Reverse confusion resisting method and system for deep learning model of end-side equipment

Abstract

The invention relates to an anti-reverse confusion method and system for an end-side equipment deep learning model, and the core process comprises the steps: firstly inputting an original model obtained through the training of a model training frame into a deep learning compiling frame, and extracting three types of key information, namely, a model operator, a topological structure, parameters and dimensions, through the characteristics of a compiler; then constructing a feature analysis module to evaluate model features, dynamically matching a confusion scheme from a strategy library, and balancing safety and performance; the confusion module is embedded into a plurality of different levels such as a computational graph level, an operator template level and tensor intermediate expression through a hierarchical compiling mechanism, and a complex scheme can be jointly implemented across multiple levels; and finally, the compiler synchronously completes confusion reinforcement when generating the target code. According to the method, hardware adaptation is not needed, low-overhead confusion is achieved through a native pass mechanism of a compiler, fine-grained customized protection is supported, a model structure, parameters and computational logic can be effectively hidden, reverse engineering attacks can be resisted, and the method is particularly suitable for end-side equipment scenes with limited computing power.

Description

Technical Field

[0001] The present invention relates to the fields of artificial intelligence security and software obfuscation, and particularly to an anti-reverse obfuscation method and system for deep learning models for end-side devices. Background Art

[0002] Deep learning models have become core components in many technical fields, from cloud computing services to Internet of Things (IoT) applications. As a result, there are increasingly high requirements for the application of deep learning in real-world scenarios, which has led to the widespread deployment of deep learning models on various computing platforms, from cloud servers to IoT embedded devices. Currently, an efficient and scalable solution for model deployment on edge devices such as IoT is to use a deep learning compiler, which can manage and optimize complex deployment processes on multiple platforms and compile high-level model specifications into binary code that can be directly run on target hardware. The model binary code downloaded to the target device is vulnerable to model extraction attacks based on reverse engineering. Therefore, there are still a series of challenges in protecting the security and usability of deep models in the model deployment link on the end side. First, due to the wide distribution and heterogeneous characteristics of end-side devices, designing a general heterogeneous protection scheme is a major challenge. Second, due to the unique computational graph structure and operation characteristics of deep learning models, the obfuscation scheme needs to specifically obfuscate the corresponding internal information of the model and hide potential information exposure points. In addition, due to the structural differences of compilers, the obfuscation framework needs to adapt to the internal characteristics of the current deep learning compiler on the basis of migrating traditional software obfuscation schemes. Finally, at the current stage, the computing resources and storage resources in end-side devices are generally limited. It is of great significance to implement an obfuscation framework that effectively utilizes the underlying hardware characteristics for task inference while performing low-overhead model protection.

[0003] The Chinese patent application CN202311491994.7 filed by Alipay Laboratory provides a model protection method, which includes: a model production device obtains a model file and a model application program corresponding to the model file, obtains the meta-information of the model file and the usage constraint conditions for the model file, generates a digital certificate for the model file based on the meta-information and the usage constraint conditions, sends the model file, the model application program, and the digital certificate to a model usage device, the model usage device loads the model file using the model application program to obtain a model prediction application program, and if the model parameters input by the user meet the usage constraint conditions in the digital certificate, then uses the model prediction application program to perform model prediction processing on the model parameters to obtain a model prediction result.

[0004] The Chinese invention patent application CN202311309725.4 by Zhejiang University provides a method and system for protecting edge - side models based on an authorization verification mechanism. In this invention method, an authorization and authentication layer is designed for the input feature map of the selected convolution kernel to protect the model. The existence of the verification layer in the network makes it impossible for unauthorized feature maps to enable the normal operation of the network, and the accuracy of the network will degrade significantly, which serves the purpose of protecting the model. At the same time, the authorized feature maps can obtain the original feature map through the operation of the verification layer, which ensures the normal use of the network. In addition, to enable the smooth deployment of the method, the invention method also discloses a system for implementing the edge - side model protection method, which largely guarantees the structure and parameters of the edge - side model.

[0005] In the method of the above - mentioned publicly - patented technology, the former generates a digital certificate according to the model file meta - information, and the scheme of decrypting the model file and performing constraint verification in the trusted execution environment during the inference stage only considers some hardware devices with a trusted execution environment, and introducing the trusted execution environment will greatly increase the inference overhead. Although it ensures high security, it is neither lightweight nor general. The latter only performs authorization verification on the convolution kernel and needs to embed the verification layer into the edge - side device, which means that different embedding schemes need to be designed for different edge - side devices in this invention, and it is difficult to protect other key model information, such as other model operators, model parameters, and model topologies. In the edge - device scenario, we want to implement a lightweight and general obfuscation scheme based on a deep - learning compiler. It can take models from different model - training frameworks as inputs and perform different - level obfuscations on key information such as the parameters, dimensions, and topologies of the models according to the enabled obfuscation options. The obfuscated model will inherit the general hardware inference characteristics of the deep - learning compiler and more difficult - to - extract key information. Summary of the Invention

[0006] To overcome the defects of the existing model - protection schemes for end - side deployment in the prior art, the present invention proposes an anti - reverse - engineering obfuscation method and system for deep - learning models for end - side devices.

