Convolutional neural network inference method and device based on device end trusted execution environment, and device

Abstract

The application provides a convolutional neural network inference method and device based on a device-side trusted execution environment, and an apparatus. The method is executed in a trusted execution environment running on a device side, and includes: receiving intermediate data of a current target convolutional layer output in a first model after obfuscated calculation; correcting the intermediate data and transmitting the corrected intermediate data to a client application, so that when the target convolutional layer is determined to be the last convolutional layer, the corrected intermediate data is input into a second model to obtain result data; receiving the result data and inputting the result data into the last fully connected layer in the convolutional neural network to obtain inference result data. The application can effectively solve the problem of limited secure memory existing in the device side such as an edge device on the basis of hardware implementation of convolutional neural network security inference, can perform convolutional neural network security inference without precision loss on the device side, and can effectively protect the privacy information of the convolutional neural network.

Description

Technical Field

[0001] This application relates to the field of model inference technology, and in particular to convolutional neural network inference methods, apparatus and devices based on a trusted execution environment on the device side. Background Technology

[0002] In recent years, machine learning has been widely applied, with advancements in deep neural networks playing a crucial role. The widespread adoption of mobile and IoT devices has also spurred the need for on-device neural network model inference. While deploying models on-device can effectively protect user privacy and reduce inference latency, it also introduces new challenges. Deploying models on devices can cause service providers to lose control of their proprietary models. Attackers could exploit this by gaining root access to smart devices and stealing critical information, potentially leading to the leakage or misuse of proprietary models and infringing on the service provider's intellectual property.

[0003] To enhance model privacy protection in on-device inference scenarios, a Trusted Execution Environment (TEE) provides an isolated computing environment. TrustZone, a specific implementation of TEE, divides the system hardware into a Secure World and a Normal World, isolating the computing environment and data. This allows for the simultaneous provision of trusted and untrusted runtime environments on a single processor. Even if an attacker has root privileges on the device, they cannot access data in the Secure World.

[0004] However, secure memory in the secure world is very limited, making it impossible to fully load neural network models into memory for inference. Quantization and pruning techniques can reduce resource requirements, but usually at the expense of model inference accuracy. Summary of the Invention

[0005] In view of this, embodiments of this application provide a convolutional neural network inference method, apparatus, and device based on a device-side trusted execution environment, in order to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of this application provides a convolutional neural network inference method based on a device-side trusted execution environment. The method is executed within a device-side trusted execution environment, and includes:

[0007] During the inference process, intermediate data is received from the current target convolutional layer output in the first model of the convolutional neural network, which is obfuscated and computed in the client application; wherein, the first model contains multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any one of the convolutional layers in the first model.

[0008] The intermediate data is corrected according to the correction parameters corresponding to the target convolutional layer to obtain the corrected intermediate data corresponding to the target convolutional layer. It is then determined whether the input data corresponding to the target convolutional layer has been obfuscated. If so, the corrected intermediate data corresponding to the target convolutional layer is transmitted to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and outputs the result data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, excluding each convolutional layer and the last fully connected layer in the convolutional neural network.

[0009] The system receives the result data sent by the client application and inputs the result data into the last fully connected layer of the convolutional neural network that is pre-stored locally, to obtain the inference result data output by the last fully connected layer.

[0010] In some embodiments of this application, the first model in the client application, after obfuscation computation, runs in the rich execution environment of the client application, so that the client application inputs the input data corresponding to the current target convolutional layer in the first model into the target convolutional layer in the rich execution environment, so that the target convolutional layer performs convolution operation on the input data based on the obfuscation weights corresponding to the target convolutional layer and outputs the intermediate data corresponding to the target convolutional layer.

[0011] In some embodiments of this application, the convolutional neural network inference method based on a device-side trusted execution environment further includes:

[0012] If it is determined that the input data corresponding to the target convolutional layer to be acquired has not been obfuscated, random noise is added to the corrected intermediate data corresponding to the target convolutional layer to complete the obfuscation of the corrected intermediate data.

[0013] The corrected intermediate data, after being obfuscated, is transmitted to the client application.

[0014] In some embodiments of this application, if the client application determines that the target convolutional layer is not the last convolutional layer in the first model, the client application uses the corrected intermediate data corresponding to the target convolutional layer as the input data corresponding to the next convolutional layer corresponding to the target convolutional layer, and inputs the input data corresponding to the next convolutional layer into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data corresponding to the next convolutional layer based on the confusion weights corresponding to the next convolutional layer and outputs the intermediate data corresponding to the next convolutional layer.

[0015] Correspondingly, after transmitting the corrected intermediate data corresponding to the target convolutional layer to the client application, and before receiving the result data sent by the client application, the method further includes:

[0016] During the inference process, intermediate data is received from the next convolutional layer corresponding to the target convolutional layer in the first model after obfuscation calculation.

[0017] The intermediate data corresponding to the next convolutional layer is corrected according to the correction parameters of the next convolutional layer to obtain the corrected intermediate data corresponding to the next convolutional layer. It is then determined whether the input data corresponding to the next convolutional layer to be acquired has been obfuscated. If so, the corrected intermediate data corresponding to the next convolutional layer is transmitted to the client application.

[0018] In some embodiments of this application, the first model and the second model corresponding to the convolutional neural network constitute the first half of the convolutional neural network model, and the last fully connected layer corresponding to the convolutional neural network constitutes the second half of the convolutional neural network model; and the first model after obfuscation calculation is generated in advance by performing obfuscation calculation on the first model based on a preset obfuscation model generation algorithm, and the first model after obfuscation calculation includes the obfuscation weights and correction parameters corresponding to each convolutional layer;

[0019] The first model and the second model after obfuscation calculation are pre-sent to the client application for storage.

[0020] In some embodiments of this application, before receiving intermediate data of the current target convolutional layer output in the first model corresponding to the obfuscated computation in the client application during the inference process, the method further includes:

[0021] Receive and locally store the correction parameters corresponding to the last fully connected layer in the convolutional neural network and each convolutional layer in the first model after obfuscation calculation.

[0022] Another aspect of this application provides a convolutional neural network inference device based on a device-side trusted execution environment. The device is configured within a device-side trusted execution environment and includes:

[0023] An intermediate data receiving module is used to receive intermediate data output by the current target convolutional layer in the first model of the convolutional neural network in the client application after obfuscation calculation during the inference process; wherein, the first model includes multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any convolutional layer in the first model.

[0024] The calibration and data transmission module is used to calibrate the intermediate data according to the calibration parameters corresponding to the target convolutional layer to obtain calibrated intermediate data, and to determine whether the input data corresponding to the target convolutional layer has been obfuscated. If so, the calibrated intermediate data is transmitted to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the calibrated intermediate data into the second model corresponding to the convolutional neural network and sends out the output data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, except for each convolutional layer and the last fully connected layer in the convolutional neural network.

