Data processing method and electronic equipment

Abstract

The invention discloses a data processing method and electronic equipment, and the method comprises the steps: obtaining a weight matrix of a target model, the weight matrix being composed of a plurality of weight parameters; the weight matrix is processed to obtain a parameter attribute value corresponding to each weight parameter, and the parameter attribute value represents the sensitivity degree of the weight parameter; according to the parameter attribute value corresponding to each weight parameter, deploying the weight parameter to a first storage space or a second storage space; the weight parameter in the first storage space is used for executing a corresponding first processing operation in the target model on a first component; the weight parameter in the second storage space is used for executing a corresponding second processing operation in the target model on a second component; the first component and the first storage space form a trusted execution environment.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data processing method and electronic equipment. Background Art

[0002] With the rapid development of artificial intelligence technology, artificial intelligence models have achieved remarkable results in natural language processing, machine translation, text generation and other fields. However, the training of artificial intelligence models requires a lot of computing resources and time, and their weight parameters also constitute valuable intellectual property rights.

[0003] Therefore, there is an urgent need for a technical solution that can protect the weight parameters of artificial intelligence models. Summary of the invention

[0004] In view of this, the present application provides a data processing method and an electronic device as follows:

[0005] A data processing method, comprising:

[0006] Obtaining a weight matrix of a target model, wherein the weight matrix is ​​composed of multiple weight parameters;

[0007] Processing the weight matrix to obtain a parameter attribute value corresponding to each weight parameter, wherein the parameter attribute value represents the sensitivity of the weight parameter;

[0008] Deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter;

[0009] Among them, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component; the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

[0010] The above method preferably deploys the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter, including:

[0011] Sort the weight parameters in descending order of the parameter attribute values;

[0012] Deploy the weight parameters that meet the first screening condition in the sorting to the first storage space;

[0013] The weight parameters of the rankings that do not satisfy the first screening condition are deployed to the second storage space.

[0014] The above method preferably deploys the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter, including:

[0015] Obtaining the parameter attribute value corresponding to the processing layer according to the parameter attribute value corresponding to the weight parameter belonging to the same processing layer in the target model;

[0016] According to the parameter attribute values ​​corresponding to the processing layers, a parameter set consisting of weight parameters corresponding to the processing layers is sorted;

[0017] Deploy the weight parameters in the parameter set whose sorting satisfies the second screening condition to the first storage space;

[0018] The weight parameters in the parameter set whose sorting does not satisfy the second screening condition are deployed to the second storage space.

[0019] In the above method, preferably, after deploying the weight parameter to the first storage space, the method further comprises:

[0020] Based on a chaotic mapping algorithm, encrypting the weight parameters in the first storage space;

[0021] Among them, the chaotic mapping algorithm corresponds to at least one chaotic mapping parameter, and the chaotic mapping parameter represents the encryption strength of the weight parameter. The chaotic mapping parameter is used to decrypt the corresponding weight parameter in the first storage space before the first component performs the first processing operation.

[0022] The above method preferably processes the weight matrix to obtain a parameter attribute value corresponding to each weight parameter, including:

[0023] The weight matrix is ​​subjected to singular value decomposition to obtain a singular value corresponding to each weight parameter, and the singular value is used as a parameter attribute value corresponding to the weight parameter.

[0024] The above method, preferably, further comprises:

[0025] Using the data transmission channel established between the first component and the second component, transmitting the processing result corresponding to the first processing operation performed by the first component to the second component in an encrypted manner;

[0026] The processing result is used by the second component to perform a corresponding second processing operation at least according to the received processing result.

[0027] In the above method, preferably, the first component and the second component are different execution components deployed in the same electronic device;

[0028] The encryption method is: using a session key and a random number to encrypt the processing result corresponding to the first processing operation.

[0029] In the above method, preferably, the first component and the second component are different execution components deployed in different electronic devices;

[0030] The encryption method is to add noise to the processing result corresponding to the first processing operation.

[0031] A data processing method, comprising:

[0032] receiving a processing request for a target model;

[0033] Determining at least one processing operation that the target model needs to perform to achieve the target function;

[0034] For the processing operation, determining that a weight parameter corresponding to the processing operation is in a first storage space or a second storage space; the weight parameters of the first storage space and the second storage space are respectively deployed according to their corresponding parameter attribute values, and the parameter attribute values ​​represent the sensitivity of the weight parameters;

[0035] Based on the determined first storage space or the second storage space, the corresponding processing operation is executed through the corresponding execution component.

[0036] An electronic device, comprising:

[0037] The first component corresponds to a first storage space;

[0038] The second component corresponds to a second storage space;

[0039] A processor is used to obtain a weight matrix of a target model, wherein the weight matrix includes multiple weight parameters; process the weight matrix to obtain parameter attribute values ​​corresponding to the weight parameters, wherein the parameter attribute values ​​represent the sensitivity of the weight parameters; and deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute values ​​corresponding to each weight parameter;

[0040] Among them, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component; the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

[0041] A computer-readable storage medium stores a computer program / instruction, which, when executed by a processor, implements the steps of any one of the data processing methods described above.