[0007] The present invention migrates multiple software obfuscation schemes to the deep - learning compiler, and realizes the generality of model obfuscation on multiple end - side heterogeneous devices and the compatibility with multiple model - training frameworks through the compilation characteristics of the deep - learning compiler. This scheme will make full use of the existing optimization strategies and search spaces of the deep - learning compiler to ensure that the obfuscated model will have the same inference results as the original model, lower inference overhead, and sufficient performance tuning for the target device.

[0008] The technical solution of the method of the present invention is an anti - reverse - engineering obfuscation method for deep - learning models for end - side devices, including the following steps:

[0009] Step 1: Obtain the original deep neural network model trained via deep learning training frameworks such as TensorFlow and PyTorch, and use it as the input of the deep learning compilation framework. Utilize the compiler features to obtain three types of key information of the model;

[0010] Step 2: Construct a feature analysis module to evaluate the model characteristics, and select a suitable obfuscation module in the obfuscation strategy search space to achieve the best balance between security and performance;

[0011] Step 3: Design exclusive obfuscation algorithms according to the three types of key information of the obfuscation strategy, and encapsulate them into independent obfuscation modules;

[0012] Step 4: Layer the compilation process of the deep learning compiler from top to bottom to obtain multiple levels such as the high-level model expression related to the computational graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation;

[0013] Step 5: Bind different obfuscation schemes to multiple levels of the high-level model expression related to the computational graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation. For complex obfuscation schemes, split and bind them to multiple levels;

[0014] Step 6: Construct pass insertion modules at different levels based on the bound levels to insert multiple obfuscation modules;

[0015] Step 7: The compiler calls the corresponding obfuscation module implementation, and the original model is obfuscated at different compilation levels while applying compilation optimizations.

[0016] Preferably, the three types of key information described in Step 1 are defined as follows:

[0017] Model operators, topological structure, parameters, and dimensions.

[0018] Preferably, the specific process of constructing the feature analysis module to evaluate the model characteristics and select a suitable obfuscation strategy in the search space described in Step 2 is as follows:

[0019] Model operator analysis: The feature analysis module extracts and analyzes the static and dynamic characteristics of the operators in the model, evaluates their complexity, dependencies, and computational costs during execution, identifies the operators that are most easily reverse-extracted, and thus decides whether to apply obfuscation strategies such as random renaming and false control flow insertion to modify the operator structure, thereby achieving operator obfuscation;

[0020] Topological structure analysis: Traverse the computational graph of the model, evaluate the dependencies between its nodes and edges, identify possible attack paths based on the complete topological structure of the extracted model, and decide whether to disrupt the dependencies of the model through topological structure obfuscation;

[0021] Parameter and dimension analysis: By analyzing the dimensional relationships of each layer in the model, evaluate the complexity and extractability of the model, and thus extract the parameter dimensions of the model;

[0022] Especially for attacks based on symbolic execution, analyze the patterns of dimension information to identify the parts that are easily derivable, and then decide the memory access patterns to be modified, and finally apply different parameter dimension obfuscations to increase the complexity;

[0023] Through comprehensive analysis of the key information of the deep learning model and the specific requirements of the hardware platform, the feature analysis module can intelligently evaluate potential reverse engineering attack paths, automatically select and apply the most suitable obfuscation module, so that the system can maximize the obfuscation effect without sacrificing performance, thus providing customized security protection for different types of deep learning models;

[0024] The appropriate obfuscation module selected in the obfuscation strategy search space described in step 2 is specifically described as follows: Through comprehensive analysis of the key information of the deep learning model and the specific requirements of the hardware platform, the feature analysis module can intelligently evaluate potential reverse engineering attack paths, automatically select and apply the most suitable obfuscation module, so that the system can maximize the obfuscation effect without sacrificing performance, thus providing customized security protection for different types of deep learning models;

[0025] Preferably, step 3 is specifically as follows:

[0026] For possible model extraction attacks based on reverse engineering, such as operator extraction by constructing templates to identify operators, model topological structure extraction by Hook function call points, constructing symbolic execution and taint analysis to extract model parameters and dimensions, etc., conduct one-by-one analysis and obfuscation, including:

[0027] Operator obfuscation based on random renaming, operator obfuscation based on false control flow insertion, topological structure obfuscation based on the computational graph, dimension obfuscation based on layer widening, dimension obfuscation based on splitting loop variables, parameter memory access obfuscation based on random shuffling;

[0028] The operator obfuscation based on random renaming is:

[0029] Randomly rename the key function names in the generated binary of the target platform, which can greatly reduce the operator information exposed by the operator names, specifically as follows:

[0030] To add a target code obfuscation pass during the target code generation phase, locate the entry of the target code function converted from the TIR function primitive, obtain the name and attributes of the key operator function, and replace the name and attributes in the original TIR function primitive with randomly generated new function names;

[0031] The operator obfuscation based on inserting false control flow is as follows:

[0032] Adding false control flow to the instructions inside the operator can obscure the instruction sequence characteristics of the operator, specifically as follows:

[0033] According to the internal characteristics of the operator obtained at the TIR layer, dynamically construct an opaque predicate that is always true. Construct complementary atomic operations based on the computational primitive of the operator to be obfuscated. Use the always-true opaque predicate as the conditional branch and the complementary atomic operations as the branch body to construct false control flow, and finally insert the newly generated false control flow into the TVM TIR;

