Model scrambling method and device, electronic equipment and storage medium

Abstract

The invention provides a model scrambling method and apparatus, an electronic device and a storage medium. The method comprises the steps of determining a model type of a to-be-scrambled model and target security strength of the to-be-scrambled model; determining disturbance information corresponding to the to-be-scrambled model according to the model type and the target safety intensity; obtaining a target key corresponding to the to-be-scrambled model, and generating a disturbance coefficient according to the target key; and scrambling the model parameters of the to-be-scrambled model according to the disturbance information and the disturbance coefficient to obtain a scrambled model. According to the method and the device, the disturbance coefficient generated by the target key is used for scrambling the weight parameter and / or the bias parameter of the to-be-scrambled model, so that the real model parameter of the to-be-scrambled model cannot be obtained even if a model stealer steals the model parameter of the scrambled model; therefore, the safety of the to-be-scrambled model is improved under the condition that the performance of the to-be-scrambled model is ensured.

Description

Technical Field

[0001] The present application relates to the field of neural network technology, and more specifically, to a model scrambling method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of science and technology, neural networks are used more and more frequently in daily life, such as text generation, question-answering systems, text translation, etc. Most models, especially large models, combined with some specific businesses such as security incident handling, network attack protection, enterprise data situation analysis, etc., have significantly improved the utility of enterprise business. However, the existing large models have model leakage problems when deployed privately. Model thieves can obtain the original model by stealing model file data, printing model parameter data, etc. Commonly used protection methods such as homomorphic encryption and federated learning often cause relatively large performance losses, affecting the model usage experience. Therefore, how to improve the security of the model while ensuring the performance of the model has become an urgent problem to be solved. Summary of the invention

[0003] In view of the above problems, the embodiments of the present application propose a model scrambling method, device, electronic device and storage medium to improve the above problems.

[0004] According to one aspect of an embodiment of the present application, a model scrambling method is provided, including: determining a model type of a model to be scrambled and a target security strength of the model to be scrambled; determining disturbance information corresponding to the model to be scrambled according to the model type and the target security strength; obtaining a target key corresponding to the model to be scrambled, and generating a disturbance coefficient according to the target key; scrambling model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain an scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0005] In some embodiments, the disturbance information includes the scrambled layer corresponding to the model to be scrambled and the target scrambling mode corresponding to the model to be scrambled, and scrambling the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain the scrambled model, including: determining the model parameters corresponding to the layer to be scrambled; based on the target scrambling mode, scrambling the model to be scrambled according to the disturbance coefficient and the model parameters to obtain the scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0006] In some embodiments, the perturbation coefficient includes a weight perturbation coefficient and a bias perturbation coefficient, and the scrambling the model to be scrambled according to the perturbation coefficient and the model parameter based on the target scrambling mode to obtain the scrambled model includes: if the target scrambling mode is multiplication perturbation, the target weight is determined according to the weight parameter and the weight perturbation coefficient, and the weight of the model to be scrambled is updated to the target weight to obtain the scrambled model; or if the target scrambling mode is additive perturbation, the target bias is determined according to the bias parameter and the bias perturbation coefficient, and the bias of the model to be scrambled is updated to the target bias to obtain the scrambled model; or if the target scrambling mode is mixed perturbation, the target weight is determined according to the weight parameter and the weight perturbation coefficient, the target bias is determined according to the bias parameter and the bias perturbation coefficient, and the weight of the model to be scrambled is updated to the target weight and the bias of the model to be scrambled is updated to the target bias to obtain the scrambled model.

[0007] In some embodiments, obtaining the target key corresponding to the model to be scrambled includes: determining the hardware device information of the hardware device where the model to be scrambled is located, and generating the target key according to the device serial number of the hardware device indicated by the hardware device information; and / or determining the account information corresponding to the model to be scrambled, and generating the target key according to the account information; and / or obtaining the target task of the model to be scrambled, and generating the target key according to the target task.

[0008] In some embodiments, determining the disturbance information corresponding to the model to be scrambled according to the model type and the target security strength includes: determining a target scrambling method corresponding to the model type according to a target mapping relationship, wherein the target mapping relationship indicates a correspondence between different model types and scrambling methods; determining a to-be-scrambled layer and the number of layers of the to-be-scrambled layer corresponding to the model to be scrambled according to the target security strength and the model type; determining the disturbance information according to the target scrambling method, the to-be-scrambled layer, and the number of layers of the to-be-scrambled layer.

[0009] In some embodiments, after scrambling the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain the scrambled model, the method further includes: acquiring an output value of the scrambled model; performing descrambling calculation on the output value according to the disturbance coefficient and the disturbance information to obtain a target output value, wherein the target output value is the output value obtained by the model to be scrambled based on the input value.

[0010] In some embodiments, the descrambling calculation of the output value according to the input value, the disturbance coefficient and the disturbance information includes: obtaining a reference key and performing key verification according to the reference key; if the key verification of the reference key passes, determining the target disturbance mode of the scrambled model according to the disturbance information and obtaining the descrambling coefficient according to the reference key; and performing descrambling calculation on the output value according to the output value and the descrambling coefficient based on the target disturbance mode.

[0011] According to one aspect of an embodiment of the present application, there is provided a model scrambling device, comprising: a target security strength determination module, used to determine the model type of the model to be scrambled and the target security strength of the model to be scrambled; a disturbance information determination module, used to determine the disturbance information corresponding to the model to be scrambled according to the model type and the target security strength; a disturbance coefficient determination module, used to obtain the target key corresponding to the model to be scrambled, and generate a disturbance coefficient according to the target key; an scrambling module, used to scramble the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain an scrambled model, wherein the model parameters include weight parameters and / or bias parameters. According to one aspect of an embodiment of the present application, there is provided an electronic device, comprising: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the scrambling method of the model as described above is implemented.