[0025] The hierarchical inference module is used to receive the result data sent by the client application and input the result data into the last fully connected layer of the convolutional neural network that is pre-stored locally to obtain the inference result data output by the last fully connected layer.

[0026] A third aspect of this application provides a convolutional neural network inference device, comprising: a client application deployed in a rich execution environment and a trusted application deployed in a trusted execution environment;

[0027] The trusted application is used to execute the aforementioned convolutional neural network inference method based on a device-side trusted execution environment.

[0028] In some embodiments of this application, the client application is used to perform the following:

[0029] In a rich execution environment, determine whether the target convolutional layer is the last convolutional layer in the first model;

[0030] If so, the corrected intermediate data is input into the second model corresponding to the convolutional neural network, and the result data output by the second model is emitted.

[0031] If not, the corrected intermediate data corresponding to the target convolutional layer is used as the input data of the next convolutional layer corresponding to the target convolutional layer, and the input data of the next convolutional layer is input into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data of the next convolutional layer based on the confusion weights of the next convolutional layer and outputs the intermediate data of the next convolutional layer, and sends the intermediate data of the next convolutional layer to the trusted application.

[0032] In some embodiments of this application, before determining whether the target convolutional layer is the last convolutional layer in the first model in the rich execution environment, the client application further performs the following:

[0033] Receive and locally store the first model and the second model after obfuscation computation in a rich execution environment.

[0034] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the convolutional neural network inference method based on a device-side trusted execution environment.

[0035] A fifth aspect of this application provides a computer program product including a computer program that, when executed by a processor, implements the convolutional neural network inference method based on a device-side trusted execution environment.

[0036] The convolutional neural network inference method based on a device-side trusted execution environment provided in this application is executed in a device-side trusted execution environment. The method includes: receiving intermediate data output from the current target convolutional layer in a first model corresponding to the convolutional neural network in a client application after obfuscation calculation during the inference process; wherein, the first model includes multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any convolutional layer in the first model; correcting the intermediate data according to the correction parameters corresponding to the target convolutional layer to obtain corrected intermediate data corresponding to the target convolutional layer, and determining whether the input data corresponding to the target convolutional layer has been obfuscated; if so, transmitting the corrected intermediate data corresponding to the target convolutional layer to the client application, so that the client application can determine whether the target convolutional layer is the first model. If the last convolutional layer in the convolutional neural network is a valid convolutional neural network, the client application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and sends out the result data output by the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, excluding each convolutional layer and the last fully connected layer in the convolutional neural network. The client application receives the result data sent by the client application and inputs the result data into the last fully connected layer in the convolutional neural network that is pre-stored locally to obtain the inference result data output by the last fully connected layer. This method can effectively solve the problem of limited security memory on devices such as edge devices, based on hardware-based secure inference of convolutional neural networks. It can perform secure inference of convolutional neural networks without precision loss on the device and can effectively protect the privacy information of convolutional neural networks.

[0037] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0038] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0039] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0040] Figure 1 This is a schematic diagram of the first process of a convolutional neural network inference method based on a trusted execution environment on the device side, according to an embodiment of this application.

[0041] Figure 2 This is a schematic diagram of the second process of a convolutional neural network inference method based on a trusted execution environment on the device side, according to an embodiment of this application.

[0042] Figure 3 This is a schematic diagram of the structure of a convolutional neural network inference device based on a trusted execution environment on the device side, according to one embodiment of this application.

[0043] Figure 4 This is a schematic diagram of the structure of a convolutional neural network inference device according to an embodiment of this application.

[0044] Figure 5 This is a flowchart illustrating the convolutional neural network inference process executed by a client application in a convolutional neural network inference device according to an embodiment of this application.

[0045] Figure 6 This is an overview diagram of the device-side model security reasoning method based on TrustZone in an application example of this application.

[0046] Figure 7 This is a schematic diagram illustrating the specific implementation process of the device-side model security reasoning method based on TrustZone in an application example of this application.

[0047] Figure 8 This is a schematic diagram of the model-safe reasoning process structure in an application example of this application.

[0048] Figure 9 This is a flowchart illustrating the specific implementation of the model-safe reasoning process in an application example of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0050] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the solution according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0051] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0052] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0053] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0054] In recent years, machine learning has been widely applied, with advancements in deep neural networks playing a crucial role. Deep neural networks are used in various fields, including image classification, anomaly detection, and health monitoring. The widespread adoption of mobile and IoT devices has also spurred the demand for on-device neural network model inference. Traditionally, to use cloud-based model inference services, users need to transmit their data from their devices to remote cloud servers over the network, and then return the results after inference is complete—a process known as Machine Learning as a Service (MLaaS). Cloud-based model inference services present two main challenges. First, there's the issue of data privacy. Deep learning technology is increasingly used in sensitive environments, and users lose control over their private data, such as images and health information collected on their devices, once uploaded to remote cloud servers. Second, there's the issue of real-time responsiveness. Sending data to remote cloud servers for model inference can introduce additional queuing, transmission, and inference latency. However, in specific scenarios such as autonomous driving and elderly alert systems, even an additional 0.1-second delay is unacceptable.

[0055] In a Machine Learning as a Service (MAS) scenario, service providers offer inference services to users using pre-inferred neural network models. The client holds private data `x`, while the neural network model implementing function `f` is deployed on a remote server. The client wants to obtain the inference results from the neural network model on `x`. However, the client wants to keep its private data `x` private, meaning it cannot upload `x` to the cloud server unencrypted; simultaneously, the neural network model is the intellectual property of the service provider and cannot be deployed to the client unencrypted. In summary, during the model inference phase, input data and the neural network model are held by different parties, and both data privacy and model security must be considered. Secure model inference needs to achieve inference computation on the client's input data while meeting these security requirements.

[0056] In recent years, secure inference methods based on encryption technology and hardware isolation have become a research hotspot in academia. For example, homomorphic encryption (HE) is a privacy-enhancing technique that allows computation to be performed on encrypted data. The output of the computation remains encrypted, and decrypting the encrypted output yields the same result as directly computing on unencrypted data. Service providers can perform inference without decrypting the data and return the encrypted result to the user for decryption. This approach ensures the confidentiality of user data. However, HE only supports addition or multiplication operations. Even though fully homomorphic encryption (FHE) schemes can support both addition and multiplication, FHE has extremely high hardware performance requirements and suffers from problems such as noise accumulation and high overhead in practical applications. Another approach is secure inference based on hardware isolation, deploying the model on a local device for inference. Inference of neural network models on the device helps protect user privacy because the user's private data never leaves the device. Therefore, many studies attempt to migrate complex neural network models from the cloud to on-device deployment. By deploying deep neural network models on mobile devices, reliance on network bandwidth and cloud server resources can be reduced, thereby improving the performance of mobile applications and minimizing application communication costs and latency.