[0034] The topological structure obfuscation based on the computational graph is as follows:

[0035] Adding additional memory accesses to the inputs of the operator based on the computational graph can obscure the address passing information of the model and hide the true operator connection relationship, specifically as follows:

[0036] Traverse each operator node on the static computational graph of the model and record all the outputs of the previous nodes when traversing to the current operator node, that is, perform topological sorting. Randomly select the operator nodes that need to add additional memory accesses, and randomly select one or more from the set of previous node outputs and add them to the input tensor attributes of the operator to be obfuscated;

[0037] The dimension obfuscation based on layer widening is as follows:

[0038] Randomly widening the output channels of specific operators can hide the true operator information and cause mismatches in the extracted information, specifically as follows:

[0039] Select the linear layer or convolutional layer operator to be widened, extract the dimension and parameter information of the original operator, and accordingly apply the widening algorithm to copy the output channels based on the widening factor to create a new operator; perform new operations using the widened weights, and finally crop the channels of the output results to ensure result consistency;

[0040] The dimension obfuscation based on splitting loop variables is as follows:

[0041] The model after splitting loop variables will have more nested loop structures, and the non-fixed splitting algorithm will prevent fixed pattern matching, specifically as follows:

[0042] Locate the original operator execution instruction nested loop based on the loop variable, and then randomly split the original loop to generate sub-loops until the configuration requirements are met. Then, randomly arrange the split sub-loops, combine the out-of-order sub-loops into a new execution sequence and return it;

[0043] The parameter access obfuscation based on random shuffling is:

[0044] Shuffling parameters for storage prevents parameter extraction that relies on sequential patterns and prevents restoration of the original memory layout through pattern matching, as follows:

[0045] A shuffling algorithm is applied to generate a shuffled random tensor sequence index for the penultimate dimension of the parameter, the actual storage space of the parameter is disrupted according to the memory access index, the tensor index is retained as the basis for subsequent memory access calculations, and the memory access calculator is improved to access the original data when performing operations based on the memory access index.

[0046] Preferably, the binding is performed as described in step 5, specifically as follows:

[0047] The obfuscation module that interferes with the topology of the model or confuses the model dependencies will be bound to the high-level expression level of the computational graph, based on the topological structure obfuscation module of the computational graph;

[0048] The obfuscation modules that modify the dimensions or parameters of the model will be bound to the operator tensor template hierarchy, such as the dimension obfuscation module based on layer widening and the parameter access obfuscation module based on random shuffling;

[0049] Obfuscation modules that adjust the model execution process or loop structure will be bound to the underlying tensor intermediate expression level, such as the dimension obfuscation module based on splitting loop variables;

[0050] Obfuscation modules that interfere with function call points or control flows in the target code will be bound to the target code generation layer, such as operator obfuscation modules based on random renaming and operator obfuscation modules based on false control flow insertion;

[0051] Preferably, each obfuscation pass in step 6 is described in detail as follows:

[0052] Advanced obfuscation pass: supports the insertion of obfuscation modules at the high-level expression level of the model related to the computational graph;

[0053] Intermediate obfuscation pass: supports the insertion of obfuscation modules related to the operator tensor template level;

[0054] Low-level obfuscation pass: supports the insertion of obfuscation modules related to the intermediate representation level of underlying tensors;

[0055] Target code obfuscation pass: Support the insertion of obfuscation modules related to the target code generation level;

[0056] The four obfuscation passes mentioned in step 6 are only for the display of the six feasible obfuscation modules mentioned in step 3 of this embodiment. In the specific implementation process, there are more software obfuscation schemes and more passes constructed according to the different functions of the obfuscation modules;

[0057] The technical solution of the system of the present invention is an anti-reverse obfuscation system for deep learning models on end-side devices, including:

[0058] Key information acquisition module, used to obtain the original deep neural network model trained by deep learning training frameworks such as TensorFlow and PyTorch, and use it as the input of the deep learning compilation framework, and obtain three types of key information of the model by using compiler features;

[0059] Model feature evaluation module, used to build a feature analysis module to evaluate the model features, and select appropriate obfuscation modules in the obfuscation strategy search space to achieve the best balance between security and performance;

[0060] Obfuscation module encapsulation module, used to design exclusive obfuscation algorithms according to the three types of key information of the obfuscation strategy, and encapsulate them into independent obfuscation modules;

[0061] Hierarchy generation module, used to layer the compilation process of the deep learning compiler from top to bottom to obtain various levels related to the computational graph, such as the high-level expression of the model, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation;

[0062] Multiple-level binding module, used to bind different obfuscation schemes to various levels related to the computational graph, such as the high-level expression of the model, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation. For complex obfuscation schemes, they are split and bound to multiple levels;

[0063] Insertion module, used to build pass insertion modules at different levels based on the bound levels to insert various obfuscation modules;

[0064] Model obfuscation module, used to implement by the compiler calling the corresponding obfuscation module, and the original model is obfuscated at different compilation levels while applying compilation optimization.