[0012] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the scrambling method of the model as described above is implemented.

[0013] In the scheme of the present application, in the embodiment of the present application, based on the model type of the model to be scrambled and the target security strength of the model to be scrambled, the disturbance information of the model to be scrambled is determined based on the model type and the target security strength, and then the target key of the model to be scrambled is obtained, and the target key is used as the root of trust to generate a specific disturbance coefficient for the model parameters of the model to be scrambled, so that the model parameters of the model to be scrambled are scrambled based on the disturbance information by the disturbance coefficient, thereby generating a scrambled disturbance model. The present application scrambles the weight parameters and / or bias parameters of the model to be scrambled by using the disturbance coefficient generated by the target key, so that even if the model thief steals the model parameters of the scrambled model, the real model parameters of the model to be scrambled cannot be obtained, thereby improving the security of the model to be scrambled while ensuring the performance of the model to be scrambled.

[0014] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0016] Figure 1 is a schematic diagram of a device for implementing a scrambling method of a model according to an embodiment of the present application;

[0017] Figure 2 is a flow chart of a model scrambling method according to an embodiment of the present application;

[0018] Figure 3 is a flow chart of a scrambling method of a model according to another embodiment of the present application;

[0019] Figure 4 is a flowchart of specific steps of step S250 according to an embodiment of the present application;

[0020] Figure 5 is a schematic diagram of scrambling in a hybrid perturbation manner according to an embodiment of the present application;

[0021] Figure 6 is a flow chart of a scrambling method of a model according to another embodiment of the present application;

[0022] Figure 7 is a flow chart of a scrambling method of a model according to another embodiment of the present application;

[0023] Figure 8 is a flow chart of a scrambling method of a model according to yet another embodiment of the present application;

[0024] Fig. 9 is a schematic diagram of the reasoning process of executing the perturbation layer according to an embodiment of the present application;

[0025] Fig.10 is a schematic diagram of a process of performing descrambling calculation according to an embodiment of the present application;

[0026] Fig.11 is a flowchart of specific steps of step S560 according to an embodiment of the present application;

[0027] Fig.12 is a schematic diagram of descrambling calculation according to an embodiment of the present application;

[0028] Fig.13is a block diagram of a scrambling device according to a model shown in an embodiment of the present application;

[0029] Fig.14 A block diagram of an electronic device according to an embodiment of the present application for executing a scrambling method of a model according to an embodiment of the present application is shown;

[0030] Fig.15 A storage unit for storing or carrying a program code for implementing a scrambling method for a model according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0032] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0034] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0035] At present, there are data privacy protection issues between model users and model providers. On the one hand, model users may need to provide users' sensitive data to the model for reasoning. If the model is deployed in an external environment such as a public cloud, model users may worry about sensitive data leakage. The data privacy of model users can be protected by deploying the model privately on the local side of the model user. In this way, the data will not be sent out of the local domain of the model user, so there is no need to worry about sensitive data leakage. On the other hand, the model itself contains the developer's research and development results and proprietary technology. When the model is deployed locally, the model developer will worry about the leakage of model parameters because the model is not under the control of the model developer. Some model thieves may extract model parameters from the model files deployed locally by the model user, or further print the model parameters running in the processor to local storage during the model reasoning process to obtain the model. If the model does not have any protection measures, the model may be easily obtained by the model thieves and used and sold.

[0036] In response to the above problems, the inventors have discovered after long-term research and proposed the scrambling method, device, electronic device and storage medium of the model provided in the embodiments of the present application. The perturbation coefficient generated by the target key is used to scramble the weight parameters and / or bias parameters of the model to be scrambled. In this way, even if the model thief steals the model parameters of the scrambled model, the real model parameters of the model to be scrambled cannot be obtained, thereby improving the security of the model to be scrambled while ensuring the performance of the model to be scrambled.

[0037] In order to better understand the solutions of the embodiments of the present application, the technical terms used in the embodiments of the present application are explained below.

[0038] AI model: AI model refers to a computing model that can process and analyze input data and output prediction results or decisions. It can be built based on different methods such as statistics, machine learning, deep learning, etc., and is used to solve various problems such as classification, regression, clustering, generation, etc. AI models usually need to be trained to learn the characteristics and patterns of data in order to improve the accuracy and reliability of their predictions or decisions. In practical applications, AI models can be used in natural language processing, computer vision, speech recognition, recommendation systems, intelligent control and other fields.

[0039] Large Model: A large model refers to a complex model that is trained with a large amount of data and parameters in the field of machine learning and artificial intelligence. Large models are often used to solve complex tasks, such as natural language processing, computer vision, and speech recognition. Because large models process more data and more complex patterns, they have higher precision and accuracy. Large models usually have better generalization capabilities and can better adapt to new data and application scenarios. They also have good interpretability, allowing users to better understand the results of the model. Large models can be applied to various tasks, such as machine translation, text generation, sentiment analysis, image classification, object detection, image segmentation, speech recognition, speech synthesis, etc.

[0040] Layer: AI models are usually composed of multiple layers, each with different functions and characteristics. Common layers include: Linear Layer: The most basic neural network layer, used to multiply the input data with the weight matrix and add a bias to obtain the output result. Activation Layer: Used to introduce nonlinear factors to increase the expressiveness of the model. Common activation functions include Sigmoid, ReLU, Tanh, etc. Convolutional Layer: Used to process two-dimensional data such as images and videos, and extract features through convolution operations.

[0041] Model Parameters: Model parameters refer to the adjustable parameters such as weight and bias of the model learned during the training process. During the inference process, the model uses these parameters for calculations and predictions. Each layer has a set of learnable weight parameters (Weight) used to convert input data into output results, also known as convolution kernels (Filters), kernels (Kernels) or connection weights (Connection Weights). During the training process, the weights are constantly adjusted to make the model's predictions more accurate. Bias is another important parameter in neural networks that is used to adjust the output results of the model. Bias is usually added to the linear combination of weights to introduce an offset. During the training process, the bias is also constantly adjusted to make the model's predictions more accurate.