[0057] However, while deploying models on-device can effectively protect user privacy and reduce inference latency, it also introduces a new problem. If models are deployed on devices, service providers may lose control of their proprietary models. Attackers could exploit this by breaking root access on smart devices to steal critical information, potentially leading to the leakage or misuse of proprietary models and infringing on the service provider's intellectual property. Besides the potential leakage of proprietary model weights, the model's inference data also faces privacy risks. Information about the inference data may be leaked during the inference process, a phenomenon known as Membership Inference Attack (MIA). Deep neural network models "remember" features from the inference data after inference, enabling them to identify samples exhibiting similar patterns in other data. However, this memory often includes more specific information in the inference dataset that is unrelated to the target pattern (the category information the model needs to classify), posing a privacy risk to the inference data.

[0058] To enhance device-level privacy protection, hardware-level protection can be implemented, with Trusted Execution Environments (TEEs) being widely researched. TEE technologies, such as ARM TrustZone and Intel SGX, provide users with a trusted, isolated computing environment. However, these technologies are limited by memory and computing power, resulting in low efficiency when processing large-scale neural networks. For example, TrustZone typically has only about 10MB of secure memory, which is insufficient for the resource requirements of deep learning tasks. In conclusion, with the development of mobile and IoT devices, the demand for secure model inference on devices is increasing. How to protect user privacy while ensuring model security has become a crucial problem that urgently needs to be solved in the field of machine learning.

[0059] Based on this, in order to address the issue of limited secure memory on devices such as edge devices while performing secure inference on the device-side, this application provides a convolutional neural network inference method based on a trusted execution environment on the device side, a convolutional neural network inference device based on a trusted execution environment for executing the convolutional neural network inference method based on a trusted execution environment on the device side, a system, an electronic device, a computer-readable storage medium, and a computer program product. According to the characteristics of the neural network model inference process, by leveraging the trusted execution environment provided by hardware, a model secure inference method without precision loss can be achieved. This can protect the privacy of proprietary model weights and inference data, and promote the secure deployment and rapid implementation of artificial intelligence models on wearable mobile devices.

[0060] The following examples will provide a detailed description.

[0061] Based on this, embodiments of this application provide a convolutional neural network inference method based on a device-side trusted execution environment, which can be implemented by a convolutional neural network inference device based on a device-side trusted execution environment. This method executes in a trusted execution environment running on the device side. See [link to relevant documentation]. Figure 1 The convolutional neural network inference method based on a trusted execution environment on the device specifically includes the following:

[0062] Step 100: During the inference process, receive intermediate data of the current target convolutional layer output in the first model of the convolutional neural network in the client application after obfuscation computation; wherein, the first model contains multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any convolutional layer in the first model.

[0063] It is understood that the convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment includes an inference process for inferring a convolutional neural network. In practical applications, it may include one or more inference processes for inferring a convolutional neural network, that is, the convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment can be executed for each different input data to be inferred.

[0064] In one or more embodiments of this application, a Convolutional Neural Network (CNN) is a deep learning model capable of effectively extracting features from data such as images and videos. It simulates the feature extraction capabilities of the human visual system through convolutional operations, demonstrating excellent performance in various visual tasks. The main principle of CNNs is to extract local features from data using convolutional operations. Convolutional layers extract features such as edges and textures from the data layer by layer by applying a set of inferable filters (convolutional kernels), and then combine this with pooling layers for downsampling. The layer-by-layer stacking of features allows CNNs to learn high-level semantic information from low-level features. The convolutional operation possesses characteristics such as translation invariance and local receptive fields, enabling CNNs to perform exceptionally well on spatially structured data such as images.

[0065] Step 200: Correct the intermediate data according to the correction parameters corresponding to the target convolutional layer to obtain the corrected intermediate data corresponding to the target convolutional layer, and determine whether the input data corresponding to the target convolutional layer has been obfuscated. If so, transmit the corrected intermediate data corresponding to the target convolutional layer to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and sends out the output data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, excluding each convolutional layer and the last fully connected layer in the convolutional neural network.

[0066] The intermediate data refers to the input data corresponding to the current target convolutional layer in the first model that the client application inputs to that target convolutional layer. If the target convolutional layer is the first convolutional layer in the first model, then the input data corresponding to the target convolutional layer is local inference data. This inference data is set according to the application scenario of the convolutional neural network. For example, if the convolutional neural network is ultimately used for face recognition, then the inference data uses face image data with labels that represent unique identifiers of individuals. If the target convolutional layer is not the first convolutional layer in the first model, then the input data corresponding to the target convolutional layer is the corrected intermediate data corresponding to the intermediate data output by the previous convolutional layer corresponding to the target convolutional layer.

[0067] Understandably, the Client Application (CA) performs the following: determining whether the target convolutional layer is the last convolutional layer in the first model; if so, the Client Application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and outputs the result data from the second model.

[0068] Alternatively, the convolutional neural network inference device based on the device-side trusted execution environment used to execute the convolutional neural network inference method based on the device-side trusted execution environment can also be implemented using a trusted application (TA). The trusted application and the client application are located on the same device. The client application can be deployed in the rich execution environment (REE) of the device, while the trusted application is deployed in the trusted execution environment (TEE) of the device.

[0069] In step 200, the result data refers to the data output by the second model corresponding to the convolutional neural network after the corrected intermediate data is input into the second model.

[0070] Step 300: Receive the result data sent by the client application, and input the result data into the last fully connected layer in the convolutional neural network that is pre-stored locally, to obtain the inference result data output by the last fully connected layer.

[0071] In one or more embodiments of this application, TrustZone can be used to implement a device-side trusted execution environment and a rich execution environment. TrustZone technology is a hardware architecture designed by ARM for embedded devices, building a security framework to resist various possible attacks. TrustZone technology provides system-level isolation for upper-layer applications by implementing interrupt isolation, isolation of internal RAM and ROM, isolation of external RAM, and isolation of peripherals. It has been applied to billions of processors to protect the security environment and sensitive data of various applications, including authentication, payment, and content protection. TrustZone achieves data and code isolation by dividing the system hardware into a secure world and a normal world, thereby providing both trusted and untrusted operating environments on a single processor. TrustZone's isolation design ensures that even if the operating system or application is attacked, the data in the secure world remains protected.

[0072] In the scenario of the convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment, TrustZone is primarily responsible for the functions of privacy data storage and trusted computation. For example, it utilizes its secure storage function to encrypt and store model weight information and other privacy data; and it utilizes its trusted computation function to perform inference computations and other computations on some layers of the neural network model. Since TrustZone is a trusted execution environment implemented at the hardware level, its security can be fully trusted.

