Methods, apparatus, devices and storage media for protecting model security

Abstract

Embodiments of this disclosure provide methods, apparatus, devices, and storage media for protecting model security. The method includes: obtaining an input feature representation for a first model layer in a machine learning model; generating a first feature tensor for the first model layer by processing the input feature representation using a first weight tensor in a processing unit; transmitting the input feature representation and the first feature tensor to a trusted execution environment; processing the input feature representation using direction transformation parameters in the trusted execution environment to generate a direction correction tensor; and correcting the first feature tensor based on the direction correction tensor in the trusted execution environment to determine an output feature representation corresponding to the first model layer.

Description

Technical Field

[0001] The exemplary embodiments disclosed herein generally relate to the field of computers, and particularly to methods, apparatus, devices, computer-readable storage media, and computer program products for protecting models. Background Technology

[0002] As the field of machine learning models continues to develop, the training and application phases of machine learning models are showing a trend of differentiation. Model trainers typically integrate powerful computing power and massive amounts of data to train machine learning models. Model users often belong to specific business domains, applying the machine learning models provided by the trainers to specific business scenarios to reduce costs or improve business capabilities. This differentiation and cooperation allows both trainers and users to leverage their respective strengths, improving training efficiency and application levels. However, it also raises concerns about the data security of the machine learning models themselves. Summary of the Invention

[0003] In a first aspect of this disclosure, a method for protecting model security is provided. The method includes: obtaining an input feature representation for a first model layer in a machine learning model, the first model layer including orientation transformation parameters deployed in a trusted execution environment of a computing device and a first weight tensor deployed in a processing unit outside the trusted execution environment, the first weight tensor being obtained by transforming a trained weight tensor of the first model layer using the orientation transformation parameters; generating a first feature tensor for the first model layer by processing the input feature representation using the first weight tensor in the processing unit; transmitting the input feature representation and the first feature tensor to the trusted execution environment; processing the input feature representation using the orientation transformation parameters in the trusted execution environment to generate an orientation correction tensor; and correcting the first feature tensor based on the orientation correction tensor in the trusted execution environment to determine an output feature representation corresponding to the first model layer.

[0004] In a second aspect of this disclosure, an apparatus for protecting model security is provided. The apparatus includes: an acquisition module configured to acquire an input feature representation for a first model layer in a machine learning model, the first model layer including orientation transformation parameters deployed in a trusted execution environment of a computing device and a first weight tensor deployed in a processing unit outside the trusted execution environment, the first weight tensor being obtained by transforming a trained weight tensor of the first model layer using the orientation transformation parameters; a generation module configured to generate a first feature tensor for the first model layer by processing the input feature representation using the first weight tensor in the processing unit; a transmission module configured to transmit the input feature representation and the first feature tensor to the trusted execution environment; a processing module configured to process the input feature representation using the orientation transformation parameters in the trusted execution environment to generate an orientation correction tensor; and a correction module configured to correct the first feature tensor based on the orientation correction tensor in the trusted execution environment to determine an output feature representation corresponding to the first model layer.

[0005] In a third aspect of this disclosure, an electronic device is provided. The device includes at least one processor; and at least one memory coupled to the at least one processor and storing instructions for execution by the at least one processor. When executed by the at least one processor, the instructions cause the device to perform the method of the first aspect.

[0006] In a fourth aspect of this disclosure, a computer-readable storage medium is provided. The computer-readable storage medium stores computer-executable instructions that can be executed by a processor to implement the method of the first aspect.

[0007] In a fifth aspect of this disclosure, a computer program product is provided, including computer-executable instructions, wherein when executed by a processor, the computer-executable instructions implement the method according to a first aspect of this disclosure.

[0008] It should be understood that the content described in this content section is not intended to limit the key or essential features of the embodiments of this disclosure, nor is it intended to restrict the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0009] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. In the drawings, the same or similar reference numerals denote the same or similar elements, wherein:

[0010] Figure 1 A schematic diagram is shown of an example environment in which embodiments of the present disclosure may be implemented;

[0011] Figure 2A flowchart illustrating a process for protecting the security of a model according to some embodiments of this disclosure is shown;

[0012] Figure 3 A schematic diagram illustrating an example scenario for protecting the security of a model according to some embodiments of the present disclosure is shown;

[0013] Figure 4 A schematic structural block diagram of an example device for protecting a model according to some embodiments of the present disclosure is shown; and

[0014] Figure 5 A block diagram of an electronic device capable of implementing several embodiments of the present disclosure is shown. Detailed Implementation

[0015] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0016] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The term "some embodiments" should be understood as "at least some embodiments". Other explicit and implicit definitions may also be included below.

[0017] In this document, unless explicitly stated otherwise, performing a step in response to A does not mean that the step is performed immediately after A, but may include one or more intermediate steps.