[0042] Model inference: refers to the process of using a trained model to predict or infer new input data after training is completed. Among them, forward propagation is the process of passing input data through each layer of the model, from the input layer to the output layer. In forward propagation, the input data undergoes a series of linear and nonlinear transformations to finally obtain the model's prediction results. Inference refers to the process of using a model to predict or estimate new input data. In the inference stage, the model calculates the prediction results or probability distribution based on the characteristics of the input data and the model parameters through the forward propagation algorithm of each layer of the model. Inference can be used for tasks such as classification, regression, and generation.

[0043] The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0044] See also Figure 1 , Figure 1 A schematic diagram of a device for implementing a scrambling method for a model provided in an embodiment of the present application is shown. Figure 1 As shown, the device 100 includes a parameter perturbation component 110, a key management component 120 and a perturbation model reasoning component 130, wherein the model perturbation component can be a component used by the enterprise of the model to be scrambled to perform parameter scrambling on the large model to be scrambled; the key management component can be a component for managing keys, and its core key will be protected in the hardware using a hardware security module and cannot be stolen by the outside world, or a key management component built by software authentication. At the same time, the key management component can perform some function calculations to generate the values ​​required in the scrambling and descrambling process; the perturbation model reasoning component can be a component used for descrambling and normal reasoning in the reasoning process of the model to be scrambled.

[0045] See also Figure 2 , Figure 2 The flowchart of the scrambling method of the model provided in one embodiment of the present application is shown. The scrambling method of the model records each software in a separate target disk with its own independent files and registry index data, so as to avoid the situation that the data of a certain software is processed and the normal use of other software is affected due to the files and registry index data of multiple software being stored in one disk. In a specific embodiment, the scrambling method of the model can be applied to Fig.13 The scrambling device 200 of the model shown and the electronic device 100 equipped with the scrambling device 200 of the model ( Fig.14 ). Figure 2 The process shown is described in detail, and the scrambling method of the model may specifically include the following steps:

[0046] Step S110, determining the model type of the model to be scrambled and the target security strength of the model to be scrambled.

[0047] As a way, the model can be obtained by training at least one neural network, and the neural network includes multiple different types of layers, each of which has its own unique functions and uses. In order to prevent the model to be scrambled from being cracked, the model type of the model to be scrambled can be determined first, and then the layer to be protected in the model to be scrambled can be determined based on the model type of the model to be scrambled, so that the layer to be protected can be scrambled later. Optionally, the model to be scrambled can be an AI model.

[0048] Optionally, the user can pre-set the security strength corresponding to each different type of model, so as to obtain the mapping relationship between the model type and the security strength. After determining the model type corresponding to the model to be scrambled, the target security strength corresponding to the model to be scrambled is determined based on the mapping relationship. Optionally, the user can also set the security strength corresponding to the model to be scrambled in advance and store it in association with the model to be scrambled. When it is determined that the model to be scrambled needs to be scrambled, the target security strength corresponding to the model to be scrambled can be directly obtained. Among them, the target security strength can be the strength corresponding to the time required for the user to crack the model to be scrambled. For example, if the user expects that it will take 30 days for the model to be scrambled to be cracked, the security strength of the model to be scrambled can be set to 30. Therefore, the security strength level of the model to be scrambled can also be determined by obtaining the cracking time corresponding to the model to be scrambled set by the user to determine the target security strength of the model to be scrambled.

[0049] Step S120: determining disturbance information corresponding to the model to be scrambled according to the model type and the target security strength.

[0050] As a way, after determining the model type of the model to be scrambled and the target security strength corresponding to the model to be scrambled, the scrambled layer corresponding to the model to be scrambled and the corresponding parameters to be scrambled in the scrambled layer can be determined according to the model type of the model to be scrambled, and the number of layers to be scrambled is determined according to the determined target security strength, so as to determine the scrambling information of the model to be scrambled according to the layers to be scrambled and the number of layers to be scrambled.

[0051] Step S130: obtaining a target key corresponding to the model to be scrambled, and generating a perturbation coefficient according to the target key.

[0052] As a way, in order to ensure that the scrambled model cannot be cracked by non-target users after being scrambled, a key of the scrambled model can be set, and a perturbation coefficient for scrambling the scrambled model can be generated based on the key. Optionally, the target key can be a key set by the user, a key randomly generated by the model, or a key generated according to the specific execution task of the model.

[0053] Optionally, after obtaining the target key corresponding to the model to be scrambled, the target key can be used as a random number to generate a seed, so that the generated seed is determined as the perturbation coefficient. Optionally, a method or formula for generating the perturbation coefficient can be pre-set, and then after the target key is determined, the perturbation coefficient is generated according to the pre-set method or formula for generating the perturbation coefficient and the target key. Optionally, multiple different methods for generating the perturbation coefficient can be pre-set, and after the target key is determined, at least one method is randomly selected to determine the perturbation coefficient.

[0054] Step S140: scramble the model parameters of the to-be-scrambled model according to the disturbance information and the disturbance coefficient to obtain a scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0055] As a method, the disturbance information may include the scrambled layer of the model to be scrambled and the scrambling method for scrambling the model to be scrambled, and then the model to be scrambled is scrambled by the determined scrambling coefficient and scrambling method, so as to obtain the scrambled model based on the model parameters modified by the disturbance coefficient.