[0042] A computer program product comprises a computer program / instruction, wherein when the computer program / instruction is executed by a processor, the steps of any one of the above data processing methods are implemented.

[0043] It can be seen from the above technical scheme that in a data processing method and electronic device disclosed in the present application, after obtaining a weight matrix composed of multiple weight parameters in the target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in the present application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components, so that in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of a data processing method provided in an embodiment of the present application;

[0046] Figure 2 This is an example diagram of implementing weight parameter deployment through singular value decomposition of a weight matrix in an embodiment of the present application;

[0047] Figure 3 This is an example diagram of the transmission of processing results between the first component and the second component through the data transmission channel in the embodiment of the present application;

[0048] Figure 4 This is an example diagram of deploying weight parameters and running a model in a single device deployment scenario in an embodiment of the present application;

[0049] Figure 5 This is an example diagram of deploying weight parameters and running a model in a cloud-edge hybrid deployment scenario in an embodiment of the present application;

[0050] Figure 6 A flowchart of another data processing method provided in an embodiment of the present application;

[0051] Figure 7 A result schematic diagram of a data processing device provided by an embodiment of the present application;

[0052] Figure 8 A schematic diagram of the structure of another data processing device provided in an embodiment of the present application;

[0053] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0054] Fig.10 A schematic diagram of the structure of another electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] refer to Figure 1 As shown, it is a flow chart of a data processing method provided in an embodiment of the present application, which can be applied to electronic devices capable of data processing, such as computers or servers, etc. The technical solution in this embodiment is mainly used to improve the security of the weight parameters of the target model.

[0057] Specifically, the method in this embodiment may include the following steps:

[0058] Step 101: Obtain a weight matrix of a target model.

[0059] Among them, the weight matrix is ​​composed of multiple weight parameters. The weight parameters are numerical values ​​used to adjust and optimize the target model. The weight matrix here may include: the weight parameters of the target model in each processing layer. The processing layer here can be understood as: the architecture layer built by the target model to achieve the target function. Taking the artificial intelligence model based on convolutional neural network as an example, the processing layers may include: input layer, convolution layer, pooling layer, fully connected layer, output layer, etc.

[0060] In one implementation, in this embodiment, the weight parameters of each processing layer can be read from the model file of the target model to obtain all weight matrices of each processing layer.

[0061] Step 102: Process the weight matrix to obtain a parameter attribute value corresponding to each weight parameter.

[0062] Among them, the parameter attribute value represents the sensitivity of the weight parameter.

[0063] It should be noted that the sensitivity of the weight parameter can also be understood as: the importance of the weight parameter, the degree to which the weight parameter needs to be protected, or the privacy of the weight parameter (the privacy here refers to the owner of the target model).

[0064] In a specific implementation, in this embodiment, the weight matrix may be subjected to singular value decomposition to obtain a singular value corresponding to each weight parameter, and the singular value serves as a parameter attribute value of the weight parameter.

[0065] Among them, the larger the singular value, the higher the sensitivity of the weight parameter, which means that the weight parameter needs to be protected more.

[0066] Taking the target model as a Transformer-based model as an example, in the multi-layer structure of Transformer, each processing layer includes one or more weight parameters. θ represents the set of weight parameters of the target model, which is expressed as a weight matrix W composed of the weight parameters of all processing layers. i , i is the number of the weight parameter. In this embodiment, the weight matrix can be subjected to singular value decomposition to obtain the singular value corresponding to each weight parameter, and the singular value is used as the parameter attribute value to characterize the sensitivity of the weight parameter.

[0067] For example, in this embodiment, the weight matrix W i Singular value decomposition is performed so that the weight matrix is ​​decomposed into three sub-matrices, as shown in formula (1), namely: a singular value matrix, a matrix of left singular vectors and a matrix of right singular vectors. Each weight parameter is composed of a singular value, a left singular vector and a right singular vector respectively:

[0068]

[0069] Among them, σ j represents the singular value corresponding to the jth weight parameter, u j is the corresponding left singular vector, v j is the corresponding right singular vector, and n is the number of weight parameters.

[0070] Step 103: deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter.

[0071] Among them, the weight parameters in the first storage space are used to perform the corresponding first processing operation in the target model on the first component; the weight parameters in the second storage space are used to perform the corresponding second processing operation in the target model on the second component.

[0072] It should be noted that the first component and the first storage space constitute a trusted execution environment.

[0073] Specifically, in this embodiment, the weight parameters can be deployed to the first storage space or the second storage space according to the size of the parameter attribute value corresponding to the weight parameters. For example, weight parameters with higher parameter attribute values ​​are deployed to the relatively safe first storage space, and weight parameters with lower parameter attribute values ​​are deployed to the second storage space. In this way, during the use of the target model, the corresponding first processing operation is performed on the first component based on the weight parameters in the first storage space, and the corresponding second processing operation is performed on the second component based on the weight parameters in the second storage space. During this process, the first storage space will not leak the weight parameters therein based on its security, thereby protecting the security of these weight parameters to protect the intellectual property rights of the target model.