[0018] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0019] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure through appropriate means in accordance with relevant laws and regulations, and user authorization should be obtained.

[0020] For example, in response to receiving a user's active request, a prompt message is sent to the user to clearly inform the user that the requested operation will require the acquisition and use of the user's personal information, thereby enabling the user to choose whether to provide personal information to the software or hardware such as electronic devices, applications, servers or storage media that perform the operation of the technical solution disclosed herein, based on the prompt message.

[0021] As an optional but non-restrictive implementation, in response to a user's active request, a prompt message can be sent to the user, such as a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0022] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0023] As used in this paper, the term "model" refers to a model that learns the relationship between inputs and outputs from training data, enabling it to generate corresponding outputs for a given input after training. Model generation can be based on machine learning techniques. Deep learning is a machine learning algorithm that processes inputs and provides corresponding outputs using multiple layers of processing units. A neural network model is an example of a deep learning-based model. In this paper, "model" may also be referred to as a "machine learning model," "learning model," "machine learning network," or "learning network," and these terms are used interchangeably.

[0024] A neural network is a machine learning network based on deep learning. A neural network processes input and provides a corresponding output, typically consisting of an input layer, an output layer, and one or more hidden layers between the input and output layers. Neural networks used in deep learning applications often include many hidden layers, thus increasing the network's depth. The layers of a neural network are connected sequentially, so that the output of the previous layer is provided as the input to the next layer. The input layer receives the input to the neural network, while the output layer's output serves as the final output. Each layer of a neural network includes one or more nodes (also called processing nodes or neurons), each node processing the input from the layer above.

[0025] Machine learning typically comprises three phases: training, testing, and application (also known as inference). In the training phase, a given model is trained using a large amount of training data, iteratively updating its parameter values ​​until the model can consistently generate inferences that meet the expected goals from the training data. Through training, the model can be considered to have learned the relationship between inputs and outputs (also known as the input-output mapping) from the training data. The parameter values ​​of the trained model are determined. In the testing phase, test inputs are applied to the trained model to test whether it can provide the correct output, thus determining the model's performance. In the application phase, the model can be used to process actual inputs based on the trained parameter values ​​to determine the corresponding output.

[0026] As used herein, the term "weight tensor" can be a tensor with any suitable number of dimensions. For example, a weight tensor can be a weight matrix. The following description will primarily use the weight matrix as an example of a weight tensor.

[0027] As mentioned above, with the continuous development of machine learning models, the training and application phases of machine learning models are showing a trend of differentiation. The model trainer (also known as the model provider) typically integrates powerful computing power and massive amounts of data to train the machine learning model. The model user often belongs to a specific business domain, applying the machine learning model provided by the trainer to specific business scenarios to reduce costs or improve business capabilities. This differentiation and cooperation allows both the trainer and the user to leverage their respective strengths, improving model training efficiency and application level. However, it also raises the issue of data security protection for machine learning models.

[0028] To address data security concerns in machine learning models, some providers choose to utilize Trusted Execution Environments (TEEs) to protect their models. Specifically, the model is split into two parts based on computational intensity. The computationally intensive part is obfuscated and deployed in a normal execution environment (NEE), while the less computationally intensive part is deployed in a TEE. During inference, the NEE and TEE are used for collaborative inference. In the NEE, the obfuscated weight vectors are used to process the input data. In the TEE, the processing results are recovered to obtain the true result.

[0029] Traditional obfuscation techniques can be categorized into lightweight obfuscation strategies and complex obfuscation strategies. Lightweight obfuscation strategies prioritize model inference performance, employing simpler and more lightweight obfuscation methods. However, these strategies cannot protect the directional information of privacy-preserving weight vectors. When attackers combine this information with publicly available model data to perform data theft attacks, the privacy protection effect of these strategies is poor, and security still needs improvement. Complex obfuscation strategies prioritize model security, utilizing relatively complex matrix multiplications to obfuscate the model's weights. However, the computational complexity of restoring the processing results in a trusted execution environment is significant, approaching the computational complexity of performing inference operations on the corresponding model layer in a trusted execution environment, thus impacting the model's inference performance. Therefore, traditional obfuscation strategies cannot simultaneously address both model privacy and inference performance.

[0030] In view of this, embodiments of this disclosure propose an improved scheme for protecting model security. In this scheme, for a first model layer in a machine learning model, a first weight tensor is obtained by pre-transforming (or obfuscating) the trained weight tensor of the first model layer using direction transformation parameters. During the execution of the machine learning model on a computing device, the direction transformation parameters are deployed in the trusted execution environment of the computing device, while the first weight tensor is deployed in a processing unit outside the trusted execution environment. If an input feature representation for the first model layer is obtained, a first feature tensor for the first model layer is generated by processing the input feature representation using the first weight tensor in the processing unit. Then, the input feature representation and the first feature tensor are transferred from the processing unit to the trusted execution environment. In the trusted execution environment, the input feature representation is processed using the direction transformation parameters to generate a direction correction tensor. Furthermore, the first feature tensor is corrected based on the direction correction tensor to determine the output feature representation corresponding to the first model layer.