[0065] The advantages of the present invention are:

[0066] According to the anti-reverse obfuscation method of the end-side device deep learning model of the present invention, due to the use of the obfuscation scheme based on the deep learning compiler, it has multiple advantages such as low overhead and no dependence on specific hardware support compared with the prior art. At the same time, due to the design independence of each obfuscation module, a certain scheduling strategy can be specified to combine multiple obfuscation schemes to achieve more customized obfuscation. Therefore, the present invention can quickly realize custom obfuscation on a wider range of hardware devices, help achieve security reinforcement at different levels of the model, effectively hide possible information exposure points, resist extraction attacks based on reverse engineering, and thus improve the security of the end-side model. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] Figure 1 : The deep learning model anti-reverse software obfuscation framework on the deep learning compiler in the embodiment of the present invention.

[0068] Figure 2 : The feature analysis module in the embodiment of the present invention extracts key information of the model.

[0069] Figure 3 : The implementation level schematic diagram of the obfuscation module in the embodiment of the present invention.

[0070] Figure 4 : The operator obfuscation method based on random renaming in the embodiment of the present invention.

[0071] Figure 5 : The operator obfuscation method based on false control flow insertion in the embodiment of the present invention.

[0072] Figure 6 : The topological structure obfuscation method based on the computational graph in the embodiment of the present invention.

[0073] Figure 7 : The dimension obfuscation method based on layer widening in the embodiment of the present invention.

[0074] Figure 8 : The dimension obfuscation method based on splitting loop variables in the embodiment of the present invention.

[0075] Figure 9 : The parameter memory access obfuscation method based on random shuffling in the embodiment of the present invention.

[0076] Figure 10 : The obfuscation effect corresponding to the operator obfuscation method based on random renaming in the embodiment of the present invention.

[0077] Figure 11 : The obfuscation effect corresponding to the operator obfuscation method based on false control flow insertion in the embodiment of the present invention.

[0078] Figure 12: The anti - attack effects achieved by the obfuscation method of the embodiments of the present invention in different models.

[0079] Figure 13 : The time overhead generated by the obfuscation method of the embodiments of the present invention under different widening factors.

[0080] Figure 14 : The obfuscation effect corresponding to the operator obfuscation method based on random renaming of the embodiments of the present invention.

[0081] Figure 15 : The obfuscation effect corresponding to the operator obfuscation method based on false control - flow insertion of the embodiments of the present invention. Detailed implementation manners

[0082] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0083] Specifically in implementation, the method proposed by the technical solution of the present invention can be automatically run by those skilled in the art using computer software technology. The system device for implementing the method, such as a computer - readable storage medium storing the corresponding computer program of the technical solution of the present invention and a computer device including running the corresponding computer program, should also be within the protection scope of the present invention.

[0084] In the first aspect of the embodiments of the present invention, a deep - learning model anti - reverse software obfuscation framework based on a deep - learning compiler is proposed. This framework makes full use of the advantages of the deep - learning compiler in efficiently converting the high - level computational graph of the trained model into code applicable to various hardware platforms, realizing seamless connection from model definition to hardware - optimized code generation. The deep - learning compiler can perform in - depth optimization according to the structure of the model and the hardware architecture, and is an efficient compiler technology specifically for the deep - learning field. By performing model obfuscation through this compiler, it has the characteristics of low overhead, wide hardware support, strong compatibility, and high generality. Based on the hierarchical structure of the compiler, the obfuscation module can be integrated in the form of an independent unit and perform refined obfuscation operations at different compilation levels.

[0085] Figure 1 For the schematic diagram of the deep - learning model anti - reverse software obfuscation framework provided by the present invention on the deep - learning compiler, as Figure 1 shown, the embodiments of the present invention include the following steps:

[0086] Step 1: Obtain the original deep neural network model trained via deep learning training frameworks such as TensorFlow and PyTorch, and use it as the input of the deep learning compilation framework. Utilize the compiler features to obtain three types of key information of the model;

[0087] The three types of key information described in Step 1 are defined as follows:

[0088] Model operators, topological structure, parameters, and dimensions.

[0089] Step 2: Construct a feature analysis module to evaluate the model characteristics, and select a suitable obfuscation module in the obfuscation strategy search space to achieve the best balance between security and performance;

[0090] The construction of the feature analysis module described in Step 2 to evaluate the model characteristics and select a suitable obfuscation strategy in the search space, as Figure 2 shown, the specific process is as follows:

[0091] Model operator analysis: The feature analysis module extracts and analyzes the static and dynamic characteristics of the operators in the model, evaluates their complexity, dependencies, and computational costs during execution, identifies which operators are most easily reverse-extracted, and thus decides whether to apply obfuscation strategies such as random renaming and false control flow insertion to modify the operator structure, thereby achieving operator obfuscation.

[0092] Topological structure analysis: The feature analysis module traverses the computational graph of the model, evaluates the dependencies between its nodes (operators) and edges (data flows), identifies possible attack paths based on the extracted complete topological structure of the model, and decides whether to disrupt the model's dependencies through topological structure obfuscation (such as inserting additional memory access operations).

