers corresponding to the nodes according to the random sorting result.

[0065] In this step, multiple operator nodes and obfuscation nodes are randomly sorted, and ordered obfuscation marks are created according to the random sorting results. The obfuscation marks created by this step are ordered, and the order of each operator node and obfuscation node is random. The obfuscation marks corresponding to the real operator nodes and the obfuscation marks corresponding to the obfuscation nodes are displayed in the same ordered form, which can play a better obfuscation role. Therefore, it is difficult to distinguish which are the operator nodes from the node set based on the obfuscation marks alone.

[0066] Among them, in the above step S14, constructing an obfuscated encryption model based on the ciphertext relationship record and each node in the node set includes: S62: Creating an obfuscation control flow relationship between nodes based on the ordered obfuscation identifiers in the node set. In this example, the obfuscated control flow relationship is further created based on the node set. The obfuscated control flow relationship between nodes is created according to the order of the ordered obfuscation identifiers in the node set. Figure 4b , the ordered obfuscation identifier may specifically refer to 1, 2, 3, ... in the node superset. In this step, the obfuscated control flow relationship is created in the order of the ordered obfuscation identifiers, thereby constructing a virtual control flow relationship that plays an obfuscating role, which can further hide the real control flow relationship.

[0067] S63: Connecting each node in the node set according to the obfuscated control flow relationship to generate the obfuscated encryption model carrying the ciphertext relationship record.

[0068] In this step, an obfuscated encryption model is generated based on the virtual obfuscated control flow relationship to further hide the real control flow relationship. Figure 6b In the example shown, according to the ordered obfuscation identifiers of 1, 2, 3, ... in the node superset, the corresponding nodes in the generated obfuscated encryption model are M→L→A→C→O...

[0069] Through the solution provided by the embodiment of the present application, based on the random ordering of nodes, a virtual obfuscated control flow relationship is further generated, and then a virtual obfuscated encryption model is generated. The obfuscated encryption model has multiple nodes and connection relationships between nodes, which can play an obfuscating role, hide the real machine learning model, and play an obfuscating encryption role.

[0070] Optionally, for the above step S14, the storage method can be flexibly adjusted in actual applications. For example, the node superset and the ciphertext relationship record are combined and stored into a file, and the obfuscated encryption model is reconstructed based on the file.

[0071] The node superset is stored in plain text, which does not contain the real operator nodes and the real relationship information between nodes. The ciphertext relationship record saves the relationship between nodes in an encrypted form and excludes the information of irrelevant confusing nodes, ensuring the integrity and security of the model.

[0072] Furthermore, the above-mentioned node superset and ciphertext relationship record are combined and stored into a file, and a new obfuscated encryption model is reconstructed. Among them, although the node superset is stored in plain text, the attacker cannot perform learning model inference based only on the node superset, which lacks the node-to-node relationship required for reconstructing the model. Moreover, the node superset also contains obfuscated nodes that are not included in the original machine learning model, which further increases the difficulty for the attacker to reconstruct the model. The ciphertext relationship record stores the relationship information between the nodes according to the original calculation order of the nodes, which can be used to reconstruct the model. However, for the attacker, the ciphertext relationship record is stored in an encrypted form and is also difficult to use to reconstruct the model. Therefore, the solution provided in the embodiment of the present application increases the difficulty for the attacker to reconstruct the model from the two aspects of node and control flow relationship, and effectively protects the security of the original machine learning model.

[0073] Through the solution provided by the embodiment of the present application, the operator nodes in the original machine learning model and the control flow relationship between the nodes are stored separately, which can reduce the encryption cost and improve security on the basis of saving the necessary information for rebuilding the machine learning model. By adding obfuscated nodes, the original real operator nodes are protected, and by recording encrypted mapping relationships, the control flow relationship can be protected on the basis of complete storage of the control flow relationship, making it more difficult for attackers to reconstruct the model.

[0074] In practical applications, encrypting deep learning models to prevent unauthorized access and copying is an important security measure. When encryption technology is applied to deep learning models, it may have the following disadvantages: Memory theft attack: The model has been encrypted and decrypted when loaded, so the model exists in plain text in the memory. Attackers may still be able to dump the memory through malware, vulnerability exploits, etc., and obtain the decrypted model parameters.

[0075] High memory usage: For some edge devices, the size of memory resources directly affects the cost. Memory is often designed to be the minimum available, so edge device memory resources are usually in short supply. If the model file is directly decrypted and stored in the memory, the memory usage will increase greatly.