[0031] In the embodiments of this disclosure, the first weight tensor deployed in the processing unit is obtained by obfuscating the direction transformation parameters, which effectively protects the orientation information of the trained weight tensor. In a trusted execution environment, only the input feature representation needs to be processed using the direction transformation parameters to generate the orientation correction tensor. Then, the orientation correction tensor is used to correct the orientation of the first feature tensor. Thus, the computational load in the trusted execution environment is relatively small, and the inference speed is relatively fast, achieving a balance between model privacy and inference performance.

[0032] The following section provides a detailed description of various example implementations of this scheme, with reference to the accompanying drawings.

[0033] Example Environment

[0034] Figure 1A schematic diagram of an example environment 100 in which embodiments of the present disclosure can be implemented is shown. In this example environment 100, a processing unit 120 and a Trusted Execution Environment (TEE) 130 are deployed in a computing device 110. The Trusted Execution Environment 130 has a higher level of trust than the processing unit 120. That is, the Trusted Execution Environment 130 has a higher security level than the processing unit 120.

[0035] In some embodiments, the Trusted Execution Environment 130 may be referred to as a Secure Execution Environment. A Trusted Execution Environment is a hardware-based security technology that constructs a secure computing environment isolated from the outside world by dividing it into secure and insecure parts. The Secure Execution Environment can guarantee the confidentiality and integrity of the data and code loaded within the Trusted Execution Environment. The Trusted Execution Environment is isolated from the ordinary execution environment, has a higher level of security, and is suitable for processing sensitive data within it. In some embodiments, a normal execution environment may be deployed in the processing unit 120, which can be formed from the default operating environment or a traditional operating environment of the computing device 110.

[0036] In some embodiments, processing unit 120 may include a first type of processing unit, and trusted execution environment 130 may be deployed in a second type of processing unit. The first and second types of processing units can be formed from any suitable different types of processing units. In some examples, processing unit 120 may include a graphics processing unit (GPU), and trusted execution environment 130 may be deployed in a central processing unit (CPU). Thus, processing unit 120 is suitable for performing computationally intensive operations, and trusted execution environment 130 has a relatively high level of trust and security.

[0037] In some embodiments of this disclosure, a machine learning model 140 is deployed in the computing device 110, and the machine learning model 140 can run in the computing device 110. In some embodiments, the machine learning model 140 may include multiple model layers. The multiple model layers are divided into two groups of model layers based on their computational density or privacy level. Each group of model layers may include one or more model layers. In some embodiments, one group of model layers may include model layers 142-1, 142-2, ..., 142-M with relatively high computational density, and the other group of model layers includes model layers 144-1, 144-2, ..., 144-N with relatively low computational density, where M and N are both positive integers. This group of model layers may be deployed in the processing unit 120, and the other group of model layers may be deployed in the trusted execution environment 130. In some examples, this group of model layers may include, but is not limited to, linear layers, and the other group of model layers may include, but is not limited to, activation layers, regularization layers, etc. Of course, the above method of dividing model layers is only exemplary, and any appropriate method can be chosen to divide the multiple model layers of the machine learning model 140 according to actual needs. The embodiments disclosed herein are not limited in this respect.

[0038] Machine learning model 140 can be of different types. In some embodiments, machine learning model 140 can be built based on deep neural networks or language models (LMs). In some embodiments, machine learning models based on large language models (LLMs) can handle textual modal model inputs (e.g., natural language and / or machine language) and / or non-textual modal model inputs (e.g., images, speech, video, etc.), and can generate desired outputs based on the model inputs and prompt words. Here, prompt words are used to guide the machine learning model to generate outputs that address the user's needs indicated by the model inputs. In application scenarios supporting user dialogue, user input can be provided to machine learning model 140 as at least a part of the model inputs (other parts may include prompt words). Based on the model outputs, content corresponding to the user's inputs can be generated and provided to the user.