[0073] As can be seen from the above description, the convolutional neural network inference method based on a trusted execution environment on the device side provided in this application embodiment can effectively solve the problem of limited security memory on the device side, such as edge devices, on the basis of hardware-based secure inference of convolutional neural networks. It can perform secure inference of convolutional neural networks on the device side without loss of precision and can effectively protect the privacy information of convolutional neural networks.

[0074] To further improve the inference resource availability and inference effectiveness of the obfuscated first model in the client application, in a convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment, the obfuscated first model in the client application runs in a rich execution environment of the client application, so that the client application inputs the input data corresponding to the current target convolutional layer in the first model into the target convolutional layer in the rich execution environment, so that the target convolutional layer performs convolution operation on the input data based on the obfuscation weights corresponding to the target convolutional layer and outputs the intermediate data corresponding to the target convolutional layer.

[0075] It is understood that the rich execution environment (REE) can also be referred to as a rich execution environment (REE). A rich execution environment refers to the environment in which an operating system runs, capable of running common operating systems such as Android and iOS. The REE is an open environment vulnerable to attacks; therefore, a first model with obfuscated computation is required. Most inference computation is performed in the rich execution environment (REE), while intermediate data (IR) is corrected and a small amount of inference computation is performed within the trusted execution environment (TEE). In one or more embodiments of this application, the first model with obfuscated computation can also be simply referred to as an obfuscated model, and the intermediate data can also be referred to as intermediate results.

[0076] To further and effectively protect the privacy information of convolutional neural networks, in a convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment, see [link to relevant documentation]. Figure 2Step 200 in the convolutional neural network inference method based on a trusted execution environment on the device side specifically includes the following:

[0077] Step 210: Correct the intermediate data according to the correction parameters corresponding to the target convolutional layer to obtain the corrected intermediate data corresponding to the target convolutional layer.

[0078] Step 220: Determine whether the input data corresponding to the target convolutional layer to be acquired has been obfuscated;

[0079] If yes, proceed to step 230; otherwise, proceed to step 240.

[0080] Step 230: The corrected intermediate data corresponding to the target convolutional layer is transmitted to the client application, so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and outputs the result data of the second model. Then, the convolutional neural network inference device based on the trusted execution environment of the device executes step 300. If not, the client application uses the corrected intermediate data corresponding to the target convolutional layer as the input data of the next convolutional layer corresponding to the target convolutional layer, and inputs the input data of the next convolutional layer into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data of the next convolutional layer based on the confusion weights of the next convolutional layer and outputs the intermediate data of the next convolutional layer. Then, the convolutional neural network inference device based on the trusted execution environment of the device executes the following step 310.

[0081] Step 240: Add random noise to the corrected intermediate data corresponding to the target convolutional layer to complete the obfuscation process of the corrected intermediate data, and then execute step 250.

[0082] Understandably, in order to prevent attackers from inferring the values ​​of model weights from the input data and intermediate results (IRs), random noise needs to be added before the IRs are copied to the untrusted ordinary world to hide the true values ​​of the intermediate results.

[0083] Specifically, if the ordinary world receives the input and corrected non-zero intermediate results, an attacker can infer the values ​​of the weights through sufficient queries (solving linear equations). Therefore, non-zero IRs should be protected before being copied to the untrusted ordinary world by the result f(X) of the activation function. l Random noise is added to achieve this. If the input of the (l-1)th layer is not obfuscated, its corrected output X... lThis will add a one-time random value e to the IR. This scheme supports any activation function that can capture non-linear properties and improve the model's accuracy. It will be represented as e. l Random noise is added to the intermediate results. l It is considered confidential data and stored privately in secure storage. The output of the intermediate result protection process is X. l ′=f(X l )+e l This process is only used for convolution operations with unobfuscated input, because if there is only obfuscated input, even if the correct intermediate results are obtained, the weight values ​​cannot be calculated.

[0084] Step 250: Transmit the corrected intermediate data after the obfuscation process to the client application, and then execute step 300 or step 310 below.

[0085] To further improve the execution reliability and effectiveness of convolutional neural network inference methods based on device-side trusted execution environments, in a convolutional neural network inference method based on device-side trusted execution environments provided in this application embodiment, if the client application determines that the target convolutional layer is not the last convolutional layer in the first model, the client application uses the corrected intermediate data corresponding to the target convolutional layer as the input data corresponding to the next convolutional layer corresponding to the target convolutional layer, and inputs the input data corresponding to the next convolutional layer into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data corresponding to the next convolutional layer based on the confusion weights corresponding to the next convolutional layer and outputs the intermediate data corresponding to the next convolutional layer.

[0086] Correspondingly, see Figure 2 After steps 230 and 250, and before step 300, the convolutional neural network inference method based on a trusted execution environment on the device side further includes the following:

[0087] Step 310: During the inference process, receive the intermediate data output from the next convolutional layer corresponding to the target convolutional layer in the first model after obfuscation calculation.

[0088] Step 320: Correct the intermediate data corresponding to the next convolutional layer according to the correction parameters to obtain the corrected intermediate data corresponding to the next convolutional layer, and determine whether the input data corresponding to the next convolutional layer to be acquired has been obfuscated. If yes, transmit the corrected intermediate data corresponding to the next convolutional layer to the client application. If no, add random noise to the corrected intermediate data corresponding to the next convolutional layer to complete the obfuscation of the corrected intermediate data, and transmit the obfuscated intermediate data corresponding to the next convolutional layer to the client application.

[0089] CNN models generally consist of convolutional layers, activation layers, pooling layers, and fully connected layers. Different combinations of these layers can extract multi-level features from the data, making the network suitable for learning and classifying complex patterns. The following is an introduction to the main layers:

[0090] (1) Convolutional layer: Features are extracted from the input data through the sliding window operation of the convolutional kernel. The parameters of the convolutional layer include the size, number, stride, and padding of the convolutional kernel, which determine the effect of feature extraction. The data features extracted by the convolutional kernel form a feature map, which reflects the spatial pattern of the data.

[0091] (1) Normalization layer: After the convolution calculation is completed, the data is usually normalized to convert it into a standard distribution range to ensure the stability of the network.

[0092] (1) Activation layer: The non-linear features of CNNs rely on activation functions such as ReLU, Sigmoid, and Tanh. ReLU is the most commonly used activation function, which improves the inference speed and stability of the model by outputting negative numbers as zero.

[0093] (1) Pooling layer: The pooling layer is used to reduce the dimensionality of the feature map, extract the core features of the data, and reduce computational complexity. Common pooling methods include average pooling and max pooling, which can effectively suppress overfitting.

[0094] (1) Fully connected layer: The fully connected layer maps the features extracted by the previous convolutional layers to the final classification or regression result. The fully connected layer performs a linear combination of all inputs and outputs the final prediction result through an activation function. It is suitable for the output layer of the task.