[0074] It can be seen from the above technical scheme that in a data processing method provided by an embodiment of the present application, after obtaining a weight matrix composed of multiple weight parameters in a target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in this application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components. Therefore, in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0075] In one implementation, in this embodiment, each weight parameter is used as a granularity, and each weight parameter is deployed to the first storage space or the second storage space according to its corresponding parameter attribute value. The storage spaces deployed by any two weight parameters may be the same or different.

[0076] Specifically, in this embodiment, the weight parameters can be sorted in descending order of parameter attribute values; then, the weight parameters whose sorting meets the first filtering condition are deployed to the first storage space, and the weight parameters whose sorting does not meet the first filtering condition are deployed to the second storage space.

[0077] Among them, the first screening condition can be: the parameter attribute values ​​of the weight parameters are sorted in the top K from large to small. K is a positive integer greater than or equal to 1, and the size of K is determined based on the protection attribute corresponding to the target model. For example, if the target model requires a higher degree of protection, then K can be set to a higher value. The size of K corresponds to the sensitive parameter density η, which is the proportion of weight parameters that meet the first screening condition to all weight parameters. For example, the sensitive parameter density η can be between 0.1 and 0.3. Low density can reduce the number of parameters to be protected, save resources, and strike a balance between performance and security.

[0078] For example, in this embodiment, after the weight model is subjected to singular value decomposition, θ is divided into θ according to the order of the singular values ​​from large to small. C and θ E , that is, θ={θ C ,θ E}. Among them, θ C Represents a set of sensitive weight parameters deployed in the first storage space, such as a trusted cloud. As shown in formula (2); θ E Represents a set of insensitive weight parameters deployed in the second storage space, such as the edge device side As shown in formula (3). The sensitive parameter density η is θ C The ratio of the number of weight parameters in to the total number of weight parameters in the entire weight matrix θ is as follows:

[0079]

[0080]

[0081] in, is the weight matrix part corresponding to the first K largest singular values ​​(and their corresponding singular vectors), which can be called sensitive model parameters. Further, in order to improve the security of weight parameters in the first storage space, these weight parameters can be encrypted before being deployed to the first storage space. For example, Arnold's Cat Map can be encrypted and sent to the first storage space such as the cloud. Figure 2 As shown in . It is the remaining insensitive weight matrix part that can be exposed to an untrusted second storage space such as an edge device.

[0082] In a specific implementation, in this embodiment, the size of K can be controlled to adjust the number of sensitive model parameters, i.e., weight parameters deployed in the first storage space. A smaller K means that only the most important part of the weight parameters is selected, thereby reducing the density of sensitive parameters and correspondingly reducing the number of weight parameters that need to be protected. It should be noted that the smaller the density of sensitive parameters, the lower the cost of protecting the target model, that is, the smaller the amount of the first storage space occupied. The values ​​of K and η can be flexibly set according to business needs in actual applications.

[0083] For example, in this embodiment, the singular value σ can be selected j The first K parameters that account for 90%-95% of the total energy are used as sensitive weight parameters. Here, K can be the first 10%-20% of the total number of singular values ​​to ensure that the main weight parameters are classified as sensitive model parameters. This choice can effectively balance security and model performance, and will not cause performance degradation due to excessive parameter encryption.

[0084] In another implementation, in this embodiment, the processing layer of the target model is used as the granularity, and the weight parameters belonging to the same processing layer are deployed to the same storage space according to the parameter attribute value. The storage space deployed for the weight parameters in the same processing layer is the same, and the storage spaces deployed for the weight parameters in different processing layers may be the same or different.

[0085] Specifically, in this embodiment, the parameter attribute value corresponding to the processing layer can be first obtained according to the parameter attribute value corresponding to the weight parameters belonging to the same processing layer in the target model. For example, the singular values ​​corresponding to the weight parameters of the same processing layer are added or averaged after adding, and the obtained value is used as the parameter attribute value corresponding to the processing layer; then, according to the parameter attribute value corresponding to the processing layer, the parameter set composed of the weight parameters corresponding to the processing layer is sorted, that is, the processing layers are sorted according to their corresponding parameter attribute values; finally, the weight parameters in the parameter set whose sorting meets the second filtering condition are deployed to the first storage space, and the weight parameters in the parameter set whose sorting does not meet the second filtering condition are deployed to the second storage space.

[0086] The second screening condition may be: the parameter attribute values ​​corresponding to the processing layers corresponding to the parameter set are ranked in the first M from large to small, where M is a positive integer greater than or equal to 1. M may be determined based on the sensitive parameter density η and the total number of processing layers, for example, M is the product of the total number of processing layers multiplied by the sensitive parameter density η.