[0039] In some embodiments, computing device 110 communicates with server 150 to support the operation of machine learning model 140. In some examples, server 150 may be a server of the provider of machine learning model 140, and computing device 110 may be an electronic device of the user of machine learning model 140. Computing device 110 may obtain machine learning model 140 or parameters necessary for its operation from server 150. In some examples, computing device 110 may be a terminal device or an edge device. In this case, machine learning model 140 may be referred to as an edge machine learning model. Terminal device may be any type of mobile terminal, fixed terminal, or portable terminal, including mobile phones, desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, media computers, multimedia tablets, personal communication system (PCS) devices, personal navigation devices, personal digital assistants (PDAs), audio / video players, digital cameras / camcorders, positioning devices, television receivers, radio receivers, e-book devices, gaming devices, or any combination thereof, including accessories and peripherals of these devices or any combination thereof. In some examples, computing device 110 may also be a server, or a computing device in a cloud environment, etc. It should be understood that the specific device type of computing device 110 may vary depending on the deployment method of machine learning model 140, and the embodiments of this disclosure do not limit the device type of computing device 110. In some embodiments, server 150 may be various types of computing systems / servers capable of providing computing power, including but not limited to mainframes, edge computing nodes, computing devices in cloud environments, etc. Server 150 may, for example, be implemented based on a cloud environment.

[0040] It should be understood that the structure and function of the various elements in environment 100 are described for illustrative purposes only and do not imply any limitation on the scope of this disclosure. Although the processing unit and trusted execution environment are shown as being in a computing device, it should be understood that this is merely exemplary. The processing unit and trusted execution environment in the embodiments of this disclosure can be deployed in any suitable type of electronic device.

[0041] Example process

[0042] The following description will continue with reference to the accompanying drawings, which will provide some exemplary embodiments of this disclosure. Figure 2 A flowchart of a process 200 for protecting the security of a model according to some embodiments of the present disclosure is shown. Some or all of process 200 may be implemented by computing device 110, or by computing device 110 in conjunction with other devices, such as computing device 110 in cooperation with server 150. In the following description, for ease of discussion, the execution of process 200 is described from the perspective of computing device 110, but this is merely exemplary.

[0043] In block 210, computing device 110 acquires an input feature representation for a first model layer in machine learning model 140. In some embodiments, the first model layer may be any one of one or more model layers deployed in processing unit 120. As an example, the first model layer may be any one of model layers 142-1, 142-2, ..., 142-M; for example, the first model layer may be a linear layer not deployed in a normal execution environment. Of course, the above-described first model layer is merely exemplary, and the first model layer may be any other suitable model layer in machine learning model 140. Embodiments of this disclosure are not limited in this regard.

[0044] The first model layer may include a first weight tensor deployed in the processing unit 120 and orientation transformation parameters deployed in the trusted execution environment 130. The first weight tensor may be obtained by transforming the trained weight tensor of the first model layer using the orientation transformation parameters. Specifically, after the machine learning model 140 is trained, each model layer of the machine learning model 140 has a corresponding trained weight tensor. Correspondingly, the first model layer also has a corresponding trained weight tensor, which is an unobfuscated or untransformed weight tensor. The first weight tensor is obtained by transforming the orientation of the trained weight tensor of the first model layer using the orientation transformation parameters.

[0045] In some embodiments, a trained weight tensor may include a trained weight matrix, and the trained weight matrix may include multiple weight vectors. A first weight tensor may include a first weight matrix, and the first weight tensor may include multiple weight vectors. As an example, Figure 3 A schematic diagram of an example scenario 300 for protecting the security of a model according to some embodiments of this disclosure is shown. For example... Figure 3 As shown in Figure 320, the trained weight tensor of the first model layer may include the trained weight matrix W. vic After training the weight matrix W vic Including weight vector Weight vector Weight vector and weight vector like Figure 3 As shown in Figure 330, the first weight tensor may include the first weight matrix W. obf The first weight matrix W obf It can include weight vectors Weight vector Weight vector and weight vector It is understood that the first weight tensor described above is merely an example, and the dimensions of the first weight tensor may differ depending on the type of machine learning model 140 or the model layer. The embodiments of this disclosure do not limit this.

[0046] In some embodiments, computing device 110 may receive machine learning model 140 from server 150. Computing device 110 may transform the trained weight tensor of the first model layer in machine learning model 140 based on orientation transformation parameters to obtain a first weight tensor. Before performing an inference process using machine learning model 140, computing device 110 may deploy the first weight tensor of the first model layer to processing unit 120, and computing device 110 may also deploy the orientation transformation parameters of the first model layer to trusted execution environment 130.

[0047] In other embodiments, server 150 may transform the trained weight tensor of the first model layer in machine learning model 140 based on orientation transformation parameters to obtain a first weight tensor. Server 150 may then use the first weight tensor to replace the trained weight tensor of the first model layer in machine learning model 140. Afterward, server 150 may provide the modified machine learning model 140 to computing device 110.

[0048] The following example illustrates the transformation process from a trained weight tensor to a first weight tensor, using computing device 110 as an example. However, it is understood that the transformation process performed by computing device 110 can also be performed by server 150.