[0095] When performing model inference on the device, the efficiency of CNNs enables them to perform complex image classification tasks with limited resources.

[0096] Based on this, in order to further improve the execution reliability and effectiveness of the convolutional neural network inference method based on a device-side trusted execution environment, in the convolutional neural network inference method based on a device-side trusted execution environment provided in this application embodiment, the first model and the second model corresponding to the convolutional neural network constitute the first half model M of the convolutional neural network. pre The last fully connected layer of the convolutional neural network constitutes the latter half of the convolutional neural network model M. post Furthermore, the first model after obfuscation calculation is generated in advance based on a preset obfuscation model generation algorithm after obfuscating the first model, and can be written as obfuscated model M. p ′ re Furthermore, the first model after obfuscation calculation contains the obfuscation weights W corresponding to each convolutional layer. l ′ and correction parameter r l , where l represents the l-th convolutional layer.

[0097] The first model and the second model after obfuscation calculation are pre-sent to the client application for storage.

[0098] Correspondingly, see Figure 2 The convolutional neural network inference method based on a trusted execution environment on the device also includes the following content before step 100:

[0099] Step 010: Receive and locally store the correction parameters corresponding to the last fully connected layer in the convolutional neural network and each convolutional layer in the first model after obfuscation calculation.

[0100] From a software perspective, this application also provides a device for executing all or part of the convolutional neural network inference method based on a device-side trusted execution environment, see [link to relevant documentation]. Figure 3 The convolutional neural network inference device based on a trusted execution environment on the device side specifically includes the following:

[0101] The intermediate data receiving module 10 is used to receive intermediate data of the current target convolutional layer output in the first model of the convolutional neural network in the client application after obfuscation calculation during the inference process; wherein, the first model includes multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any convolutional layer in the first model.

[0102] The calibration and data transmission module 20 is used to calibrate the intermediate data according to the calibration parameters corresponding to the target convolutional layer to obtain calibrated intermediate data, and to determine whether the input data corresponding to the target convolutional layer has been obfuscated. If so, the calibrated intermediate data is transmitted to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the calibrated intermediate data into the second model corresponding to the convolutional neural network and sends out the output data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially except for each convolutional layer and the last fully connected layer in the convolutional neural network.

[0103] The hierarchical inference module 30 is used to receive the result data sent by the client application and input the result data into the last fully connected layer in the convolutional neural network that is pre-stored locally to obtain the inference result data output by the last fully connected layer.

[0104] The embodiments of the convolutional neural network inference device based on a device-side trusted execution environment provided in this application can be used to execute the processing flow of the embodiments of the convolutional neural network inference method based on a device-side trusted execution environment in the above embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the embodiments of the convolutional neural network inference method based on a device-side trusted execution environment.

[0105] The convolutional neural network inference portion of the device-based trusted execution environment (TEX) based convolutional neural network inference device can be performed in an edge device. The specific implementation can be chosen based on the processing capabilities of the edge device and the limitations of the user's usage scenario. This application does not impose any limitations on this. If all operations are performed in the edge device, the edge device may further include a processor for the specific processing of the convolutional neural network inference based on the device-based trusted execution environment.

[0106] The aforementioned edge devices may have a communication module (i.e., a communication unit) that can communicate with remote client devices to achieve data transmission between them. The client devices can also communicate with servers, which may include servers on the task scheduling center side, or, in other implementation scenarios, servers on an intermediate platform, such as servers on a third-party server platform that have a communication link with the task scheduling center server. The servers may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0107] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0108] As can be seen from the above description, the convolutional neural network inference device based on a trusted execution environment on the device side provided in this application embodiment can effectively solve the problem of limited security memory on the device side, such as edge devices, based on hardware-based secure inference of convolutional neural networks. It can perform secure inference of convolutional neural networks on the device side without loss of precision and can effectively protect the privacy information of convolutional neural networks.

[0109] Based on the foregoing embodiments, this application also provides a convolutional neural network inference device, see [link to previous document]. Figure 4 The convolutional neural network inference device specifically includes the following components:

[0110] Client applications deployed in rich execution environments and trusted applications deployed in trusted execution environments;

[0111] The trusted application is used to execute the convolutional neural network inference method based on a device-side trusted execution environment provided in the foregoing embodiments. To further improve the memory usage and inference efficiency of the convolutional neural network inference, in one embodiment of the convolutional neural network inference device provided in this application, see... Figure 5 The client application in the convolutional neural network inference device is used to perform the following:

[0112] Step 400: In a rich execution environment, determine whether the target convolutional layer is the last convolutional layer in the first model;

[0113] If yes, proceed to step 500; otherwise, proceed to step 600.

[0114] Step 500: Input the corrected intermediate data into the second model corresponding to the convolutional neural network, and send out the result data output by the second model so that the trusted application can execute step 300.

[0115] Step 600: Use the corrected intermediate data corresponding to the target convolutional layer as the input data of the next convolutional layer corresponding to the target convolutional layer, and input the input data of the next convolutional layer into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data of the next convolutional layer based on the confusion weights of the next convolutional layer and outputs the intermediate data of the next convolutional layer. Send the intermediate data of the next convolutional layer to the trusted application so that the trusted application executes step 310.

[0116] Furthermore, to further improve the effectiveness and reliability of convolutional neural network inference, in one embodiment of the convolutional neural network inference device provided in this application, see [link to relevant documentation]. Figure 5 Prior to step 400, the client application in the convolutional neural network inference device is also used to perform the following:

[0117] Step 020: Receive and locally store the first model and the second model after obfuscation computation in a rich execution environment.

[0118] To further illustrate the above embodiments, this application also provides a convolutional neural network inference method that uses TrustZone as a trusted execution environment and a rich execution environment on the device side, namely, a device-side model secure inference method based on TrustZone. See [link to relevant documentation]. Figure 6 The TrustZone-based device-side model security reasoning method is divided into three stages: preparation stage, initialization stage, and reasoning stage.

[0119] 1. Preparation phase: Divide the neural network model to obtain the first half of the indirect security reasoning model M. pre And the second half of the model M of direct security reasoning post Then, by using a scrambling model generation algorithm, model M is obtained. pre Obfuscated version model M p ′ re .

[0120] Specifically, the original model that yields good reasoning is first divided into two parts, resulting in the first half model M. pre and the second half of the model M post Next, the confusion model generation algorithm proposed in the application example of this application is used to obtain model M. pre Obfuscated version model M p ′ re .

[0121] 2. Initialization Phase: Next, model M will be... p ′ re and model M postThey are deployed in both the normal world and the secure world, while securely storing privacy data.