[0056] Optionally, when the model executes the corresponding task, complex operations such as data calculation are performed through linear layers or other layers. When performing operations such as data calculation, the parameters in the corresponding layer are used for calculation. When the parameters in the corresponding layer change, the results output by the model based on the input and the executed tasks are also different. Therefore, the model to be scrambled can be disturbed by disturbing the parameters of the layer to be scrambled in the model to be scrambled, thereby preventing the model from being cracked due to reverse reasoning by non-target users based on the output and input of the model.

[0057] In an embodiment of the present application, based on the model type of the model to be scrambled and the target security strength of the model to be scrambled, the disturbance information of the model to be scrambled is determined based on the model type and the target security strength, and then the target key of the model to be scrambled is obtained, and the target key is used as the root of trust to generate a specific disturbance coefficient for the model parameters of the model to be scrambled, so that the model parameters of the model to be scrambled are scrambled based on the disturbance information by the disturbance coefficient, thereby generating a scrambled disturbance model. The present application scrambles the weight parameters and / or bias parameters of the model to be scrambled by using the disturbance coefficient generated by the target key, so that even if the model thief steals the model parameters of the scrambled model, the real model parameters of the model to be scrambled cannot be obtained, thereby improving the security of the model to be scrambled while ensuring the performance of the model to be scrambled.

[0058] See also Figure 3 , Figure 3 The flowchart of the scrambling method of the model provided by an embodiment of the present application is shown in FIG. Figure 3 The process shown is described in detail, the disturbance information includes the scrambled layer corresponding to the scrambled model and the target scrambling mode corresponding to the scrambled model, and the scrambling method of the model can specifically include the following steps:

[0059] Step S210: determining the model type of the model to be scrambled and the target security strength of the model to be scrambled.

[0060] Step S220: determining disturbance information corresponding to the model to be scrambled according to the model type and the target security strength.

[0061] Step S230: Obtain a target key corresponding to the model to be scrambled, and generate a perturbation coefficient according to the target key.

[0062] The specific step descriptions of step S210 to step S230 can refer to step S110 to step S130, which will not be repeated here.

[0063] Step S240: determining the model parameters corresponding to the layer to be scrambled.

[0064] As a method, a plurality of layers with different functions may be included in the model, each layer includes corresponding parameters, and the parameters are used to infer the input value of the model, so as to complete the recognition task or calculation task of the model. In order to scramble the model to be scrambled, the weight parameters and / or bias parameters corresponding to the layer to be scrambled may be determined first, so as to facilitate scrambling by the weight parameters and / or bias parameters. Optionally, the model to be scrambled may be a pre-trained model, so after determining the layer to be scrambled of the model to be scrambled, the model parameters of the layer to be scrambled may be directly obtained.

[0065] Step S250: Based on the target scrambling mode, scramble the model to be scrambled according to the disturbance coefficient and the model parameters to obtain the scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0066] As a method, after determining the model parameters corresponding to the layer to be scrambled and the target scrambling method corresponding to the model to be scrambled, the target parameters of the layer to be scrambled after scrambling can be determined based on the determined disturbance coefficient and the model parameters and the corresponding target scrambling method, and then the target parameters are used to update the model to be scrambled, and the model to be scrambled after the parameter update is determined as the scrambled model.

[0067] In some embodiments, the perturbation coefficients include weight perturbation coefficients and bias perturbation coefficients, such as Figure 4 As shown, the step S250 includes:

[0068] Step S251: If the target scrambling mode is multiplication perturbation, the target weight is determined according to the weight parameter and the weight perturbation coefficient, and the weight of the model to be scrambled is updated to the target weight to obtain the scrambled model.

[0069] As a method, multiplication perturbation is to perturb the weight parameter of the layer to be perturbed by multiplying the weight perturbation coefficient by the value obtained as the weight. Optionally, the target weight can be determined by the formula Q=k*w, where Q is the target weight, k is the weight perturbation coefficient, and w is the weight parameter corresponding to the layer to be perturbed.

[0070] Step S252: If the target scrambling mode is additive perturbation, a target bias is determined according to the bias parameter and the bias perturbation coefficient, and the bias of the model to be scrambled is updated to the target bias to obtain the scrambled model.

[0071] As a method, additive perturbation is to perform perturbation by adding the bias parameter of the layer to be scrambled to the bias perturbation coefficient as the bias. Optionally, the target bias can be determined by the formula L=b+e, where L is the target bias, e is the bias perturbation coefficient, and b is the bias parameter corresponding to the layer to be scrambled.

[0072] Step S253: If the target scrambling mode is a mixed disturbance, the target weight is determined according to the weight parameter and the weight disturbance coefficient, the target bias is determined according to the bias parameter and the bias disturbance coefficient, and the weight of the model to be scrambled is updated to the target weight and the bias of the model to be scrambled is updated to the target bias to obtain the scrambled model.

[0073] As a method, hybrid perturbation refers to scrambling the scrambled layer by multiplicative perturbation and additive perturbation. First, the target weight of the scrambled layer is determined according to the multiplicative perturbation, and the target bias of the scrambled layer is determined according to the additive perturbation. Then, the parameters of the scrambled layer are updated according to the target weight as the weight parameter of the scrambled layer and the target bias as the bias parameter of the scrambled layer, so as to scramble the scrambled model.

[0074] Optionally, before the scrambled layer is scrambled by a mixed perturbation method, multiple bias perturbation coefficients can be determined according to the number of weight parameters and bias parameters, and then when the number of weight parameters is multiple, the weight perturbation coefficients are multiplied by the weight parameters to obtain multiple target weights, and the weight perturbation coefficients are multiplied by the bias parameters to obtain target biases, and then the multiple target weights are added to the bias perturbation coefficients to obtain perturbation weight coefficients, and the target bias is added to the bias perturbation coefficients to obtain bias weight coefficients, and finally the scrambled model is scrambled according to the perturbation weight coefficients and the bias weight coefficients. Figure 5 As shown, when the target scrambling method is mixed disturbance, the weight disturbance coefficient is multiplied by the weight parameter to obtain the target weights k*w1, k*w2 and k*w3, and the weight disturbance coefficient is multiplied by the bias parameter to obtain the target bias k*b, and multiple target weights are added to the bias disturbance coefficient to obtain disturbance weight coefficients k*w1+e1, k*w2+e2 and k*w3+e3, and the target bias is added to the bias disturbance coefficient to obtain the bias weight coefficient k*b+e4.