[0049] In some embodiments, the computing device 110 can use orientation transformation parameters to transform the orientation of the weight components in each dimension of the trained weight tensor to obtain an orientation-transformed weight tensor. Then, the computing device 110 can use order transformation parameters to adjust the order of at least some weight components in the orientation-transformed weight tensor to obtain a first weight tensor. In this way, not only are the orientations of the weight components in each dimension of the trained weight tensor adjusted, but the order of the weight components is also disrupted. This makes it impossible for an attacker to compare the orientation similarity between the weight tensors of the model layers in the pre-trained model and the weight components in the first weight tensor, and even more impossible to restore the order of the weight components based on orientation similarity. This significantly improves the attack resistance of the machine learning model 140.

[0050] As an example, a trained weight tensor can include a trained weight matrix, which can be represented as follows: The direction transformation parameters may include the direction transformation vector v, and the computing device 110 can use the direction transformation vector v and the trained weight matrix Wvic Weight vectors in each dimension Add to adjust the weight vector The direction. Then, computing device 110 can use the sequence transformation parameters to randomly shuffle the trained weight matrix W. vic The weight vectors in at least some dimensions are ordered to obtain the first weight matrix (i.e., the first weight tensor). The first weight matrix can be represented as follows:

[0051] In some embodiments, the computing device 110 can acquire tensor scaling information, which may include a first scaling factor and a second scaling factor corresponding to each dimension of the trained weight tensor. For one dimension of the trained weight tensor, the computing device 110 can adjust the magnitude of the orientation transformation parameter for that dimension using the first scaling factor corresponding to that dimension to obtain the adjusted orientation transformation parameter. The computing device 110 can adjust the magnitude of the weight component using the second scaling factor corresponding to that dimension to obtain the adjusted weight component. Then, the computing device 110 can use the adjusted orientation transformation parameter to transform the orientation of the adjusted weight component to obtain the weight component of the orientation-transformed weight tensor in that dimension. For each dimension of the trained weight tensor, the computing device 110 can repeat the above process to obtain the weight component of the orientation-transformed weight tensor in the corresponding dimension. Thus, not only can the orientation of each weight component be adjusted, but also the magnitude of each weight component can be adjusted, further increasing the difficulty of restoring the first weight tensor and further improving the anti-attack capability of the machine learning model 140.

[0052] As an example, the trained weight tensor still includes the trained weight matrix. For example, computing device 110 can perform a transformation on the trained weight matrix using the following formula to obtain a first weight matrix.

[0053]

[0054] Where v represents the direction transformation vector (i.e., the direction transformation parameter); q represents the weight vector of the i-th dimension in the trained weight matrix; i Indicates and The corresponding first scaling factor; p i Indicates and The corresponding second scaling factor; Π represents the order transformation parameter, used to randomly shuffle the order.

[0055] In some embodiments, the first model layer may be the first model layer of the machine learning model 140. In this case, the computing device 110 may determine the input feature representation for the first model layer based on the model input of the machine learning model 140, and use it as the input feature representation of the first model layer.

[0056] In some embodiments, the first model layer may not be the first model layer of the machine learning model 140. In this case, the input feature representation of the first model layer may be the output feature representation of the second model layer preceding the first model layer in the machine learning model 140. If the processing of the second model layer is performed entirely in the processing unit 120, the computing device 110 can obtain the output feature representation of the second model layer from the processing unit 120 as the input feature representation for the first model layer. If part of the processing of the second model layer is performed in the trusted execution environment 130, and the output feature representation of the second model layer is generated in the trusted execution environment 130, the computing device 110 can transfer the output feature representation corresponding to the second model layer from the trusted execution environment 130 to the processing unit 120 as the input feature representation for the first model layer.

[0057] Return to combination Figure 2 As shown in block 220, computing device 110 generates a first feature tensor for a first model layer by processing the input feature representation using a first weight tensor in processing unit 120. In some embodiments, the order transformation parameters of the first model layer may also be deployed in trusted execution environment 130. Computing device 110 may process the input feature representation using the first weight tensor in processing unit 120 to generate a second feature tensor. Subsequently, computing device 110 may update the order of at least a portion of the components in the second feature tensor in trusted execution environment 130 using the order transformation parameters to obtain the first feature tensor.

[0058] As an example, the first weight tensor may include a first weight matrix W. obf In this example, computing device 110 can generate the first feature tensor based on the following formula:

[0059] Y' = X·W obf (2)

[0060] Y"=Y'·Π -1 (3)

[0061] Where Y′ represents the second feature matrix (i.e., the second feature tensor), X represents the input feature representation of the first model layer; Y″ represents the first feature matrix (i.e., the first feature tensor), and Π represents the order transformation parameter. Specifically, the computing device 110 can generate the second feature matrix Y′ using the above formula (2) in a normal execution environment, such as a GPU. Then, the computing device 110 can restore the order of the feature vectors in each dimension of the second feature matrix Y′ based on the order transformation parameter using the above formula (3) in a TEE, such as a CPU, to obtain the first feature matrix Y″. In this way, the intensive computation process for the input feature representation is executed in a normal execution environment, which can ensure inference performance. The order restoration process for the feature vectors in the second feature matrix Y′ is executed in a TEE, which can avoid leakage of the order transformation parameter.