[0087] It can be seen that in this embodiment, in order to avoid the weight parameters from being deployed too dispersedly and to avoid too frequent data transmission between storage spaces, the weight parameters belonging to the same processing layer are deployed to the same storage space. During deployment, the parameter attribute values ​​corresponding to the processing layer are determined based on the parameter attribute values ​​of the weight parameters of the processing layer of the same layer, and then the weight parameters in the processing layer whose parameter attribute values ​​are ranked in the top K are deployed to the first storage space, and the weight parameters of other processing layers are deployed to the second storage space. For example, if the singular values ​​corresponding to the convolution layer are ranked in the top K, then all the weight parameters in the convolution layer are deployed to the first storage space; if the singular values ​​corresponding to the pooling layer are not ranked in the top K, then all the weight parameters in the pooling layer are deployed to the second storage space.

[0088] In one implementation, in this embodiment, after the weight parameters are deployed to the first storage space, the weight parameters stored in the first storage space may be encrypted, thereby further improving the security of the weight parameters.

[0089] Specifically, in this embodiment, the weight parameters in the first storage space may be encrypted based on a chaotic mapping algorithm.

[0090] The chaotic mapping algorithm corresponds to at least one chaotic mapping parameter, which represents the encryption strength of the weight parameter. The chaotic mapping parameter is used to decrypt the corresponding weight parameter in the first storage space before the first component performs the first processing operation.

[0091] It should be noted that the chaotic mapping algorithm may be Arnold's Cat Map, which has good obfuscation properties. It achieves a high degree of data confusion by rearranging the elements in the matrix. Based on this, in this embodiment, Arnold's Cat Map is used to encrypt the sensitive model parameters stored in the first storage space, thereby increasing security.

[0092] For example, in this embodiment, when the chaotic mapping algorithm is used to encrypt the weight parameters in the first storage space, Encrypt Arnold's Cat Map and convert the weight matrix Treat it as two-dimensional data and perform the transformation. The size of is C×N, and the mapping rules of Arnold's Cat Map are shown in formula (5) and formula (6):

[0093]

[0094] Wherein, x and y are coordinates in the matrix such as rows and columns, S is less than or equal to the minimum of C and N, that is, S≤min(C, N), S is the size of the mapping area, and τ is the number of mapping iterations, which can be a value between 5 and 10 to achieve a sufficient obfuscation effect. The mapping of Arnold's Cat Map can be performed multiple times, and each mapping will further increase the degree of confusion of the matrix element positions and increase the encryption strength. The mapping matrix parameters, namely p and q, can take encryption parameter values, such as p is 1 and q is 2. Such a higher number of iterations can improve the encryption strength, but it should not be too high to avoid increased computational overhead. Based on this, in this embodiment, the mapping is performed Rearrange the matrix elements of to obtain the encrypted matrix Enc(θ E ), i.e., the encrypted weight parameter, which is stored in a first storage space such as a trusted execution environment TEE (Trusted execution environment), such as Figure 2 as shown in .

[0095] It should be noted that the above chaotic mapping parameters such as q, p, S and τ are injected into the first storage space such as TEE in the cloud device as encryption keys. Based on this, the encryption key in the TEE can be used to decrypt the weight parameters.

[0096] In another implementation, the first storage space may be a memory space in a PXP environment of a processor such as a graphics processing unit (GPU). In order to ensure memory security during operation execution, the weight parameters in the memory space may be encrypted using a memory encryption key in the PXP environment.

[0097] In a specific implementation, before the first component executes the first processing operation, in this embodiment, the weight parameter corresponding to the first processing operation in the first storage space is first decrypted according to the chaotic mapping parameter.

[0098] For example, as shown in 2, in a trusted execution environment (TEE), when executing the first processing operation of the target model, the encrypted sensitive parameters can be decrypted and then normal calculations can be performed. The decryption process is as follows:

[0099] After receiving a request to be calculated (i.e., a request to perform the first processing operation), TEE first calls the inverse mapping of Arnold's Cat Map. During the decryption process, the owner of the target model provides the chaotic mapping parameters used in encryption, such as q, p, S, and τ. Through the inverse transformation of formulas (7) and (8), the encrypted matrix Enc(θ E ) is restored to sensitive model parameters

[0100]

[0101] Wherein, n is a parameter corresponding to S. The weight parameter obtained after decryption is used to perform the corresponding first processing operation, such as the intermediate calculation in the model reasoning.

[0102] In one implementation, in this embodiment, the data transmission channel established between the first component and the second component can also be used to transmit the processing result corresponding to the first processing operation performed by the first component to the second component in an encrypted manner.

[0103] The processing result is used by the second component to perform a corresponding second processing operation at least according to the received processing result.

[0104] Furthermore, in this embodiment, the data transmission channel established between the first component and the second component can also be used to transmit the processing result corresponding to the second processing operation performed by the second component to the first component in an encrypted manner, and the first component at least performs the corresponding first processing operation based on the received processing result.