[0122] Specifically, a runtime environment is built on the local device. First, the service provider provides the code for the Client Application (CA) and the Trusted Application (TA), which includes the basic environment required to run the model; then the obfuscation model M is... p ′ re And the latter half of the model M post Except for the last fully connected layer, all other layers in the application are deployed in the normal world. To ensure the secure loading and operation of the application on edge devices, the secure world hashes and signs the initial state of the application and sends this signature back to the service provider to ensure trusted operation. After authentication, the service provider sends the second half of the model M to the secure world. post The last fully connected layer in the process provides correction parameters for intermediate result correction.

[0123] 3. Inference Phase: The user initiates an inference request, M p ′ re The model begins inference and sends the inference results to the model M in the safe world via shared memory. post Continue execution; finally, filter the inference results and return them to the user for viewing.

[0124] Specifically, the user provides input and receives inference results. First, the user passes the input data to a client application on an edge device; the client application interacts with a trusted application, through a confusion model M. p ′ re Reasoning and correction, model M post The system performs inference and result filtering to complete secure model inference; finally, the client application feeds back the inference results to the user.

[0125] This method enables users to perform secure model inference on the device without precision loss, effectively protecting the model's privacy. The specific implementation process of the TrustZone-based device-side secure model inference method is as follows: Figure 7 As shown.

[0126] The TrustZone-based device-side model-secure inference method performs most of the inference computation in an enriched execution environment (REE), and corrects intermediate results (IR) and performs a small amount of inference computation in a trusted execution environment (TEE). The structure diagram of the model-secure inference process is shown below. Figure 8As shown, the model secure inference process consists of four parts: I) Denoising the IR using the correction parameter r. II) Hiding the true intermediate results with random noise e. III) Denoising the IR using r and e. IV) Model partitioning execution. The obfuscated model weights W′ are stored in untrusted storage, while only r, e, and pre-computed u are stored in secure storage. The first three parts can be summarized as obfuscated model inference and correction.

[0127] Starting from user-requested model inference, and through a model-safe inference system, the complete inference operation process is implemented as follows: Figure 9 As shown in the diagram, the process involves the CA on the REE side initiating a model inference request and reading files from the file system to prepare for model inference, including loading input data and the obfuscated model. Next, obfuscated model inference and correction are performed, with most computation done on the REE side and intermediate result correction only through the TEE. This effectively reduces the computational load on the TEE side and alleviates the need for secure memory. After the convolutional layers with obfuscated weights are executed, the subsequent unobfuscated pooling layers and fully connected layers are executed in a partitioned manner, deployed on the REE and TEE respectively. Specifically, the first few layers are executed on the resource-rich REE, while only the last layer of the model is executed in the TEE. After all layers of the model have been executed, the inference results are filtered using the topK method, and a portion of the inference results is returned to the REE side for user viewing.

[0128] In summary, this application presents a device-side model secure inference method and apparatus based on TrustZone, which effectively protects the privacy information of the model. The main work is as follows: (1) Protecting the weight information of the neural network model: protecting the confidentiality of the proprietary model by generating a confusing model. (2) Optimizing performance: optimizing performance by minimizing the model inference computation running in the secure world on the edge device.

[0129] Specifically, the core technical content of the application examples in this application is described in the following order:

[0130] (1) Neural network model division

[0131] Because deep neural networks follow a hierarchical architecture, the neural network model can be divided. In this method, the deep neural network model is divided into two parts, with the first fully connected layer as the first part. partition Using the dividing points, we obtain the first half of the model M. pre and the second half of the model M post Model M pre Operations such as convolution, activation, and pooling are performed, encompassing most of the computation in the inference process; Model M post Perform calculations for the fully connected layer.

[0132] By partitioning neural network models, model inference can be performed more flexibly, making full use of the computing resources on the device while ensuring security.

[0133] (2) Generation of the confusion model

[0134] A perplexed version generation algorithm for neural network models is proposed to optimize the performance of secure inference and improve memory efficiency. To prevent users from recovering the neural network model or illegally reselling the inference service, the perplexed model needs to meet the following three objectives: (1) the input prediction results change significantly; (2) the constructed perplexed parameters are difficult to identify;

[0135] This method focuses on the weights of convolutional layers because over 90% of the computation in a CNN model comes from convolution operations. Experiments show that even modifying only a portion of the weights in convolutional layers can drastically reduce the model's accuracy to an unacceptable level. Furthermore, while adding noise to the weights of fully connected layers is possible, the sheer number of weights in fully connected layers results in a significantly higher computational cost, and using noise correction schemes may impact the real-time performance of inference.

[0136] To address the memory and computational performance limitations of the secure world, this method prioritizes modifying key weights that contribute significantly to the model. This approach is inspired by pruning methods in model compression, where small-norm filters are proposed to contribute less to model performance. Therefore, to significantly reduce the inference accuracy of the obfuscated model, weights that would almost never be removed in pruning methods should be modified first. Considering the limited secure memory and inference efficiency requirements, this method chooses to modify only a small subset of the larger weights, rather than all of them. Experiments demonstrate that even modifying only a portion of the weights significantly alters the predicted labels of the input. To achieve the second security objective (i.e., making the obfuscated weights difficult to identify), the obfuscated weights need to be carefully designed. Specifically, given an obfuscated model, it should be difficult for an attacker to infer which weights are "encrypted" or "unencrypted."

[0137] The proportion of processed filter weights is set to p%. To make these carefully designed weights difficult to identify, the processed p% of weights should be consistent with the distribution of the remaining 1-p% of weights in the same convolutional kernel. The process of generating the obfuscated model is described in detail in Algorithm 1 as shown in Table 1. The algorithm involves the noise amplification factor k, the number of convolutional layers L in the first half of the model, the original weights W of the model, and the weights W1,…,W of each convolutional layer from layer 1 to layer L in the model. L and the subset W with a larger weight top .

[0138] Table 1

[0139]

[0140]

[0141] Based on the average weight m and standard deviation s of the 1-p% portion of these convolutional kernel weights, random noise η = N(m, k·s) is generated layer by layer from the normal distribution. 2 ), where k is the noise amplification factor, and the original weights w i Replace with w i ′=-w i +η i This ensures that the weights follow a similar distribution, but at the same time makes the inference performance of the confusion model worse.

[0142] This paper proposes a weight modification scheme that combines sign reversal and noise perturbation to significantly reduce the inference performance of convolutional neural networks while maintaining their ∈-indistinguishability. The noise amplification factor k is a crucial parameter, controlling the magnitude of the noise variance and thus determining the extent of the modification's impact on the weights. A reasonable k value should ensure a significant decrease in model performance without a substantial deviation from the original weight distribution.

[0143] (3) Confusion model reasoning and correction

[0144] To alleviate computational burden in the secure world and optimize inference performance, this method offloads most convolutional operations and fully connected layer computations to the ordinary world (enriched execution environment). Furthermore, to prevent attackers from inferring model weight values ​​using input data and intermediate results (IRs), random noise is added before replicating the IRs to the untrusted ordinary world to hide the true values ​​of the intermediate results. A three-stage correction framework is introduced below, which effectively protects the inference process and corrects prediction results.