[0093] Parameter and dimension analysis: The feature analysis module extracts the parameter dimensions of the model by analyzing the dimension relationships of each layer in the model, evaluates the complexity and extractability of the model. Especially for attacks based on symbolic execution, this module analyzes the patterns of dimension information to identify the parts that are easily deduced, and then decides the memory access patterns to be modified, and finally applies different parameter dimension obfuscations (such as layer widening, loop variable splitting, etc.) to increase complexity. By comprehensively analyzing the key information of the deep learning model (including operators, topological structure, parameters, and dimensions) and the specific requirements of the hardware platform, the feature analysis module can intelligently evaluate potential reverse engineering attack paths, automatically select and apply the most suitable obfuscation module, maximize the obfuscation effect without sacrificing performance, and thus provide customized security protection for different types of deep learning models.

[0094] The appropriate obfuscation module selected in Step 2 in the obfuscation strategy search space is specifically described as follows: By comprehensively analyzing the key information of the deep learning model and the specific requirements of the hardware platform, the feature analysis module can intelligently evaluate potential reverse engineering attack paths, automatically select and apply the most suitable obfuscation module, so that the system can maximize the obfuscation effect without sacrificing performance, thereby providing customized security protection for different types of deep learning models.

[0095] Step 3: Design exclusive obfuscation algorithms for the three types of key information described in Step 1 according to the obfuscation strategy, and encapsulate them into independent obfuscation modules;

[0096] The present invention proposes an obfuscation scheme for three key information of the deep learning model, and conducts one-by-one analysis and obfuscation on possible model extraction attacks based on reverse engineering, such as operator extraction by constructing a template to identify operators, model topology structure extraction by Hook function call points, and extraction of model parameters and dimensions by constructing symbolic execution and taint analysis.

[0097] For the obfuscation modules mentioned in Step 3, for better description, the present invention only shows six feasible obfuscation schemes. Other obfuscation schemes implemented based on the framework of the present invention are also within the scope of the present invention. Specifically:

[0098] Module 1: Operator obfuscation based on random renaming. Randomly rename the key function names in the generated binary of the target platform, which can greatly reduce the operator information exposed by the operator names. For example Figure 4 As shown, the specific approach is to add a target code obfuscation pass during the target code generation stage, locate the TIR function primitive to be converted into the target code function entry, obtain the key operator function name and its attributes, and replace the name and attributes in the original TIR function primitive with randomly generated new function names. By disassembling the binary files before and after obfuscation, it can be found that each operator in the model after applying the renaming obfuscation is renamed to a random name. For example Figure 10 As shown in the comparison of the effects before and after operator obfuscation based on random renaming, before obfuscation, tvmgen_default_fused_nn_conv2d_nn_relu is an operator that fuses a convolution and a relu function using the TVM default strategy. After obfuscation, it will be replaced by a randomly generated string tvmgen_H7t4L9k2S6fA, which will greatly increase the difficulty of manually restoring the model.

[0099] Module 2: Operator obfuscation based on inserting false control flow. Adding false control flow to the instructions inside the operator can obscure the instruction sequence characteristics of the operator, making it difficult to distinguish the true operator type based on static analysis. For example Figure 5As shown, the specific approach is to dynamically construct an always-true opaque predicate based on the internal characteristics of the operator obtained from the TIR layer. Complementary atomic operations are constructed according to the computational primitives of the operator to be obfuscated. The always-true opaque predicate is used as the conditional branch, and the complementary atomic operations are used as the branch body to construct a false control flow. Finally, the newly generated false control flow is inserted into the TVM TIR. Using IDA Pro to disassemble the binary files before and after inserting the false control flow obfuscation, by looking at the places where there are a large number of SIMD instructions, we can quickly locate a false control flow branch added for the convolution operator. The obfuscation effects before and after are as Figure 11 shown. In this example, for the original addition operation, a branch using subtraction operation is added to change its assembly instruction characteristics, making it more difficult for attackers to match the correct operator using patterns.

[0100] Module 3: Topological structure obfuscation based on the computational graph. Adding additional memory accesses to the inputs of operators based on the computational graph can obscure the address passing information of the model and hide the true operator connection relationships. As Figure 6 shown, the specific approach is to traverse each operator node on the static computational graph of the model and record all the outputs of the previous nodes when traversing to the current operator node, i.e., perform a topological sort. Randomly select the operator nodes that need to add additional memory accesses, and randomly select one or more from the set of previous node outputs and add them to the input tensor attributes of the operator to be obfuscated. To test the effect of the model topological structure obfuscation, classic image classification models such as Resnet50 and VGG16 in ONNX Zoo are used for testing. Using IDA Pro and the model decompiler BTD to decompile the original model before obfuscation and the model after applying the topological structure obfuscation respectively, and comparing the ratio of the successfully recovered topological structures as Figure 12 shown, it can be seen that the topological structure obfuscation has achieved good obfuscation effects.

[0101] Module 4: Dimension obfuscation based on layer widening. Randomly widening the output channels of specific operators can hide the true operator information and cause mismatches in the extracted information. As Figure 7 shown, the specific approach is to select the linear layer or convolutional layer operator to be widened, extract the dimension and parameter information of the original operator, and accordingly apply a widening algorithm to copy the output channels based on the widening factor to create a new operator. Use the widened weights for new operations, and finally perform channel cropping on the output results to ensure result consistency. Figure 13 Shows the comparison of the average inference time for the same input before and after applying layer widening obfuscation measured on different models. In extreme cases, applying 2 times layer widening to each linear layer and convolutional layer will cause a time overhead of 10%-25% for different models. Normally using 1.2 times layer widening will only increase the inference overhead by 1.5%-5.5%, which is acceptable.