[0075] In this embodiment, the model parameters corresponding to the scrambled layer of the model to be scrambled are first determined, so that the model parameters can be scrambled and calculated according to the perturbation coefficient based on the target scrambling method, and the scrambling of the model to be scrambled is realized at one time, wherein the target scrambling method includes multiplication perturbation, additive perturbation and mixed perturbation, so as to ensure the richness of the scrambling of the model to be scrambled, and further improve the security of the model to be scrambled after scrambling.

[0076] See also Figure 6 , Figure 6 The following is a schematic diagram of the scrambling method of the model provided in an embodiment of the present application. Figure 6 The process shown is described in detail, and the scrambling method of the model may specifically include the following steps:

[0077] Step S310: determine the model type of the model to be scrambled and the target security strength of the model to be scrambled.

[0078] Step S320: Determine disturbance information corresponding to the model to be scrambled according to the model type and the target security strength.

[0079] Step S330, determining the hardware device information of the hardware device where the model to be scrambled is located, and generating the target key according to the device serial number of the hardware device indicated by the hardware device information.

[0080] As a way, in order to make the scrambling of the model not easy to be cracked, when determining the target key of the model to be scrambled, a specific key can be generated in a specific way to prevent attackers from stealing the key. Optionally, since each hardware device has specific hardware device information, the target key can be generated by obtaining the hardware device information of the hardware device where the model to be scrambled is located, so that the attacker cannot crack the scrambled model by obtaining the hardware device information corresponding to the model to be scrambled. Optionally, the key can be determined by a key management component, and the key management group can be a component embedded in a hardware device chip card. The method is a hardware security module (Hardwaresecurity machine, HSM), which is a commonly used means of protecting and managing keys. For example, encryption machine devices usually protect the key in hardware through a variety of security means, which is difficult to be stolen. Then the key management component has the hardware access capability to use the key in the hardware security module. The key of the entire process needs to be in the hardware security module to avoid being leaked. The key management component needs to enter the hardware security module to use the key and generate the required position value. In this embodiment, the target key can be generated in the key management component according to the device serial number of the hardware device indicated by the hardware device information.

[0081] Step S340: determine the account information corresponding to the model to be scrambled, and generate the target key according to the account information.

[0082] As a way, in order to enable non-target users to arbitrarily determine the target key of the model to be scrambled in different devices, thereby causing the scrambled model to be cracked, the corresponding target key can be generated by the account information of the target account logged in in the model to be scrambled. Optionally, a high-security commercial key management system (Key management system, KMS) can be used to generate the target key according to the account information, such as the key management system provided by mainstream cloud providers. The key management component has a protection measure similar to the HSM for the high security protection capability of the key, so as to ensure that the target key will not be obtained by non-target users. Optionally, the key management system can also access the target key using KMS through authentication and other methods. Finally, the key management component also needs to use some authentication functions to implement functions that can only be used by specific users, such as access to the key management component through authentication methods such as user passwords / passwords.

[0083] Step S350, obtaining the target task of the model to be scrambled, generating the target key according to the target task, and generating a perturbation coefficient according to the target key.

[0084] As a way, in order to ensure the randomness of scrambling the model to be scrambled, the target task that needs to be performed by the model to be scrambled each time can be determined, so that the corresponding target key can be randomly generated based on the target task, thereby ensuring the randomness of the target key and making it difficult to crack the target key.

[0085] Step S360: scramble the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain a scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0086] Among them, the specific step descriptions of step S310-step S320 and step S360 can refer to step S110-step S120 and step S140, which will not be repeated here.

[0087] In this embodiment, the target key of the model to be scrambled is generated by the device serial number indicated by the hardware device information of the hardware device where the superstition to be scrambled is located, the account information corresponding to the model to be scrambled, and the target task corresponding to the superstition to be scrambled, so as to ensure the diversity and security of the generated target key, avoid the situation where the target key is easily obtained by others, and further improve the security of the model to be scrambled after scrambling.

[0088] See also Figure 7 , Figure 7 The flowchart of the scrambling method of the model provided by an embodiment of the present application is shown in FIG. Figure 7 The process shown is described in detail, the disturbance information includes the scrambled layer corresponding to the scrambled model and the target scrambling mode corresponding to the scrambled model, and the scrambling method of the model can specifically include the following steps:

[0089] Step S410: determining the model type of the model to be scrambled and the target security strength of the model to be scrambled.

[0090] Step S420: determining a target scrambling method corresponding to the model type according to the target mapping relationship, wherein the target mapping relationship indicates a correspondence between different model types and scrambling methods.

[0091] As a method, the mapping relationship between the scrambling methods corresponding to different model types and different model types can be pre-set, and then after the model type of the model to be scrambled is determined, the target scrambling method corresponding to the model type of the model to be scrambled is determined based on the target mapping relationship and the model type.

[0092] Step S430: Determine the to-be-scrambled layer corresponding to the to-be-scrambled model and the number of layers of the to-be-scrambled layer according to the target security strength and the model type.

[0093] As a method, different types of models have different structures and layers that need to be protected. The corresponding relationship between different types of models and the layers that need to be protected corresponding to different types of models can be pre-set. After determining the model type of the model to be scrambled, the layer to be scrambled corresponding to the model to be scrambled is determined based on the corresponding relationship.