[0105] For example, Figure 3As shown in , the target model needs to perform at least processing operation 1, processing operation 2 and processing operation 3 to achieve the target function (such as image processing, text generation, etc.), and the processing operations are divided according to the storage space where the weight parameters used are deployed. For example, the weight parameters used in processing operation 1 are deployed in the first storage space, the weight parameters used in processing operation 2 are deployed in the second storage space, and the weight parameters used in processing operation 3 are deployed in the first storage space. The first storage space and the second storage space establish a data transmission channel, based on which the first component uses the weight parameter (weight parameter corresponding to processing operation 1) deployed in the first storage space to perform processing operation 1, obtains processing result 11, and sends processing result 11 to the second component through the data transmission channel in an encrypted manner. The second component uses the weight parameter (weight parameter corresponding to processing operation 2) deployed in the second storage space according to processing result 11 to perform processing operation 2, obtains processing result 22, and sends processing result 22 to the first component through the data transmission channel in an encrypted manner. The first component uses the weight parameter (weight parameter corresponding to processing operation 3) deployed in the first storage space according to processing result 22 to perform processing operation 3, obtains processing result 33, and so on, until the target model performs the last processing operation to obtain the output result of the target model, such as an image or text. It can be seen that in this embodiment, based on the first storage space or the second storage space where the weight parameter is located, the corresponding processing operation is performed by the corresponding execution component such as the first component or the second component, and the processing result is provided to the execution component corresponding to the next processing operation through a secure data transmission channel, thereby improving the security of the target model during operation.

[0106] Based on the above implementation, the encryption method on the data transmission channel can be determined based on the deployment method of the first component and the second component.

[0107] In one scenario, the first component and the second component are different execution components deployed in the same electronic device. The corresponding encryption method may be: using a session key and a random number to encrypt the processing result corresponding to the first processing operation.

[0108] In another scenario, the first component and the second component are different execution components deployed in different electronic devices. The corresponding encryption method is: adding noise to the processing result corresponding to the first processing operation.

[0109] In a specific implementation, in order to ensure the secure interaction between trusted computing resources (i.e., the first component and the first storage space) and untrusted computing resources (i.e., the second component and the second storage space), different methods can be used to achieve this. Taking the scenario where the first component is a GPU and the second component is a central processing unit (CPU) as an example, secure communication between the GPU and the CPU is achieved through memory encryption. Taking the scenario where the first component is the cloud and the second component is an edge device as an example, secure communication between the cloud and the edge device is achieved by adding noise to the transmitted data.

[0110] like Figure 4 As shown in , it is an architecture diagram of a single deployment of the first component and the second component. The first component may be a GPU in electronic device A, and the second component may be a CPU in electronic device A. The GPU is deployed with a TEE, and the CPU is deployed with a memory. The data transmission channel established between the GPU and the CPU uses a session key and a random number to perform memory encryption on the transmitted processing results.

[0111] For example, after the user starts the target model and enters the data prompt into the target model, the target model performs the corresponding processing operations through the GPU and CPU, and returns the final inference result to the user. When the processing result (i.e., sensitive data) of a processing operation performed by the GPU on the target model needs to be transferred from the GPU to the CPU, the Advanced Encryption Standard Galois / Counter Mode (AES-GCM) can be used to encrypt the sensitive data during transmission. The process is as follows:

[0112] First, generate a session key: Generate a session key KKK (the length can be 128 bits or 256 bits) inside the GPU. The session key is used to encrypt data.

[0113] Then, a random number, i.e., Nonce, is generated: In this embodiment, a unique random number, i.e., 96 bits, is generated for each encryption (i.e., each data transmission). The random number is used as the initialization vector (IV) of AES-GCM. AES-GCM requires that the random number for each encryption is different to avoid replay attacks.

[0114] Afterwards, the processing result XXX that needs to be transmitted to the CPU is encrypted with AES-GCM on the GPU, and the encryption result (including the ciphertext Ciphertex, the random number Nonc, and the encryption identifier Tag) is transmitted to the corresponding memory area of ​​the GPU through the bus to ensure that all transmitted content is encrypted in the network and memory.

[0115] Finally, on the CPU, the ciphertext Ciphertex is decrypted using the session key KKK and the Nonce and Tag transmitted from the GPU.

[0116] It should be noted that when the CPU sends sensitive data to the GPU, AES-GCM can also be used for encryption to improve security.

[0117] For example, Figure 5 As shown in , the first component can be a cloud device, and the second component can be an edge device. TEE is deployed in the cloud device, and a memory area is deployed in the edge device. The data transmission channel established between the cloud device and the edge device realizes encrypted communication by adding noise. After the user starts the target model and inputs the data prompt to the target model, the target model performs the corresponding processing operations through the remote device and the edge device, and returns the final inference result to the user.