[0145] In the first stage, for unobfuscated input data, intermediate result correction is performed using the correction parameter r stored in secure memory. In the second stage, when the input data is unobfuscated, a one-time random value e is added to the intermediate result IR to hide the true values ​​of the weights, giving it sufficient uncertainty to prevent attackers from inferring the weights through the IR. In the third stage, for obfuscated IR, denoising correction is performed using e and a pre-computed u.

[0146] Taking a CNN with two convolutional layers as an example ( Figure 8In this approach, convolutional computations are performed in the normal world (Rich Execution Environment, REE), while intermediate result correction is completed in the secure world (Trusted Execution Environment, TEE). Through the interaction between the two, secure inference of the model is achieved. This method can be extended to any CNN model architecture; even fully connected layers can employ similar noise addition and correction strategies. By adding random noise during the inference phase and correcting it when necessary, the true model weights are effectively hidden while ensuring the accuracy of model inference. Even if an attacker obtains the intermediate results, the presence of random noise prevents them from inferring the model weights, thus ensuring the security of inference. This method ensures both efficiency and security in inference; even in environments with limited memory and computational resources, TrustZone's security mechanism still guarantees data privacy and model integrity. The secure inference correction scheme will be described in detail below.

[0147] Intermediate result correction (Phase 1). Only when the model weights are obfuscated is the obfuscated weight W constructed by the client application in the normal world. l '=W l +r l and the input X of the lth layer l Perform convolution operations between them to obtain a confused output result Y. l =X l ·(W l +r l )+bias l And IR is corrected within a safe world. The original input X... l and confusion result Y l 'Transmit to the safe world, then use the correction parameter r' l Perform correction to obtain the correction result X. l+1 =Y l '-X l ·r l =X l ·(W l +r l )+bias l -X l ·r l =X l ·W l +bias l .

[0148] Intermediate Result Protection (Second Phase). If the ordinary world receives the input and corrected non-zero intermediate results, an attacker can infer the values ​​of the weights through sufficient queries (solving linear equations). Therefore, the non-zero IR should be protected before being copied to the untrusted ordinary world by the result f(X) of the activation function. lRandom noise is added to achieve this. If the input of the (l-1)th layer is not obfuscated, its corrected output X... l This will add a one-time random value e to the IR. This scheme supports any activation function that can capture non-linear properties and improve the model's accuracy. It will be represented as e. l Random noise is added to the intermediate results. l It is considered confidential data and stored privately in secure storage. The output of the intermediate result protection process is X′. l =f(X) l )+e l This process is only used for convolution operations with unobfuscated input, because if there is only obfuscated input, even if the correct intermediate results are obtained, the weight values ​​cannot be calculated.

[0149] Intermediate result correction (third stage). When both weights and inputs are obfuscated, the client application constructs obfuscated weights W in the normal world. l ′=W l +r l and the input X′ of the lth layer l =(X l +e l Perform convolution operations between the two sides to obtain the confused output result Y. l '=X' l ·W l +bias l =(X l +e l )·(W l +r l )+bias l And correct the IR within a safe world. Obfuscate the input X′ l and confusion result Y l 'Transmit to the safe world, then use the correction parameter r' l and e l After correction, the result X is obtained. l+1 =X l ·W l +bias l =(X l +e l )·(W l +r l )+bias l -e l ·(W l +r l )-(X l +e l -e l )·r l =Y l '-ul -(X′ l -e l )·r l , where u l =e l ·(W l +r l Due to u l The calculation of u is independent of the input data, therefore u can be pre-calculated. l To save calibration time within the safe world.

[0150] The aforementioned inference correction process continues until no more obfuscated weights or inputs are involved. The remaining computations (such as fully connected layers) will be performed through model partitioning, fully utilizing the resources of the rich execution environment to safely and efficiently complete the remaining inference process.

[0151] (4) Model partitioning execution

[0152] Different layers of a model retain different amounts of input data. Research shows that features from earlier layers closer to the input have stronger transferability on new datasets, while features from later layers are more task-specific. This means that earlier layers can capture more general information (such as ambient tones in an image), while later layers retain more refined task-specific features (such as facial features). Therefore, when a model is accessed by an untrusted third party, the information retained in the model's memory could be used to infer sensitive features in the data, leading to privacy risks.

[0153] Placing the last few layers of a neural network model in a TEE (Transparent Environment Execution Environment) for inference can effectively prevent MIA (Multi-Input Multiple-Output) attacks because the last layer has a higher probability of leaking private information about the inference data. Therefore, placing the last few layers of the model in a TEE can effectively prevent MIA attacks. post Perform partitioned execution. Without loss of generality, the model's layer... first layer to the first layer partition -1 layer performs obfuscated model inference in the REE and intermediate result correction in the TEE. CA in the REE runs the layer-1. partition layer to the first layer last -1 layer, the TA located in the TEE runs the last layer during inference. last .

[0154] Execution model M by partitioning post This ensures security while making fuller use of the device's computing resources.

[0155] (5) Filter and return the results

[0156] After completing calculations for all layers, the TA performs top-k filtering on the output of the last layer to control the returned data, mitigate MIA attacks, and further prevent the leakage of member information. The filtered prediction results are returned to the CA via shared memory as the final output for users to view.

[0157] In other words, this application proposes a method for secure model inference in mobile and IoT devices. This method deploys neural network models on edge devices (such as smartwatches and wristbands) that support TrustZone technology, ensuring that user privacy data does not leave the device's local storage while leveraging secure hardware on the device to fully protect the service provider's proprietary models. Through the isolated environment and secure storage provided by TrustZone, the model's private weights are protected, preventing leakage to untrusted device users and thus safeguarding the model owner's intellectual property. Furthermore, by introducing a model partitioning strategy, member inference attacks (MIA) can be effectively prevented, further enhancing the privacy and security of model inference data. This application focuses on the inference of convolutional neural network (CNN) models, a commonly used model type in many mainstream machine learning tasks.

[0158] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the convolutional neural network inference method based on a device-side trusted execution environment mentioned in the above embodiments. The processor and the memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and the memory via wired or wireless means.

[0159] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0160] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the convolutional neural network inference method based on a device-side trusted execution environment in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the convolutional neural network inference method based on a device-side trusted execution environment in the above method embodiments.

[0161] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0162] The one or more modules are stored in the memory, and when executed by the processor, the convolutional neural network inference method based on the device-side trusted execution environment in the embodiment is executed.

[0163] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0164] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0165] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0166] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned convolutional neural network inference method based on a device-side trusted execution environment. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0167] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the aforementioned convolutional neural network inference method based on a device-side trusted execution environment.