[0094] Optionally, since the target security strength can directly affect the number of layers and the number of parameters of the layers that need to be scrambled, the number of layers that need to be scrambled can be determined according to the target security strength, and then the layers that can be scrambled in the model to be scrambled can be determined according to the model type, so as to determine the layers to be scrambled and the number of layers to be scrambled.

[0095] Step S440: determining the disturbance information according to the target scrambling mode, the layer to be scrambled, and the number of layers of the layer to be scrambled.

[0096] As a method, after determining the target scrambling mode, the layer to be scrambled and the number of layers to be scrambled corresponding to the model to be scrambled, the scrambling parameters to be scrambled can be determined according to the target scrambling mode, the layer to be scrambled and the number of layers to be scrambled corresponding to the model to be scrambled, and then the scrambling information is determined based on the parameters to be scrambled.

[0097] Step S450: Obtain a target key corresponding to the model to be scrambled, and generate a perturbation coefficient according to the target key.

[0098] Step S460: scramble the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain a scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0099] The specific step descriptions of step S410 and step S450 to step S460 can refer to step S110 and step S130 to step S140, which will not be repeated here.

[0100] In this embodiment, in order to ensure the accuracy of scrambling the model to be scrambled, the target scrambling mode of the model to be scrambled is first determined according to the model type and the correspondence between the indicated model type and the scrambling mode, and the scrambled layer and the number of scrambled layers corresponding to the model to be scrambled are determined according to the target security strength of the model to be scrambled and the model type. In this way, the scrambled layer can be scrambled according to the target scrambling mode and the number of scrambled layers, thereby improving the accuracy of scrambling the model to be scrambled and ensuring the security of the model to be scrambled.

[0101] See also Figure 8 , Figure 8 The following is a schematic diagram of the scrambling method of the model provided in an embodiment of the present application. Figure 8 The process shown is described in detail, the disturbance information includes the scrambled layer corresponding to the scrambled model and the target scrambling mode corresponding to the scrambled model, and the scrambling method of the model can specifically include the following steps:

[0102] Step S510: determine the model type of the model to be scrambled and the target security strength of the model to be scrambled.

[0103] Step S520: Determine disturbance information corresponding to the model to be scrambled according to the model type and the target security strength.

[0104] Step S530: Obtain a target key corresponding to the model to be scrambled, and generate a perturbation coefficient according to the target key.

[0105] Step S540: scramble the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain a scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

[0106] The specific step descriptions of step S510 to step S540 can refer to step S110 to step S140, which will not be repeated here.

[0107] Step S550, obtaining the output value of the scrambled model.

[0108] As a method, after obtaining the scrambled model, the input value is input into the scrambled model, and the scrambled model performs scrambling reasoning based on the input value and the scrambled parameters, and outputs the scrambled output value. Optionally, since the perturbation layer is obtained after scrambling the to-be-scrambled layer in the standby scrambled model according to the perturbation coefficient, the scrambled model can then perform reasoning based on the perturbation layer to obtain the output value. Optionally, when the scrambled model is reasoning, the input data will be calculated accordingly according to each forward propagation algorithm of the model until the corresponding perturbation layer is executed. In the perturbation layer, the reasoning calculation process of the perturbation layer is first executed, such as Fig. 9 As shown, for a perturbation layer with parameters (M, d) = (k*W+E, k*b+e4), for input X = (x1, x2, x3), the inference result z of this layer is calculated.<X,M> +d, where the perturbation layer can be identified by building the configuration into the inference component of the perturbation model.

[0109] Step S560: performing descrambling calculation on the output value according to the disturbance coefficient and the disturbance information to obtain a target output value, wherein the target output value is an output value obtained by the model to be scrambled based on the input value.

[0110] As a way, in order to obtain the actual output value of the scrambled model when executing the corresponding task according to the input value, the output value can be descrambled by using the input value, the perturbation coefficient and the perturbation information to obtain the original output value, and then the original output value is determined as the target output value. Optionally, the descrambling calculation process can be as follows Fig.10 As shown, the model reasoning is executed to the perturbation layer, the reasoning of the perturbation layer is executed, the intermediate reasoning result is obtained, the target key is obtained, and then a specific descrambling parameter is generated according to the target key. The descrambling calculation is performed on the director reasoning result corresponding to the perturbation layer through the descrambling parameter, and the original reasoning result corresponding to the perturbation layer is returned to obtain the target output value.

[0111] In some embodiments, Fig.11 As shown, the step S560 includes:

[0112] Step S561, obtaining a reference key, and performing key verification according to the reference key.

[0113] As a way, in order to ensure the accuracy of the descrambling calculation, the reference key can be obtained first, and then the reference key can be verified to prevent any key from being used for descrambling calculation. Optionally, since in each perturbation Linear layer, the model uses the key management component to generate perturbation coefficients specific to that layer, this process is similar to the previous perturbation parameter generation process, and the key is required to be used as a random number seed to generate a specific perturbation value. Because the key is a fixed value, the perturbation coefficient can be recovered, so the reference key must be verified to ensure that when performing the descrambling calculation, the reference key is the target key when scrambling.

[0114] Step S562: If the key verification of the reference key passes, determining the target perturbation mode of the scrambled model according to the perturbation information and obtaining the descrambling coefficient according to the reference key.

[0115] As a method, when it is determined that the key verification of the reference key is passed, the reference key can be determined to be the target key corresponding to the generation of the perturbation coefficient, and then the perturbation information for scrambling the scrambled model stored in the key management component can be directly obtained based on the target key, and then the target perturbation mode and the descrambling coefficient are determined according to the perturbation information. Optionally, the descrambling coefficient is the same as the perturbation coefficient determined when the scrambled model is scrambled.

[0116] Step S563: performing descrambling calculation on the output value according to the output value and the descrambling coefficient based on the target disturbance mode.