[0118] Specifically, in this embodiment, random noise masking technology can be used to blind the sensitive data transmitted between the cloud device and the edge device. For example, a one-time password (OTP) or a random Gaussian distribution noise scheme is used to blind the sensitive data. Taking the transformer-based target model as an example, the encryption process based on the random blinding factor is as follows:

[0119] First, in this embodiment, for the i-th layer of the transformer, a random blinding factor r can be selected on the model server. i-1 ; and in advance according to the random blinding factor r i-1 , calculate the factors that can be eliminated

[0120] Based on this, in this embodiment, when performing model reasoning calculations (i.e., performing the first processing operation) on the trusted execution environment, the pre-generated noise mask can be used to encrypt sensitive data. The specific process is as follows:

[0121] 1) Securely obtain the blinding factor r from the model server in a trusted execution environment i-1 ;

[0122] 2) Through the weight parameters in the trusted execution environment Calculate the processing results of the middle layer corresponding to the trusted execution environment x i-2 The input data received by the middle layer;

[0123] 3) For x i-1 (i.e., the processing result of step 2) ), use the blinding factor to calculate the blinded result Blind the results Transmitted to edge devices through data transmission channels.

[0124] Based on this, when performing model inference on edge devices, the same noise masking method is used to add noise to the processing results of the output of the intermediate layer of the model calculation. For example, the edge device uses non-sensitive weight parameters Calculate the processing results of the middle layer output of the edge device And send the processing results to the trusted execution environment through the data transmission channel.

[0125] Accordingly, denoising is performed in the trusted execution environment, as shown in formula (9):

[0126]

[0127] refer to Figure 6 , is a flow chart of a data processing method provided in an embodiment of the present application, which can be applied to electronic devices capable of data processing, such as computers or servers, etc. The technical solution in this embodiment is mainly used to improve the security of the target model operation.

[0128] Specifically, the method in this embodiment may include the following steps:

[0129] Step 601: Receive a processing request for a target model.

[0130] The processing request is a request to instruct the target model to run, so that the target model can output the corresponding reasoning results, such as images or text. For example, the user starts the application to trigger the large model to run, and enters a prompt in the input interface of the large model so that the large model outputs the reasoning results according to the prompt.

[0131] Step 602: Determine at least one processing operation that the target model needs to perform to achieve the target function.

[0132] Step 603: For a processing operation, determine whether a weight parameter corresponding to the processing operation is in the first storage space or the second storage space.

[0133] The weight parameters of the first storage space and the second storage space are respectively deployed according to their corresponding parameter attribute values, and the parameter attribute values ​​represent the sensitivity of the weight parameters. Figure 1 The embodiment shown.

[0134] Step 604: Based on the determined first storage space or second storage space, a corresponding processing operation is performed through a corresponding execution component.

[0135] The first storage space and the corresponding first component constitute a trusted execution environment.

[0136] It can be seen from the above technical scheme that in a data processing method provided by an embodiment of the present application, after obtaining in advance a weight matrix composed of multiple weight parameters in the target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in this application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components. Therefore, in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0137] refer to Figure 7 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application, and the device can be configured in an electronic device capable of data processing, such as a computer or a server. The technical solution in this embodiment is mainly used to improve the security of the weight parameters of the target model.

[0138] Specifically, the device in this embodiment may include the following units:

[0139] A weight obtaining unit 701 is used to obtain a weight matrix of a target model, wherein the weight matrix is ​​composed of multiple weight parameters;

[0140] The attribute obtaining unit 702 is used to process the weight matrix to obtain a parameter attribute value corresponding to each weight parameter, wherein the parameter attribute value represents the sensitivity of the weight parameter;

[0141] A parameter deployment unit 703, configured to deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter;

[0142] Among them, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component; the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

[0143] It can be seen from the above technical solution that in a data processing device provided by an embodiment of the present application, after obtaining in advance a weight matrix composed of multiple weight parameters in a target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in the present application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components, so that in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0144] refer to Figure 8 , is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application, and the device can be configured in an electronic device capable of data processing, such as a computer or a server. The technical solution in this embodiment is mainly used to improve the security of the weight parameters of the target model.

[0145] Specifically, the device in this embodiment may include the following units:

[0146] A request receiving unit 801 is used to receive a processing request for a target model;

[0147] An operation determination unit 802, configured to determine at least one processing operation that needs to be performed by the target model to realize a target function;

[0148] The space determination unit 803 is used to determine, for the processing operation, whether the weight parameter corresponding to the processing operation is in the first storage space or the second storage space; the weight parameters of the first storage space and the second storage space are respectively deployed according to their corresponding parameter attribute values, and the parameter attribute value represents the sensitivity of the weight parameter;

[0149] An operation execution unit 804, configured to execute the corresponding processing operation through a corresponding execution component based on the determined first storage space or the second storage space;