[0062] Continue to combine Figure 2 As shown in block 230, computing device 110 can transfer the input feature representation and the first feature tensor from processing unit 120 to trusted execution environment 130. The data transfer between processing unit 120 and trusted execution environment 130 can be implemented using any suitable communication mechanism. In some examples, computing device 110 can utilize a communication channel such as a bus to transfer the input feature representation and the first feature tensor from processing unit 120 to trusted execution environment 130. In other examples, computing device 110 can also utilize, for example, shared storage space between processing unit 120 and trusted execution environment 130 to implement the transfer of input feature representation and the first feature tensor. It is understood that the data transfer method between processing unit 120 and trusted execution environment 130 may differ depending on the device type and system architecture of computing device 110. The embodiments of this disclosure do not limit this.

[0063] In box 240, computing device 110, within trusted execution environment 130, processes the input feature representation using orientation transformation parameters to generate an orientation correction tensor. This orientation correction tensor is used to correct the orientation of the first feature tensor. It is understood that the specific process of processing the input feature representation using orientation transformation parameters here depends primarily on the process by which the orientation transformation parameters transform the trained weight tensor. Depending on the process of processing the trained weight tensor using orientation transformation parameters, the process of processing the input feature representation using orientation transformation parameters here may also differ.

[0064] In some embodiments, the orientation transformation parameters may include an orientation transformation vector v, and the computing device 110 may generate an orientation correction tensor in the TEE based on the following formula:

[0065] R v =X·v (4)

[0066] Among them, Rv X represents the direction correction vector (i.e., the direction correction tensor); X represents the input feature representation. Of course, the above processing procedure is merely exemplary, and the embodiments of this disclosure do not impose specific limitations in this regard.

[0067] In box 250, computing device 110, within trusted execution environment 130, modifies a first feature tensor based on a direction correction tensor to determine the output feature representation corresponding to the first model layer. It is understood that the process of modifying the first feature tensor based on the direction correction tensor largely depends on the processing of the trained weight tensor using direction transformation parameters. The process of modifying the first feature tensor using the direction correction tensor may differ depending on the processing of the trained weight tensor using different direction transformation parameters. Embodiments of this disclosure do not limit this process.

[0068] In some embodiments, as described in the foregoing analysis, the orientation of the weight components in each dimension of the trained weight tensor can be adjusted using orientation transformation parameters to obtain a first weight tensor. Based on this, the computing device 110 can use the orientation correction tensor in the trusted execution environment 130 to correct the orientation of the feature components in each dimension of the first feature tensor to determine the output feature representation corresponding to the first model layer. As an example, the computing device 110 can use the orientation correction vector R in the TEE. v The eigenvectors in each dimension of the first feature matrix Y″ are corrected to obtain the eigenvectors in the corresponding dimensions of the output feature matrix.

[0069] In some embodiments, the trained weight tensor of the first model layer can be adjusted using orientation transformation parameters and tensor scaling information to obtain the first weight tensor of the first model layer. Based on this, the computing device 110 can, within the trusted execution environment 130, correct the orientation and magnitude of the feature components of the first feature tensor in each dimension based on the orientation correction tensor and tensor scaling information to obtain the output feature representation of the first model layer.

[0070] In some embodiments, the tensor scaling information includes a first scaling factor and a second scaling factor corresponding to the feature components in each dimension of the first feature tensor. The computing device 110 can use the first scaling factor corresponding to the feature component in that dimension to adjust the size of the orientation correction tensor relative to that dimension. The computing device 110 can use the adjusted orientation correction tensor to correct the orientation of the feature components to obtain the corrected feature components. Then, the computing device 110 can use the second scaling factor to adjust the size of the corrected feature components.

[0071] As an example, the first feature tensor may include a first feature matrix Y″ = [y″1, y″2, ..., y″] n ],y″ iThis represents the eigenvector of the i-th dimension in the first feature matrix Y″. Tensor scaling information can include the eigenvector of y″. i The corresponding first scaling factor q i Represents the second scaling factor p i In this case, computing device 110 can determine the feature vector of the i-th dimension in the output feature representation using the following formula in the TEE:

[0072] y i =(y″ i -q i ·R v ) / p i (5)

[0073] Understandably, computing device 110 can use formula (5) to process the feature vectors in each dimension of the first feature matrix to obtain the output feature representation of the first model layer.

[0074] In some embodiments, the first model layer may be the last model layer in the machine learning model 140. In this case, the output feature representation of the first model layer is the model output of the machine learning model 140. The computing device 110 may use the output feature representation of the first model layer as the model output of the machine learning model 140.