[0117] As a method, after determining the target disturbance mode, the determined descrambling coefficient and the output value can be reversely calculated according to the target disturbance mode, so as to realize the descrambling calculation of the output value. Optionally, the process of descrambling the output value can be based on the formula (z-<X,E> -e4) / k to calculate and return the value as the target output, where z is the output value, X is the input value, E and e4 are the bias perturbation coefficients, k is the weight perturbation coefficient, and -< is used to indicate the reverse calculation, which is to perform an inverse matrix algorithm on the weight parameters and subtract the bias parameters, such as Fig.12 As shown, the calculation process can be

[0118] z=<X,M> +d=x1*k*w1+x1*e1+x2*l*w2+x2*e2+x3*k*w3+x3*e3+k*b+e4=k*(x1*w1+x2*w2+x3*w3+b)+x1*e1+x2*e2+x3*e3+e4=k*y+<X,E> +e4, that is, y=(z-<X,E> -e4) / k, so that after descrambling, the correct non-scrambled inference result value y expected by the layer is obtained, and then the result can continue the subsequent model inference calculation to obtain the target output value.

[0119] In this embodiment, after obtaining the scrambled model, the output value output by the scrambled model based on the input is first obtained, and then the reference key obtained during descrambling is verified, and then if the verification is passed, the target perturbation mode of the scrambled model is determined according to the perturbation information of the scrambled model and the descrambling coefficient is generated according to the reference key, and then the output value is descrambled according to the output value and the descrambling coefficient based on the target perturbation mode to obtain the target output value of the model to be scrambled, thereby ensuring that the reasoning ability of the model cannot be used correctly without the correct key, thereby improving the security of the model.

[0120] Fig.13 A scrambling device according to an embodiment of the present application is shown in FIG. Fig.13 As shown, the scrambling 200 of the model includes: a target security strength determination module 210, a disturbance information determination module 220, a disturbance coefficient determination module 230 and a scrambling module 240.

[0121] The target security strength determination module 210 is used to determine the model type of the model to be encrypted and the target security strength of the model to be encrypted; the disturbance information determination module 220 is used to determine the disturbance information corresponding to the model to be encrypted according to the model type and the target security strength; the disturbance coefficient determination module 230 is used to obtain the target key corresponding to the model to be encrypted and generate the disturbance coefficient according to the target key; the scrambling module 240 is used to scramble the model to be encrypted according to the disturbance information and the disturbance coefficient to obtain the encrypted model, wherein the model parameters include weight parameters and / or bias parameters.

[0122] In some embodiments, the disturbance information includes the scrambled layer corresponding to the model to be scrambled and the target scrambling method corresponding to the model to be scrambled, and the scrambling module 240 includes: a model parameter determination submodule, used to determine the model parameters corresponding to the layer to be scrambled; a scrambling submodule, used to scramble the model parameters of the model to be scrambled according to the disturbance coefficient and the model parameter based on the target scrambling method to obtain the scrambled model.

[0123] In some embodiments, the perturbation coefficient includes a weight perturbation coefficient and a bias perturbation coefficient, and the scrambling submodule includes: a first scrambling unit, which is used to determine the target weight according to the weight parameter and the weight perturbation coefficient if the target scrambling mode is multiplication perturbation, and update the weight of the model to be scrambled to the target weight to obtain the scrambled model; or a second scrambling unit, which is used to determine the target bias according to the bias parameter and the bias perturbation coefficient if the target scrambling mode is additive perturbation, and update the bias of the model to be scrambled to the target bias to obtain the scrambled model; or a third scrambling unit, which is used to determine the target weight according to the weight parameter and the weight perturbation coefficient if the target scrambling mode is mixed perturbation, determine the target bias according to the bias parameter and the bias perturbation coefficient, and update the weight of the model to be scrambled to the target weight and the bias of the model to be scrambled to the target bias to obtain the scrambled model.

[0124] In some embodiments, the perturbation coefficient determination module 230 includes: a first perturbation coefficient determination submodule, used to determine the hardware device information of the hardware device where the model to be encrypted is located, and generate the target key according to the device serial number of the hardware device indicated by the hardware device information; and / or a second perturbation coefficient determination submodule, used to determine the account information corresponding to the model to be encrypted, and generate the target key according to the account information; and / or a third perturbation coefficient determination submodule, used to obtain the target task of the model to be encrypted, and generate the target key according to the target task.

[0125] In some embodiments, the disturbance information determination module 220 includes: a target scrambling mode determination submodule, which is used to determine the target scrambling mode corresponding to the model type according to the target mapping relationship, wherein the target mapping relationship indicates the correspondence between different model types and scrambling modes; a to-be-scrambled layer determination submodule, which is used to determine the to-be-scrambled layer and the number of layers of the to-be-scrambled layer corresponding to the to-be-scrambled model according to the target security strength and the model type; a disturbance information determination submodule, which is used to determine the disturbance information according to the target scrambling mode, the to-be-scrambled layer and the number of layers of the to-be-scrambled layer.

[0126] In other embodiments, the scrambling device 200 of the model further includes: an acquisition module, used to obtain the output value of the scrambled model; a descrambling module, used to perform descrambling calculation on the output value according to the disturbance coefficient and the disturbance information to obtain a target output value, wherein the target output value is the output value obtained by the model to be scrambled based on the input value.

[0127] In some embodiments, the descrambling module includes: a key verification submodule, used to obtain a reference key and perform key verification based on the reference key; a perturbation coefficient acquisition submodule, used to determine the target perturbation mode of the scrambled model according to the perturbation information and obtain the descrambling coefficient according to the reference key if the key verification of the reference key passes; a descrambling submodule, used to perform descrambling calculation on the output value according to the output value and the descrambling coefficient based on the target perturbation mode.