[0150] It can be seen from the above technical solution that in a data processing device provided by an embodiment of the present application, after obtaining in advance a weight matrix composed of multiple weight parameters in a target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in the present application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components, so that in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0151] refer to Fig. 9 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, and the electronic device may include the following structure:

[0152] The first component 901, such as a GPU, corresponds to a first storage space 911;

[0153] The second component 902, such as a CPU, corresponds to a second storage space 921;

[0154] Processor 903 is used to obtain a weight matrix of a target model, wherein the weight matrix includes multiple weight parameters; process the weight matrix to obtain parameter attribute values ​​corresponding to the weight parameters, wherein the parameter attribute values ​​represent the sensitivity of the weight parameters; and deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute values ​​corresponding to each weight parameter;

[0155] Among them, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component; the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

[0156] It can be seen from the above technical solution that in an electronic device provided by an embodiment of the present application, after obtaining in advance a weight matrix composed of multiple weight parameters in a target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in this application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components, so that in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0157] refer to Fig.10 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, and the electronic device may include the following structure:

[0158] Memory 1001, used to store computer programs and data generated by the execution of computer programs;

[0159] Processor 1002 is used to execute a computer program to achieve: receiving a processing request for a target model; determining at least one processing operation that needs to be performed by the target model to implement a target function; for the processing operation, determining whether a weight parameter corresponding to the processing operation is in the first storage space 1031 or the second storage space 1041; the weight parameters of each of the first storage space 1031 and the second storage space 1041 are deployed according to their corresponding parameter attribute values, and the parameter attribute values ​​characterize the sensitivity of the weight parameters; based on the determined first storage space 1031 or the second storage space 1041, the corresponding processing operation is executed through the corresponding execution component such as the first component 1003 or the second component 1004.

[0160] The first component 1003 may be deployed on a cloud device, corresponding to a first storage space 1031; the second component 1004 may be deployed on an edge device, corresponding to a second storage space 1041;

[0161] It can be seen from the above technical solution that in an electronic device provided by an embodiment of the present application, after obtaining in advance a weight matrix composed of multiple weight parameters in a target model, the weight matrix is ​​processed, so that the parameter attribute value of each weight parameter representing its sensitivity can be obtained, and then according to the parameter attribute value, that is, the sensitivity, these weight parameters are deployed to the first storage space or the second storage space that constitutes a trusted execution environment with the first component. Based on this, the weight parameters in the first storage space are used to execute the corresponding first processing operation in the target model on the first component, and the weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component. It can be seen that in this application, the weight parameters are deployed according to the sensitivity of the weight parameters, so that at least part of the weight parameters are deployed in the trusted execution environment, and then the corresponding processing operations in the target model are executed by the corresponding components, so that in the process of the target model providing artificial intelligence services to users, the weight parameters of the target model will not be completely leaked, thereby ensuring the security of the weight parameters and realizing the protection of the weight parameters.

[0162] Taking the target model as a large model as an example, this embodiment can provide a protection method for a large model of hybrid reasoning based on singular value decomposition SVD (Singular Value Decomposition) and chaotic mapping, which has the following core technical points:

[0163] 1. Use singular value decomposition technology to decompose the weight matrix of the large model, and decompose the sensitive model parameters (i.e. sensitive weight parameters) and insensitive model parameters (i.e. insensitive weight parameters) according to the singular value decomposition.

[0164] 2. Use Arnold's Cat Map chaos mapping to encrypt sensitive parameters and send them to trusted computing resources (such as cloud devices). They are securely encrypted and decrypted within the trusted execution environment. Even if an attacker obtains the encrypted data, they cannot easily obtain the original and complete weight parameters.

[0165] 3. During the interaction between trusted computing resources and untrusted computing resources (edge ​​devices), random noise masking technology is used to encrypt sensitive information to prevent attackers from inferring sensitive information by observing model outputs.

[0166] 4. Offloading most computing tasks to edge devices can reduce the latency of model reasoning and improve user experience. At the same time, this solution is a low-cost solution that does not involve model retraining and fine-tuning. The lightweight nature of Arnold's Cat Map makes it suitable for resource-constrained scenarios such as trusted execution environments and edge devices, ensuring the actual availability of the system.

[0167] refer to Figure 4 and Figure 5The architecture diagram shown in the figure, in which trusted computing resources are used to store and calculate sensitive parts of the model, such as the trusted execution environment TEE in a cloud device or GPU; untrusted computing resources are used to perform most of the computing work of the model, such as edge devices or low-security servers or CPUs.

[0168] The trusted computing resources and untrusted computing resources establish a data transmission channel through a secure communication protocol to facilitate the exchange of intermediate computing results. To prevent information leakage, the model parameters on the trusted computing resource side are encrypted using an obfuscation mapping algorithm, and the interaction between the two parties uses random noise masking technology to blind sensitive information or perform memory encryption.