[0075] In some embodiments, the first model layer may not be the last processing layer of the machine learning model 140. In this case, the computing device 110 can provide the output feature representation corresponding to the first model layer from the trusted execution environment 130 to the processing unit 120 as the input feature representation for the next processing layer of the first model layer in the machine learning model 140. It should be noted that the machine learning model 140 may have multiple processing layers deployed in the trusted execution environment 120. During each inference process of the machine learning model 140, the computing device 110 may need to repeatedly execute the above process 200 multiple times.

[0076] With the development of machine learning model-related technologies, many open-source databases provide pre-trained machine learning models. Developers can obtain pre-trained machine learning models from these databases. By constructing a training dataset according to specific task requirements and fine-tuning the parameters of the pre-trained machine learning model using this dataset, a machine learning model that meets the specific task requirements can be obtained. This not only shortens the training cycle but also saves required computing resources, thus reducing training costs. Observation of this machine learning model formed by fine-tuning a pre-trained machine learning model reveals a strong similarity between the directions of the weight tensors in the trained machine learning model and those in the pre-trained model. This similarity can be easily exploited by attackers to attack the edge machine learning model.

[0077] In view of this, some embodiments of this disclosure also provide a model testing scheme for testing the attack resistance of the machine learning model 140. Part or all of this model testing process can be implemented by the computing device 110, by the computing device 110 in conjunction with other devices, or by other devices, such as the server 150. In the following discussion, for ease of discussion, the execution of this process is described from the perspective of the computing device 110, but this is merely exemplary.

[0078] In some embodiments of this disclosure, computing device 110 can determine the pre-trained weight tensor and obfuscated weight tensor of the first model layer of machine learning model 140. In some embodiments, computing device 110 can determine the type of the machine learning model 140 being tested. Based on the type of machine learning model 140, a pre-trained machine learning model 140 is obtained from a publicly available database. Then, computing device 110 can obtain the pre-trained weight tensor of the first model layer in the pre-trained machine learning model 140 and the obfuscated weight tensor of the first model layer in the trained machine learning model 140. Here, the obfuscated weight tensor refers to the weight tensor obtained after obfuscating the trained weight tensor of the first model layer; for example, the obfuscated weight tensor may include the first weight tensor of the first model layer.

[0079] As an example, such as Figure 3 As shown in Figure 310, assuming that the pre-trained weight tensor corresponding to the first model layer in the pre-trained machine learning model 140 includes the pre-trained weight matrix... Pre-trained weight matrix W pre Including weight vector Weight vector Weight vector and weight vector like Figure 3 As shown in Figure 320, the trained weight tensor of the first model layer may include the trained weight matrix W. vic After training the weight matrix W vic Including weight vector Weight vector Weight vector and weight vector Clearly, the direction and magnitude of the weight vectors in the trained weight matrix have changed compared to the pre-trained weight matrix. However, the direction and magnitude of the weight vectors in the trained weight matrix still show a high degree of similarity to those in the pre-trained weight matrix.

[0080] like Figure 3 As shown in Figure 330, the confusion weight tensor can include the confusion weight matrix W. obf Confusion weight matrix Wobf It can include weight vectors Weight vector Weight vector and weight vector Clearly, if only the order and size of the weight vectors are adjusted, the directional similarity between the confused weight vectors and the pre-trained weight vectors can be preserved.

[0081] In some embodiments of this disclosure, computing device 110 determines the correspondence between weight components in each dimension of the pre-trained weight tensor and weight components in each dimension of the first weight tensor. In some embodiments, computing device 110 may determine the correspondence between weight components in each dimension of the pre-trained weight tensor and weight components in each dimension of the first weight tensor based on directional similarity.

[0082] As an example, such as Figure 3 As shown, computing device 110 can determine the vector direction of each weight vector in the pre-training matrix. Computing device 110 can also determine the vector direction of each weight vector in the confusion weight matrix. Then, computing device 110 can use the mapping function σ(·) shown below to determine the mapping relationship between the weight vectors in the pre-training matrix and the weight vectors in the confusion weight matrix:

[0083]

[0084] Where σ(i) represents the directional similarity; This indicates the vector direction of the weight vector in the i-th dimension of the pre-training matrix; This indicates the vector direction of the weight vector in the i-th dimension of the confusion weight matrix; express and Direction distance between them indicates and The directional similarity between them. Specifically, the computing device 110 can use formula (6) to determine the pair of weight vectors with the smallest directional distance from the pre-trained weight matrix and the confusion weight matrix, and thus determine that there is a mapping relationship between this pair of weight vectors. For example, according to Figure 3 The mapping relationship shown in Figure 340 is determined by the weight vector. Mapping to weight vector Weight vector Mapping to weight vector Weight vector Mapping to weight vector Weight vector Mapping to weight vector