[0076] In view of the above shortcomings, the present application embodiment provides a machine learning model decryption method based on control flow, such as Figure 7 As shown, including: S71: Obtain an obfuscated encryption model that carries ciphertext relationship records.

[0077] The solution provided in the embodiment of the present application is used to decrypt the obfuscated encryption model encrypted by the control flow-based machine learning model encryption method provided in any of the above embodiments. In this step, the obfuscated encryption model carrying the ciphertext relationship record is obtained.

[0078] S72: Extract nodes in the obfuscated encryption model to construct a node set.

[0079] In this step, the nodes in the obfuscated encryption model are extracted, and each node is used as an element to construct a node set. The node set contains operator nodes in the real machine learning model and obfuscated nodes.

[0080] S73: Decrypt the ciphertext relationship record to obtain a mapping relationship record, where the mapping relationship record includes a mapping relationship between operator nodes in a control flow relationship of a machine learning model and operator nodes in a node set.

[0081] In this step, the ciphertext relationship record is decrypted. The decryption is performed according to the encryption rule of the ciphertext relationship record to obtain the mapping relationship record before encryption. The mapping relationship record contains the mapping relationship between the real operator nodes in the machine learning model and the operator nodes in the node set, and the mapping relationship record also reflects the real control flow relationship of the operator nodes in the machine learning model.

[0082] S74: Construct the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record.

[0083] In this step, the real operator nodes of the machine learning model are determined from the node set according to the mapping relationship record, and the operator nodes are constructed into a machine learning model according to the control flow relationship in the mapping relationship record.

[0084] Through the solution provided in the embodiments of the present application, the obfuscated encryption model can be decrypted and reconstructed into the machine learning model before encryption, effectively ensuring the integrity and functionality of the reconstructed machine learning model.

[0085] In actual application, the encrypted model file can be decrypted first, then the decrypted model data can be loaded into the memory, and then the model can be loaded into the corresponding deep learning framework through a specific interface or method to achieve secure model inference service. This process is not only applicable to ONNX models, but also to any deep learning model framework (such as TensorFlow, PyTorch or other frameworks that support model encryption).

[0086] Based on the solution provided in the above embodiment, optionally, Figure 8 As shown, in the above step S73, the ciphertext relationship record is decrypted to obtain a mapping relationship record, including: S81: Parse the ciphertext relationship record to obtain the encrypted obfuscation identification pair in the ciphertext relationship record.

[0087] S82: Decrypt the encrypted obfuscation identification pairs in the ciphertext relationship record based on preset encryption rules to obtain a mapping relationship record containing the obfuscation identification pair, where the obfuscation identification pair represents a directed control flow relationship between a pair of operator nodes.

[0088] In the solution provided in the embodiment of the present application, through a pre-set reasoning program and a correct key, the stored relationship records are decrypted one by one to obtain multiple obfuscated identification pairs, which can be used to reveal the real connections between the nodes in the node set in the original machine learning model.

[0089] Based on the solution provided in the above embodiment, optionally, Fig. 9 As shown, in the above step S74, the operator nodes in the node set are constructed into a machine learning model based on the control flow relationship according to the mapping relationship record, including: S91: Determine, from the node set, a plurality of operator nodes corresponding to the obfuscated identification pairs in the mapping relationship record.

[0090] In this step, based on the obfuscation identification pair in the above mapping relationship record, the operator nodes corresponding to the obfuscation identification in the obfuscation identification pair are determined from the node set, and these operator nodes are real operator nodes that can be used to reconstruct the machine learning model. Through this step, the real operator nodes can be selected from the node set and the obfuscation nodes can be eliminated.

[0091] S92: According to the control flow relationship represented by the obfuscation identifier pair in the mapping relationship record, a connection relationship between the multiple operator nodes is constructed to obtain the machine learning model.

[0092] In this step, according to the obfuscation identification pairs in the mapping relationship record, the paired connection relationships between the operator nodes are constructed, thereby constructing a machine learning model that conforms to the control flow relationship.

[0093] Among them, the obfuscation identifiers correspond to the operator nodes one by one, and the obfuscation identifier pairs can represent the directed connection relationship between the operator nodes. In this step, according to the directed connection relationship represented by the obfuscation identifier pairs, a control flow relationship pointing from the first operator node to the second operator node is established. Then, all the obfuscation identifier pairs in the mapping relationship record are traversed to construct the control flow relationship of the complete machine learning model to ensure the integrity of the reconstructed machine learning model.