[0102] Module 5: Dimensional confusion based on split loop variables. The model after splitting the loop variables will have more nested loops, and the non-fixed splitting algorithm will prevent fixed pattern matching. Figure 8 As shown in the figure, the specific approach is to locate the original operator execution instruction nested loop based on the loop variable, and then randomly split the original loop to generate sub-loops until the configuration requirements are met. The split sub-loops are then randomly arranged, and the out-of-order sub-loops are combined into a new execution sequence and returned. Figure 14 The data shows the states of loop variables in the VGG16 model before and after applying dimension confusion based on splitting loop variables. It can be seen that the original loop is successfully split into four layers of sub-loops, which greatly increases the complexity of the model and improves the model security, with almost no performance loss.

[0103] Module 6: Parameter access obfuscation based on random shuffling. Randomly shuffling the parameters can prevent parameter extraction that depends on sequential patterns and prevent the original memory layout from being restored through pattern matching. Figure 9 As shown in the figure, the specific approach is to apply the shuffle algorithm to generate a shuffled random tensor sequence index for the penultimate dimension of the parameter, disrupt the actual storage space of the parameter according to the memory access index, retain the tensor index as the basis for subsequent memory access calculations, and improve the memory access calculator to access the original data when performing operations based on the memory access index. The random shuffle effect of module 6 is demonstrated using a 3*3*3*4 convolution kernel, as shown in the figure. Figure 15 The unobfuscated parameters shown in a are stored continuously in memory. To facilitate the display effect, they are converted into a 9*12 matrix. To ensure the normal use of SIMD instructions, the relative position of the innermost dimension will not change during the shuffle. After the obfuscation is completed, the effect is as follows Figure 15 As shown in b.

[0104] Through this strategy, the present invention realizes an automated and intelligent deep learning model obfuscation solution, greatly improving the applicability and flexibility of obfuscation.

[0105] Step 4: Layer the compilation process of the deep learning compiler from top to bottom to obtain multiple levels of model high-level expression related to the computational graph, tensor templates of model operators, intermediate representation of underlying tensors, and target code generation;

[0106] Step 5: Classify the software obfuscation schemes mentioned in Step 3 based on the compilation characteristics of the deep learning model. Bind different obfuscation schemes to multiple levels of model high-level expressions related to the computational graph, tensor templates of model operators, low-level tensor intermediate expressions, and target code generation. For complex obfuscation schemes, split them and bind them to multiple levels.

[0107] The binding described in step 5 is as follows: The obfuscation module that interferes with the topological structure of the model or confuses the model dependencies will be bound to the high-level expression level of the computational graph, such as the topological structure obfuscation module based on the computational graph.

[0108] The obfuscation module that modifies the dimensions or parameters of the model will be bound to the operator tensor template level, such as the dimension obfuscation module based on layer widening and the parameter memory access obfuscation module based on random shuffling.

[0109] The obfuscation module that adjusts the execution flow or loop structure of the model will be bound to the underlying tensor intermediate expression level, such as the dimension obfuscation module based on splitting loop variables.

[0110] The obfuscation module that interferes with the function call points or control flow in the target code will be bound to the target code generation level, such as the operator obfuscation module based on random renaming and the operator obfuscation module based on false control flow insertion.

[0111] Step 6: Construct pass insertion modules at different levels according to the binding levels described in step 5 to insert the various obfuscation modules described in step 3;

[0112] The specific descriptions of each obfuscation pass in step 6 are as follows:

[0113] High-level obfuscation pass: Supports the insertion of obfuscation modules at the high-level expression level of the model related to the computational graph;

[0114] Intermediate-level obfuscation pass: Supports the insertion of obfuscation modules related to the operator tensor template level;

[0115] Low-level obfuscation pass: Supports the insertion of obfuscation modules related to the underlying tensor intermediate expression level;

[0116] Target code obfuscation pass: Supports the insertion of obfuscation modules related to the target code generation level;

[0117] The four obfuscation passes mentioned in step 6 are only for the demonstration of the six feasible obfuscation modules mentioned in step 3 of this embodiment. In the specific implementation process, more software obfuscation schemes and more passes constructed according to the different functions of the obfuscation modules are also within the protection scope of the present invention. For better demonstration, the present invention takes Figure 3 for simple illustration.

[0118] Step 7: Based on the obfuscation options enabled by the user and the obfuscation module evaluation performed in the feature analysis module in Step 2, the compiler invokes the corresponding obfuscation module implementation. While applying compilation optimization to the original model, model obfuscation is completed at different compilation levels. The compiled model will possess the defined obfuscation characteristics to prevent the extraction of key model parameters through reverse engineering-based model extraction attacks.