[0128] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0129] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0130] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0131] See also Fig.14, which shows a structural block diagram of an electronic device provided in an embodiment of the present application. The electronic device 300 may be an electronic device capable of running applications, such as a smart phone, a tablet computer, an e-book, etc. The electronic device 300 in the present application may include one or more of the following components: a processor 310, a processor 320, and one or more applications, wherein the one or more applications may be stored in the processor 320 and configured to be executed by the one or more processors 310, and the one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0132] The processor 310 may include one or more processing cores. The processor 310 uses various interfaces and lines to connect various parts of the entire electronic device 300, and executes various functions and processes data of the electronic device 300 by running or executing instructions, programs, code sets or instruction sets stored in the processor 320, and calling data stored in the processor 320. Optionally, the processor 310 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 310 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 310, but may be implemented separately through a communication chip.

[0133] The processor 320 may include a random access memory (RAM) or a read-only memory (ROM). The processor 320 may be used to store instructions, programs, codes, code sets or instruction sets. The processor 320 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the electronic device 300 during use.

[0134] See also Fig.15, which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable medium 400 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0135] The computer readable storage medium 400 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium 400 includes a non-transitory computer-readable storage medium. The computer readable storage medium 400 has storage space for program code 410 that performs any method steps in the above method. These program codes can be read from or written to one or more computer program products. The program code 410 can be compressed, for example, in an appropriate form.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A scrambling method for a model, characterized in that: The method comprises: Determining a model type of a model to be scrambled and a target security strength of the model to be scrambled; Determine disturbance information corresponding to the to-be-scrambled model according to the model type and the target security strength; Obtaining a target key corresponding to the model to be scrambled, and generating a perturbation coefficient according to the target key; The model parameters of the model to be scrambled are scrambled according to the disturbance information and the disturbance coefficient to obtain a scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

2. The method according to claim 1, characterized in that The disturbance information includes a to-be-scrambled layer corresponding to the to-be-scrambled model and a target scrambling mode corresponding to the to-be-scrambled model, and scrambling the model parameters of the to-be-scrambled model according to the disturbance information and the disturbance coefficient to obtain a scrambled model, including: Determining model parameters corresponding to the layer to be scrambled; Based on the target scrambling mode, the model to be scrambled is scrambled according to the disturbance coefficient and the model parameter to obtain the scrambled model.

3. The method according to claim 2, characterized in that The perturbation coefficient includes a weight perturbation coefficient and a bias perturbation coefficient. The method of scrambling the model to be scrambled based on the target scrambling mode according to the perturbation coefficient and the model parameter to obtain the scrambled model includes: If the target scrambling mode is multiplication perturbation, determining the target weight according to the weight parameter and the weight perturbation coefficient, and updating the weight of the model to be scrambled to the target weight to obtain the scrambled model; or If the target scrambling mode is additive perturbation, a target bias is determined according to the bias parameter and the bias perturbation coefficient, and the bias of the model to be scrambled is updated to the target bias to obtain the scrambled model; or If the target scrambling mode is a mixed disturbance, the target weight is determined according to the weight parameter and the weight disturbance coefficient, the target bias is determined according to the bias parameter and the bias disturbance coefficient, the weight of the model to be scrambled is updated to the target weight, and the bias of the model to be scrambled is updated to the target bias, so as to obtain the scrambled model.

4. The method according to claim 1, characterized in that: The obtaining of the target key corresponding to the model to be scrambled includes: Determine the hardware device information of the hardware device where the model to be scrambled is located, and generate the target key according to the device serial number of the hardware device indicated by the hardware device information; and / or Determine the account information corresponding to the model to be scrambled, and generate the target key according to the account information; and / or Obtain a target task of the model to be scrambled, and generate the target key according to the target task.

5. The method according to claim 1, characterized in that The determining, according to the model type and the target security strength, disturbance information corresponding to the model to be scrambled includes: Determining a target scrambling mode corresponding to the model type according to a target mapping relationship, wherein the target mapping relationship indicates a correspondence between different model types and scrambling modes; Determining, according to the target security strength and the model type, a to-be-scrambled layer corresponding to the to-be-scrambled model and the number of layers of the to-be-scrambled layer; The disturbance information is determined according to the target scrambling mode, the layer to be scrambled, and the number of layers of the layer to be scrambled.

6. The method according to any one of claims 1 to 5, characterized in that: After scrambling the model parameters of the to-be-scrambled model according to the disturbance information and the disturbance coefficient to obtain the scrambled model, the method further includes: Obtaining an output value of the scrambled model; The output value is descrambled and calculated according to the disturbance coefficient and the disturbance information to obtain a target output value, wherein the target output value is an output value obtained by the model to be scrambled based on the input value.

7. The method according to claim 6, characterized in that The performing descrambling calculation on the output value according to the input value, the disturbance coefficient and the disturbance information comprises: Obtaining a reference key, and performing key verification based on the reference key; If the key verification of the reference key passes, determining a target perturbation mode of the scrambled model according to the perturbation information and obtaining the descrambling coefficient according to the reference key; The output value is descrambled and calculated based on the target disturbance mode according to the output value and the descrambling coefficient.

8. A scrambling device for a model, characterized in that: The device comprises: A target security strength determination module, used to determine the model type of the model to be scrambled and the target security strength of the model to be scrambled; A disturbance information determination module, used to determine the disturbance information corresponding to the to-be-scrambled model according to the model type and the target security strength; A perturbation coefficient determination module, used to obtain a target key corresponding to the model to be scrambled, and generate a perturbation coefficient according to the target key; The scrambling module is used to scramble the model parameters of the model to be scrambled according to the disturbance information and the disturbance coefficient to obtain the scrambled model, wherein the model parameters include weight parameters and / or bias parameters.

9. An electronic device, characterized in that: The electronic device comprises: one or more processors; a memory, electrically connected to the one or more processors; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images