[0094] Based on the solution provided in the above embodiment, optionally, Fig.10 As shown, after the above step S72, that is, after extracting the nodes in the obfuscated encryption model to construct the node set, it also includes: S101: Storing the node set in a memory of an electronic device.

[0095] Since the node set is stored in plain text, there is no need to perform decryption, and the node set is directly stored in the memory of the electronic device for reading and calling in subsequent steps.

[0096] After the above step S73, that is, after decrypting the ciphertext relationship record to obtain the mapping relationship record, the method further includes: S102: storing the mapping relationship record in the memory of the electronic device.

[0097] In this example, the encrypted relationship record can be decrypted through the memory resources, and the decrypted mapping relationship record is then stored in the memory of the electronic device for reading and calling in subsequent steps.

[0098] Among them, in the above step S74, constructing the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record includes: S103: Based on the mapping relationship record in the memory of the electronic device, the operator nodes in the node set are read from the memory of the electronic device, and the connection relationship between the operator nodes is constructed according to the control flow relationship to obtain the machine learning model.

[0099] In this step, the inference operation is performed based on the mapping relationship records in the memory and the node super data on the disk is read.

[0100] During the inference process, the connection information decrypted from the memory is combined with the node superset data on the storage to reconstruct the model node by node. Specifically, according to the mapping relationship record, the operator nodes with direct connection relationships are read one by one from the node set in the storage, and the connection relationship between the nodes is reconstructed to obtain the machine learning model, ensuring the security and efficiency of the model.

[0101] In the solution provided by the embodiment of the present application, memory resources can be optimized and saved. Specifically, in the solution provided by the embodiment of the present application, the relationship between nodes and the nodes are stored separately, wherein the relationship between nodes is stored in ciphertext, and obfuscated nodes are mixed into the operator nodes and stored in plaintext, which increases the difficulty of attackers to reconstruct the model from the two aspects of nodes and the relationship between nodes. During the decryption process, the node relationship can be decrypted only in the memory, without the need to perform decryption on the node set, which effectively reduces the demand for edge device memory resources and solves the problem of high memory usage caused by directly loading the decryption model.

[0102] The solution provided by the embodiment of the present application can also refine the control flow management. Specifically, the ciphertext relationship record is encoded and stored according to the calculation traversal order of the original machine learning model, which can accurately restore the original execution path of the model during decryption and reasoning, while avoiding the leakage of irrelevant node information and improving the level of information security.

[0103] The encryption in the solution provided in the embodiment of the present application is more targeted and can effectively improve security. Specifically, the solution provided in the embodiment of the present application encrypts the control flow relationship of the model, which not only retains the executability of the model, but also enhances the protection of core intellectual assets, and is particularly suitable for countering reverse engineering attacks and illegal reuse in commercial scenarios.

[0104] It can be seen that the solution provided by the embodiment of the present application can greatly improve the security protection level of the model without significantly increasing the memory burden of the edge device, thereby effectively improving the security of the machine learning model.

[0105] The solution provided by the embodiment of the present application can effectively prevent the business model from being illegally copied and abused, protect the core intellectual property rights of the enterprise from infringement, and help the enterprise maintain its competitive advantage and exclusive position in the fierce market competition. Through a unique node mapping and relationship encryption mechanism, the design of storing node relationships and node information separately can significantly reduce the edge device's demand for memory resources when loading and running encryption models, reduce hardware costs, thereby saving operating costs for enterprises and improving economic benefits. Moreover, this solution improves the security of deep learning models, effectively prevents malicious attackers from obtaining the internal structure and parameters of the model through reverse engineering, enhances the security and reliability of the product, helps to win customer trust, and enhances brand image and market share. This solution is widely applicable to various deep learning model frameworks, such as TensorFlow, PyTorch, etc., and can be widely used in cloud computing, big data, edge computing and other fields, which is conducive to promoting the standardization process of encryption model deployment and protection technology in the industry and promoting the healthy development of related industries.

[0106] The present application embodiment also provides a control flow-based machine learning model encryption device 110, such as Fig.11 As shown, including: A first acquisition module 111 acquires control flow information of a machine learning model to be encrypted, wherein the control flow information includes information of a plurality of operator nodes and information of control flow relationships between the plurality of operator nodes; A first generating module 112 constructs a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, and generates a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set; A first encryption module 113 encrypts the mapping relationship record to obtain a ciphertext relationship record; The first construction module 114 constructs an obfuscated encryption model based on the ciphertext relationship record and each node in the node set, wherein the obfuscated encryption model carries the ciphertext relationship record.