[0169] The model owner (such as the electronic device implementing this embodiment) is responsible for the weight matrix decomposition of the model, encrypts sensitive model parameters, and injects encryption keys (such as chaos mapping parameters, session keys, etc.) into the corresponding locations. Users can initiate requests through the application corresponding to the large model and obtain the inference results of the model.

[0170] like Figure 4 and Figure 5 As shown, the usage scenarios of this embodiment are divided into a single device deployment scenario and a cloud edge deployment scenario.

[0171] Among them, in the scenario of single device deployment, sensitive model parameters are encrypted and placed in the protected Xe path PXP (Protected Xe Path) environment of the electronic device's TEE or GPU; non-sensitive model parameters are placed in the memory environment of the CPU or GPU.

[0172] In the cloud-edge hybrid deployment scenario, when a large model is running, most of the model calculations involving non-sensitive model parameters are performed on edge devices, while sensitive model parameters are stored in cloud devices, and the corresponding model calculations are performed on cloud devices, thereby reducing cloud computing costs and ensuring the security of model parameters.

[0173] Among them, low-security servers are suitable for devices that need to deploy models on devices that are not fully trusted, such as smart home devices, mobile devices, etc.

[0174] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0175] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0176] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0177] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data processing method, comprising: Obtaining a weight matrix of a target model, wherein the weight matrix is ​​composed of multiple weight parameters; Processing the weight matrix to obtain a parameter attribute value corresponding to each weight parameter, wherein the parameter attribute value represents the sensitivity of the weight parameter; Deploy the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter; Wherein, the weight parameter in the first storage space is used to perform a corresponding first processing operation in the target model on the first component; The weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

2. The method according to claim 1, deploying the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter, comprising: Sort the weight parameters in descending order of the parameter attribute values; Deploy the weight parameters that meet the first screening condition in the sorting to the first storage space; The weight parameters of the sorted items that do not satisfy the first screening condition are deployed to the second storage space.

3. The method according to claim 1, deploying the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter, comprising: Obtaining the parameter attribute value corresponding to the processing layer according to the parameter attribute value corresponding to the weight parameter belonging to the same processing layer in the target model; According to the parameter attribute values ​​corresponding to the processing layers, a parameter set consisting of weight parameters corresponding to the processing layers is sorted; Deploy the weight parameters in the parameter set whose sorting satisfies the second screening condition to the first storage space; The weight parameters in the parameter set whose sorting does not satisfy the second screening condition are deployed to the second storage space.

4. The method according to claim 1, after deploying the weight parameter to the first storage space, the method further comprises: Based on a chaotic mapping algorithm, encrypting the weight parameters in the first storage space; Among them, the chaotic mapping algorithm corresponds to at least one chaotic mapping parameter, and the chaotic mapping parameter represents the encryption strength of the weight parameter. The chaotic mapping parameter is used to decrypt the corresponding weight parameter in the first storage space before the first component performs the first processing operation.

5. The method according to claim 1, processing the weight matrix to obtain a parameter attribute value corresponding to each weight parameter, comprising: The weight matrix is ​​subjected to singular value decomposition to obtain a singular value corresponding to each weight parameter, and the singular value is used as a parameter attribute value corresponding to the weight parameter.

6. The method according to claim 1, further comprising: Using the data transmission channel established between the first component and the second component, transmitting the processing result corresponding to the first processing operation performed by the first component to the second component in an encrypted manner; The processing result is used by the second component to perform a corresponding second processing operation at least according to the received processing result.

7. The method according to claim 6, wherein the first component and the second component are different execution components deployed in the same electronic device; in, The encryption method is: using a session key and a random number to encrypt the processing result corresponding to the first processing operation.

8. The method according to claim 6, wherein the first component and the second component are different execution components deployed in different electronic devices; in, The encryption method is: adding noise to the processing result corresponding to the first processing operation.

9. A data processing method, comprising: receiving a processing request for a target model; Determining at least one processing operation that the target model needs to perform to achieve the target function; For the processing operation, determining whether a weight parameter corresponding to the processing operation is in the first storage space or the second storage space; The weight parameters of the first storage space and the second storage space are respectively deployed according to their corresponding parameter attribute values, and the parameter attribute values ​​represent the sensitivity of the weight parameters; Based on the determined first storage space or the second storage space, the corresponding processing operation is executed through the corresponding execution component.

10. An electronic device, comprising: The first component corresponds to a first storage space; The second component corresponds to a second storage space; A processor, configured to obtain a weight matrix of a target model, wherein the weight matrix includes a plurality of weight parameters; Processing the weight matrix to obtain a parameter attribute value corresponding to the weight parameter, wherein the parameter attribute value represents a sensitivity of the weight parameter; Deploying the weight parameters to the first storage space or the second storage space according to the parameter attribute value corresponding to each weight parameter; Wherein, the weight parameter in the first storage space is used to perform a corresponding first processing operation in the target model on the first component; The weight parameters in the second storage space are used to execute the corresponding second processing operation in the target model on the second component; the first component and the first storage space constitute a trusted execution environment.

Images