[0168] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0169] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0170] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0171] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for convolutional neural network inference based on a device-end trusted execution environment, characterized in that, This method is executed in a trusted execution environment running on the device, and the method includes: During the inference process, intermediate data is received from the current target convolutional layer output in the first model of the convolutional neural network, which is obfuscated and computed in the client application; wherein, the first model contains multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any one of the convolutional layers in the first model. The intermediate data is corrected according to the correction parameters corresponding to the target convolutional layer to obtain the corrected intermediate data corresponding to the target convolutional layer. It is then determined whether the input data corresponding to the target convolutional layer has been obfuscated. If so, the corrected intermediate data corresponding to the target convolutional layer is transmitted to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the corrected intermediate data into the second model corresponding to the convolutional neural network and outputs the result data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, excluding each convolutional layer and the last fully connected layer in the convolutional neural network. The system receives the result data sent by the client application and inputs the result data into the last fully connected layer of the convolutional neural network that is pre-stored locally to obtain the inference result data output by the last fully connected layer. The first model, after obfuscation computation, runs in the rich execution environment of the client application, so that the client application inputs the input data corresponding to the current target convolutional layer in the first model into the target convolutional layer in the rich execution environment, so that the target convolutional layer performs convolution operation on the input data based on the obfuscation weights corresponding to the target convolutional layer and outputs the intermediate data corresponding to the target convolutional layer.

2. The method of claim 1, wherein the method is performed by a device-side trusted execution environment. Also includes: If it is determined that the input data corresponding to the target convolutional layer to be acquired has not been obfuscated, random noise is added to the corrected intermediate data corresponding to the target convolutional layer to complete the obfuscation of the corrected intermediate data. The corrected intermediate data, after being obfuscated, is transmitted to the client application.

3. The convolutional neural network inference method based on a device-side trusted execution environment according to claim 1, characterized in that, If the client application determines that the target convolutional layer is not the last convolutional layer in the first model, then the client application uses the corrected intermediate data corresponding to the target convolutional layer as the input data corresponding to the next convolutional layer corresponding to the target convolutional layer, and inputs the input data corresponding to the next convolutional layer into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data corresponding to the next convolutional layer based on the confusion weights corresponding to the next convolutional layer and outputs the intermediate data corresponding to the next convolutional layer. Correspondingly, after transmitting the corrected intermediate data corresponding to the target convolutional layer to the client application, and before receiving the result data sent by the client application, the method further includes: During the inference process, intermediate data is received from the next convolutional layer corresponding to the target convolutional layer in the first model after obfuscation calculation. The intermediate data corresponding to the next convolutional layer is corrected according to the correction parameters of the next convolutional layer to obtain the corrected intermediate data corresponding to the next convolutional layer. It is then determined whether the input data corresponding to the next convolutional layer to be acquired has been obfuscated. If so, the corrected intermediate data corresponding to the next convolutional layer is transmitted to the client application.

4. The convolutional neural network inference method based on a device-side trusted execution environment according to claim 1, characterized in that, The first model and the second model corresponding to the convolutional neural network constitute the first half of the convolutional neural network model, and the last fully connected layer corresponding to the convolutional neural network constitutes the second half of the convolutional neural network model; and the first model after obfuscation calculation is generated in advance by performing obfuscation calculation on the first model based on a preset obfuscation model generation algorithm, and the first model after obfuscation calculation contains the obfuscation weights and correction parameters corresponding to each convolutional layer. The first model and the second model after obfuscation calculation are pre-sent to the client application for storage.

5. The convolutional neural network inference method based on a device-side trusted execution environment according to claim 4, characterized in that, Before receiving intermediate data of the current target convolutional layer output in the first model corresponding to the obfuscated computation in the client application during the inference process, the method further includes: Receive and locally store the correction parameters corresponding to the last fully connected layer in the convolutional neural network and each convolutional layer in the first model after obfuscation calculation.

6. A convolutional neural network inference device based on a device-side trusted execution environment, characterized in that, The device is set up in a trusted execution environment running on the device side, including: An intermediate data receiving module is used to receive intermediate data output by the current target convolutional layer in the first model of the convolutional neural network in the client application after obfuscation calculation during the inference process; wherein, the first model includes multiple convolutional layers connected in sequence in the convolutional neural network, and the target convolutional layer represents any convolutional layer in the first model. The calibration and data transmission module is used to calibrate the intermediate data according to the calibration parameters corresponding to the target convolutional layer to obtain calibrated intermediate data, and to determine whether the input data corresponding to the target convolutional layer has been obfuscated. If so, the calibrated intermediate data is transmitted to the client application so that the client application can determine whether the target convolutional layer is the last convolutional layer in the first model. If so, the client application inputs the calibrated intermediate data into the second model corresponding to the convolutional neural network and sends out the output data of the second model. The second model corresponding to the convolutional neural network includes pooling layers and multiple fully connected layers connected sequentially, except for each convolutional layer and the last fully connected layer in the convolutional neural network. The hierarchical inference module is used to receive the result data sent by the client application and input the result data into the last fully connected layer of the convolutional neural network that is pre-stored locally to obtain the inference result data output by the last fully connected layer. The first model, after obfuscation computation, runs in the rich execution environment of the client application, so that the client application inputs the input data corresponding to the current target convolutional layer in the first model into the target convolutional layer in the rich execution environment, so that the target convolutional layer performs convolution operation on the input data based on the obfuscation weights corresponding to the target convolutional layer and outputs the intermediate data corresponding to the target convolutional layer.

7. A convolutional neural network inference device, characterized in that, include: Client applications deployed in rich execution environments and trusted applications deployed in trusted execution environments; The trusted application is used to execute the convolutional neural network inference method based on a device-side trusted execution environment as described in any one of claims 1 to 5.

8. The convolutional neural network inference device according to claim 7, characterized in that, The client application is used to perform the following: In a rich execution environment, determine whether the target convolutional layer is the last convolutional layer in the first model; If so, the corrected intermediate data is input into the second model corresponding to the convolutional neural network, and the result data output by the second model is emitted. If not, the corrected intermediate data corresponding to the target convolutional layer is used as the input data of the next convolutional layer corresponding to the target convolutional layer, and the input data of the next convolutional layer is input into the next convolutional layer, so that the next convolutional layer performs convolution operation on the input data of the next convolutional layer based on the confusion weights of the next convolutional layer and outputs the intermediate data of the next convolutional layer, and sends the intermediate data of the next convolutional layer to the trusted application.

9. The convolutional neural network inference device according to claim 8, characterized in that, Before determining whether the target convolutional layer is the last convolutional layer in the first model within the rich execution environment, the client application also performs the following: Receive and locally store the first model and the second model after obfuscation computation in a rich execution environment.

Images