[0107] Through the device provided by the implementation of the present application, first, the control flow information of the machine learning model to be encrypted is obtained, and the control flow information includes information of multiple operator nodes and information of control flow relationships between multiple operator nodes. Then, a node set including multiple operator nodes and at least one obfuscated node is constructed based on the control flow information, and a mapping relationship record is generated, and the mapping relationship record includes the mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set. Among them, the obfuscated node plays an obfuscating role in the node set. Even if the node set is leaked, it is difficult to identify which are the real operator nodes contained in the machine learning model from the node set, thereby avoiding the model leakage caused by the reverse reconstruction of the model based on the real operator node. Then, the mapping relationship record is encrypted to obtain a ciphertext relationship record. The ciphertext relationship record can effectively store the real control flow relationship between the operator nodes, ensure that the machine learning model can be accurately reconstructed, and avoid the loss of the relationship between the nodes. Finally, a confused encryption model is constructed based on the ciphertext relationship record and each node in the node set, and the confused encryption model carries the ciphertext relationship record. The obfuscated encryption model constructed by the solution provided in the embodiment of the present application contains obfuscated nodes. Even if the obfuscated encryption model is leaked, it is difficult to restore the original machine learning model, thereby improving the security of the machine learning model and reducing the risk of the machine learning model being stolen.

[0108] The present application embodiment also provides a control flow-based machine learning model decryption device 120, such as Fig.12 As shown, including: The second acquisition module 121 acquires the obfuscated encryption model carrying the ciphertext relationship record; A second extraction module 122 extracts nodes in the obfuscated encryption model to construct a node set; A second decryption module 123 performs decryption on the ciphertext relationship record to obtain a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between an operator node in a control flow relationship of a machine learning model and an operator node in a node set; The second construction module 124 constructs the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record.

[0109] The device provided by the embodiment of the present application can optimize and save memory resources. Specifically, in the scheme provided by the embodiment of the present application, the node-to-node relationship and the node are stored separately, wherein the node-to-node relationship is stored in ciphertext, and the obfuscated node is mixed in the operator node and stored in plaintext, thereby increasing the difficulty of the attacker to reconstruct the model from the two aspects of the node and the node-to-node relationship. During the decryption process, the node relationship can be decrypted only in the memory, without the need to perform decryption on the node set, which effectively reduces the demand for edge device memory resources and solves the problem of high memory usage caused by directly loading the decryption model.

[0110] The solution provided by the embodiment of the present application can also refine the control flow management. Specifically, the ciphertext relationship record is encoded and stored according to the calculation traversal order of the original machine learning model, which can accurately restore the original execution path of the model during decryption and reasoning, while avoiding the leakage of irrelevant node information and improving the level of information security.

[0111] The encryption in the solution provided in the embodiment of the present application is more targeted and can effectively improve security. Specifically, the solution provided in the embodiment of the present application encrypts the control flow relationship of the model, which not only retains the executability of the model, but also enhances the protection of core intellectual assets, and is particularly suitable for countering reverse engineering attacks and illegal reuse in commercial scenarios.

[0112] It can be seen that the solution provided by the embodiment of the present application can greatly improve the security protection level of the model without significantly increasing the memory burden of the edge device, thereby effectively improving the security of the machine learning model.

[0113] Among them, the above modules in the device provided by the embodiment of the present application can also implement the method steps provided by the above method embodiment. Alternatively, the device provided by the embodiment of the present application can also include other modules in addition to the above modules to implement the method steps provided by the above method embodiment. And the device provided by the embodiment of the present application can achieve the technical effects that can be achieved by the above method embodiment.

[0114] Preferably, an embodiment of the present application also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the various processes of the above-mentioned control flow-based machine learning model encryption method or control flow-based machine learning model decryption method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.

[0115] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the various processes of the above-mentioned control flow-based machine learning model encryption method or control flow-based machine learning model decryption method embodiment, and can achieve the same technical effect. To avoid repetition, it is not repeated here. Among them, the computer-readable storage medium is such as a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0116] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program can be operated to enable a computer to execute part or all of the steps of the above-mentioned control flow-based machine learning model encryption method or control flow-based machine learning model decryption method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0117] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device for implementing the functions specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0119] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0120] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0121] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0122] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0123] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0124] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0125] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0126] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A control flow-based machine learning model encryption method, characterized in that: include: Acquire control flow information of the machine learning model to be encrypted, wherein the control flow information includes information of multiple operator nodes and information of control flow relationships between the multiple operator nodes; Constructing a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, and generating a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between the operator nodes in the control flow relationship and the operator nodes in the node set; Encrypting the mapping relationship record to obtain a ciphertext relationship record; An obfuscated encryption model is constructed based on the ciphertext relationship record and each node in the node set, and the obfuscated encryption model carries the ciphertext relationship record.