[0119] An embodiment of the system of the present invention is an anti-reverse obfuscation system for deep learning models oriented to edge devices, including:

[0120] A key information acquisition module, used to obtain the original deep neural network model trained by deep learning training frameworks such as TensorFlow and PyTorch, and use it as the input of the deep learning compilation framework, and obtain three types of key information of the model using compiler characteristics;

[0121] A model characteristic evaluation module, used to construct a feature analysis module to evaluate the model characteristics, and select a suitable obfuscation module in the obfuscation strategy search space to achieve the best balance between security and performance;

[0122] An obfuscation module encapsulation module, used to design exclusive obfuscation algorithms according to the three types of key information of the obfuscation strategy and encapsulate them into independent obfuscation modules;

[0123] A layer generation module, used to layer the compilation process of the deep learning compiler from top to bottom to obtain multiple levels such as the high-level model expression related to the computation graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation;

[0124] Multiple layer binding modules, used to bind different obfuscation schemes to multiple levels such as the high-level model expression related to the computation graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation, and split and bind complex obfuscation schemes to multiple levels;

[0125] An insertion module, used to construct pass insertion modules at the bound levels to insert multiple obfuscation modules;

[0126] A model obfuscation module, used for the compiler to invoke the corresponding obfuscation module implementation, and while applying compilation optimization to the original model, complete model obfuscation at different compilation levels.

[0127] It should be understood that the parts not elaborated in detail in this specification belong to the prior art.

[0128] It should be understood that the above description of the embodiments is relatively detailed, and it should not be considered as a limitation to the protection scope of the present invention patent. Under the inspiration of the present invention, those of ordinary skill in the art can also make substitutions or deformations without departing from the protection scope defined by the claims of the present invention, and all fall within the protection scope of the present invention. The scope of protection claimed by the present invention shall be subject to the appended claims.

Claims

1. An anti-reverse obfuscation method for deep learning models on edge devices, characterized in that It includes the following steps: Step 1: Obtain the original deep neural network model trained via deep learning training frameworks such as TensorFlow and PyTorch, and use it as the input of the deep learning compilation framework. Utilize the compiler features to obtain three types of key information of the model; Step 2: Construct a feature analysis module to evaluate the model characteristics, and select a suitable obfuscation module in the obfuscation strategy search space to achieve the best balance between security and performance; Step 3: Design exclusive obfuscation algorithms according to the three types of key information of the obfuscation strategy, and encapsulate them into independent obfuscation modules; Step 4: Layer the compilation process of the deep learning compiler from top to bottom to obtain multiple levels such as the high-level model expression related to the computation graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation; Step 5: Bind different obfuscation schemes to multiple levels including the high-level model expression related to the computation graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation. For complex obfuscation schemes, split and bind them to multiple levels; Step 6: Construct pass insertion modules at different levels based on the bound levels to insert multiple obfuscation modules; Step 7: The compiler calls the corresponding obfuscation module implementation, and the original model is obfuscated at different compilation levels while applying compilation optimizations.

2. The anti-reverse obfuscation method for deep learning models for edge devices according to claim 1, wherein: The three types of key information described in Step 1 are defined as follows: Model operators, topological structure, parameters, and dimensions.

3. The anti-reverse obfuscation method for deep learning models for edge devices according to claim 2, wherein: The process of constructing a feature analysis module to evaluate the model characteristics and selecting a suitable obfuscation strategy in the search space in Step 2 is as follows: Model operator analysis: The feature analysis module extracts and analyzes the static and dynamic characteristics of the operators in the model, evaluates their complexity, dependency relationships, and computational costs during execution, identifies the operators that are most easily reverse-extracted, and thus decides whether to apply obfuscation strategies such as random renaming and false control flow insertion to modify the operator structure, thereby achieving operator obfuscation; Topological structure analysis: Traverse the computation graph of the model, evaluate the dependencies between its nodes and edges, identify possible attack paths based on the extracted complete topological structure of the model, and decide whether to disrupt the dependency relationships of the model through topological structure obfuscation; Parameter and dimension analysis: By analyzing the dimensional relationships of each layer in the model, evaluate the complexity and extractability of the model, and thus extract the parameter dimensions of the model.

4. The anti-reverse obfuscation method for deep learning models for edge devices according to claim 3, wherein: The suitable obfuscation module selected in the obfuscation strategy search space in Step 2 is specifically described as a comprehensive analysis of the key information of the deep learning model and the specific requirements of the hardware platform.

5. The anti-reverse obfuscation method for deep learning models for edge devices according to claim 4, wherein: The specific content of Step 3 is as follows: For possible reverse-engineering-based model extraction attacks, such as operator extraction for identifying operators by constructing templates, model topology extraction by hooking function call points, and model parameter and dimension extraction by constructing symbolic execution and taint analysis, etc., conduct one-by-one analysis and obfuscation, including: Operator obfuscation based on random renaming, operator obfuscation based on inserting false control flow, topology obfuscation based on the computational graph, dimension obfuscation based on layer widening, dimension obfuscation based on splitting loop variables, and parameter memory access obfuscation based on random shuffling.