2. The method according to claim 1, characterized in that Constructing a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, including: Taking each operator node in the control flow information as an element, respectively, to construct an operator set; A superset of the operator set is constructed as the node set, wherein a difference set between the node set and the operator set includes an element corresponding to at least one confusion node.

3. The method according to claim 1, characterized in that Constructing a node set including the plurality of operator nodes and at least one obfuscation node based on the control flow information, and generating a mapping relationship record, including: Creating corresponding obfuscation identifiers for the multiple operator nodes and the at least one obfuscation node respectively; Constructing the obfuscation identifier and the corresponding node as elements of the node set to obtain the node set, wherein the obfuscation identifier in any element is unique in the node set; The obfuscation identifiers corresponding to the multiple operator nodes are associated and stored according to the control flow relationship to obtain the mapping relationship record.

4. The method according to claim 3, characterized in that The obfuscation identifiers corresponding to the multiple operator nodes are stored in association with each other according to the control flow relationship to obtain the mapping relationship record, including: Generate an obfuscation identifier corresponding to the first operator node and an obfuscation identifier corresponding to the second operator node as an obfuscation identifier pair, wherein the first operator node directly points to the second operator node in the control flow relationship; The obfuscated identification pairs generated based on the multiple operator nodes are stored as the mapping relationship records.

5. The method according to claim 4, characterized in that The mapping relationship record is encrypted to obtain a ciphertext relationship record, including: Encrypting each obfuscation identification pair in the mapping relationship record based on a preset encryption rule to obtain encrypted obfuscation identification pairs corresponding to each obfuscation identification pair; The encrypted obfuscation identification pairs corresponding to each obfuscation identification pair are stored as ciphertext relationship records.

6. The method according to any one of claims 3 to 5, characterized in that: Creating corresponding obfuscation identifiers for the multiple operator nodes and the at least one obfuscation node respectively includes: Randomly sorting the multiple operator nodes and the at least one obfuscation node, and creating ordered obfuscation identifiers corresponding to the nodes according to the random sorting result; Wherein, constructing an obfuscated encryption model based on the ciphertext relationship record and each node in the node set includes: Creating an obfuscation control flow relationship between nodes based on the ordered obfuscation identifiers in the node set; The nodes in the node set are connected according to the obfuscated control flow relationship to generate the obfuscated encryption model carrying the ciphertext relationship record.

7. A control flow-based machine learning model decryption method, characterized in that: include: Obtain the obfuscated encryption model that carries the ciphertext relationship record; Extracting nodes in the obfuscated encryption model to construct a node set; Decrypting the ciphertext relationship record to obtain a mapping relationship record, wherein the mapping relationship record includes a mapping relationship between an operator node in a control flow relationship of a machine learning model and an operator node in a node set; The operator nodes in the node set are constructed into a machine learning model based on the control flow relationship according to the mapping relationship record.

8. The method according to claim 7, characterized in that Decrypting the ciphertext relationship record to obtain a mapping relationship record includes: Parsing the ciphertext relationship record to obtain the encrypted obfuscated identification pair in the ciphertext relationship record; The encrypted obfuscation identification pairs in the ciphertext relationship record are respectively decrypted based on preset encryption rules to obtain a mapping relationship record containing the obfuscation identification pair, wherein the obfuscation identification pair represents a directed control flow relationship between a pair of operator nodes.

9. The method according to claim 8, characterized in that Constructing the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record, including: Determine, from the node set, a plurality of operator nodes corresponding to the obfuscated identification pairs in the mapping relationship record; According to the control flow relationship represented by the obfuscation identifier pair in the mapping relationship record, a connection relationship between the multiple operator nodes is constructed to obtain the machine learning model.

10. The method according to claim 7, characterized in that After extracting the nodes in the obfuscated encryption model to construct a node set, the method further includes: Storing the node set in a memory of an electronic device; Wherein, after decrypting the ciphertext relationship record to obtain the mapping relationship record, the method further includes: Storing the mapping relationship record in the memory of the electronic device; Wherein, constructing the operator nodes in the node set into a machine learning model based on the control flow relationship according to the mapping relationship record includes: Based on the mapping relationship record in the memory of the electronic device, the operator nodes in the node set are read from the memory of the electronic device, and the connection relationship between the operator nodes is constructed according to the control flow relationship to obtain the machine learning model.

Images