6. The anti-reverse obfuscation method for the deep learning model for edge devices according to claim 5, wherein: The operator obfuscation based on random renaming is as follows: Randomly rename the key function names in the generated binary of the target platform, which can greatly reduce the operator information exposed by the operator names. Specifically as follows: Add a target code obfuscation pass during the target code generation stage, locate the entry of the target code function converted from the TIR function primitive, obtain the key operator function name and its attributes, and replace the name and attributes in the original TIR function primitive with randomly generated new function names; The operator obfuscation based on inserting false control flow is as follows: Adding false control flow to the internal instructions of the operator can obscure the instruction sequence characteristics of the operator. Specifically as follows: According to the internal characteristics of the operator obtained from the TIR layer, dynamically construct an opaque predicate that is always true; construct complementary atomic operations according to the computational primitive of the operator to be obfuscated, use the always-true opaque predicate as the conditional branch, and the complementary atomic operations as the branch body to construct false control flow, and finally insert the newly generated false control flow into the TVM TIR; The topology obfuscation based on the computational graph is as follows: Adding additional memory access for the input of the operator based on the computational graph can obscure the address transfer information of the model and hide the real operator connection relationship. Specifically as follows: Traverse each operator node on the static computational graph of the model, and record all the outputs of the previous nodes when traversing to the current operator node, that is, perform topological sorting. Randomly select operator nodes that need to add additional memory access, and randomly select one or more from the set of previous node outputs and add them to the input tensor attributes of the operator to be obfuscated; The dimension obfuscation based on layer widening is as follows: Randomly widen the output channels of specific operators to hide the real operator information and cause mismatches in the extracted information. Specifically as follows: Select the linear layer or convolutional layer operator to be widened, extract the dimensions and parameter information of the original operator, and accordingly apply the widening algorithm to copy the output channels based on the widening factor to create a new operator; use the widened weights for new operations, and finally crop the channels of the output result to ensure result consistency; The dimension obfuscation based on splitting loop variables is as follows: The model after splitting loop variables will have more nested loops with layer structures, and the non-fixed splitting algorithm will prevent fixed pattern matching. Specifically as follows: Locate the original operator execution instruction nested loop based on the loop variable, and then randomly split the original loop to generate sub-loops until the configuration requirements are met. Then, randomly arrange the split sub-loops, combine the out-of-order sub-loops into a new execution sequence and return it; The parameter access obfuscation based on random shuffling is: Shuffling parameters for storage prevents parameter extraction that relies on sequential patterns and prevents restoration of the original memory layout through pattern matching, as follows: A shuffling algorithm is applied to generate a shuffled random tensor sequence index for the penultimate dimension of the parameter, the actual storage space of the parameter is disrupted according to the memory access index, the tensor index is retained as the basis for subsequent memory access calculations, and the memory access calculator is improved to access the original data when performing operations based on the memory access index.

7. The anti-reverse obfuscation method for a deep learning model for an end-side device according to claim 6, characterized in that: Bind as described in step 5, as follows: The obfuscation module that interferes with the topology of the model or confuses the model dependencies will be bound to the high-level expression level of the computational graph, based on the topological structure obfuscation module of the computational graph; The obfuscation modules that modify the dimensions or parameters of the model will be bound to the operator tensor template hierarchy, such as the dimension obfuscation module based on layer widening and the parameter access obfuscation module based on random shuffling; Obfuscation modules that adjust the model execution process or loop structure will be bound to the underlying tensor intermediate expression level, such as the dimension obfuscation module based on splitting loop variables; Obfuscation modules that interfere with function call points or control flows in the target code will be bound to the target code generation hierarchy, such as operator obfuscation modules based on random renaming and operator obfuscation modules based on false control flow insertion.

8. The anti-reverse obfuscation method for a deep learning model for an end-side device according to claim 7, characterized in that: The details of each obfuscation pass in step 6 are as follows: Advanced obfuscation pass: supports the insertion of obfuscation modules at the high-level expression level of the model related to the computational graph; Intermediate obfuscation pass: supports the insertion of obfuscation modules related to the operator tensor template level; Low-level obfuscation pass: supports the insertion of obfuscation modules related to the intermediate representation level of underlying tensors; Target code obfuscation pass: supports the insertion of obfuscation modules related to the target code generation level.

9. The anti-reverse obfuscation method for a deep learning model of an end-side device according to claim 8, characterized in that: The four obfuscation passes mentioned in step 6 are only used as a demonstration of the six feasible obfuscation modules mentioned in step 3 of this embodiment. In the specific implementation process, more software obfuscation schemes and more passes constructed according to the different functions of the obfuscation modules may be used.

10. An anti-reverse obfuscation system for deep learning models of edge devices, characterized in that, include: The key information acquisition module is used to obtain the original deep neural network model trained by deep learning training frameworks such as TensorFlow and Pytorch, and use it as input to the deep learning compilation framework, using the compiler features to obtain three types of key information of the model; The model feature evaluation module is used to build a feature analysis module to evaluate the model features, and select a suitable obfuscation module in the obfuscation strategy search space to achieve the best balance between security and performance; The obfuscation module encapsulation module is used to design exclusive obfuscation algorithms according to the three types of key information of the obfuscation strategy and encapsulate them into independent obfuscation modules; The hierarchical generation module is used to layer the compilation process of the deep learning compiler from top to bottom to obtain multiple levels such as the high-level model expression related to the computational graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation; Multiple hierarchical binding modules are used to bind different obfuscation schemes to multiple levels such as the high-level model expression related to the computational graph, the tensor template of the model operator, the underlying tensor intermediate expression, and the target code generation, and split and bind multiple levels for complex obfuscation schemes; The insertion module is used to build pass insertion modules at different levels based on the bound levels to insert multiple obfuscation modules; The model obfuscation module is used to implement the corresponding obfuscation module called by the compiler, and the original model completes the obfuscation of the model at different compilation levels while applying compilation optimization.

Images