[0085] In some embodiments of this disclosure, the computing device 110 adjusts the order of weight components in at least some dimensions of the obfuscated weight tensor based on the correspondence to obtain a recovered weight tensor. Specifically, the computing device 110 can adjust the order of weight components in at least some dimensions of the obfuscated weight tensor based on the order and correspondence between weight components in each dimension of the pre-trained weight tensor to obtain a recovered weight tensor. As an example, such as Figure 3 As shown, computing device 110 can adjust the confusion weight matrix based on the correspondence. By retrieving the order of the weight vectors, the recovered weight matrix is ​​obtained. Where the weight vector With weight vector Correspondingly, the weight vector With weight vector Correspondingly, the weight vector With weight vector Correspondingly, the weight vector With weight vector Correspondingly.

[0086] In some embodiments of this disclosure, the computing device 110 determines an evaluation result of the attack resistance of the machine learning model 140 based on the recovered weight tensor and the trained weight tensor of the first model layer. In some embodiments, the computing device 110 may compare the directional similarity and size similarity between the weight components of each dimension in the recovered weight tensor and the weight components of each dimension in the trained weight tensor. Then, the computing device 110 may determine the evaluation result of the attack resistance of the machine learning model 140 based on the directional similarity and size similarity. Specifically, higher directional similarity and size similarity indicate lower attack resistance of the machine learning model 140. Lower directional similarity and size similarity indicate higher attack resistance of the machine learning model 140.

[0087] In some embodiments, the computing device 110 can determine the restoration coefficient based on the ratio between a pair of weight components that have a mapping relationship in the pre-trained weight tensor and the confused weight tensor. Based on the restoration coefficient and the weight components of the corresponding dimension in the confused weight tensor, the weight components of the corresponding dimension in the restored weight tensor are determined.

[0088] As an example, computing device 110 can determine the coefficient of recovery based on the following formula:

[0089]

[0090] in, Indicates the coefficient of restitution; Represents the weight vector Length; Represents the weight vector The length.

[0091] The computing device 110 can also determine the weight components of each dimension in the recovered weight tensor based on the following formula:

[0092]

[0093] Specifically, the computing device 110 can obtain the restored weight matrix based on the above formulas (7) and (8).

[0094] In some embodiments, the computing device 110 may also use a sample set to train the machine learning model 140 to adjust the recovered weight tensor of the first model layer. Then, the computing device 110 may determine an evaluation result of the machine learning model 140's resistance to attack based on the adjusted recovered weight tensor and the trained weight tensor.

[0095] As an example, computing device 110 can acquire multiple input samples. Computing device 110 can provide these multiple input samples to a machine learning model 140 containing a confusion weight tensor, and obtain the output of machine learning model 140 as multiple output samples corresponding to the multiple input samples, thus forming a sample set. Computing device 110 can use this sample set to adjust the recovered weight matrix of the first model layer. The computing device 110 can recover the weight matrix and the trained weight matrix The directional and size similarities between the corresponding weight vectors can be used to determine the evaluation results of the machine learning model 140's resistance to attacks.

[0096] It is understandable that the above example only uses the first model layer as an example to illustrate the evaluation result of the machine learning model 140's resistance to attacks. In practical applications, the evaluation result of the machine learning model 140's resistance to attacks can be determined by combining the recovered weight tensors and trained weight tensors of multiple processing layers in the machine learning model 140. For example, the evaluation result of the machine learning model 140's resistance to attacks can be determined by combining the recovered weight tensors and trained weight tensors of multiple processing layers that need to be deployed in the processing unit of the machine learning model 140.

[0097] In this manner, in the embodiments of this disclosure, the first weight tensor deployed in the processing unit is obtained by obfuscating the direction transformation parameters, which can effectively protect the orientation information of the trained weight tensor. In a trusted execution environment, only the input feature representation needs to be processed using the direction transformation parameters to generate the orientation correction tensor. Then, the orientation correction tensor is used to correct the orientation of the first feature tensor. Thus, the computational load in the trusted execution environment is relatively small, the inference speed is relatively fast, and the goal of balancing model privacy and inference performance can be achieved.

[0098] Example devices and equipment

[0099] Embodiments of this disclosure also provide corresponding apparatus for implementing the above methods or processes. Figure 4 A schematic structural block diagram of an example device 400 for protecting a model according to certain embodiments of the present disclosure is shown. Device 400 may be implemented as or included in computing device 110. Various modules / components in device 400 may be implemented by hardware, software, firmware, or any combination thereof.

[0100] like Figure 4 As shown, the apparatus 400 includes: an acquisition module 410 configured to acquire an input feature representation for a first model layer in a machine learning model, the first model layer including orientation transformation parameters deployed in a trusted execution environment of a computing device and a first weight tensor deployed in a processing unit outside the trusted execution environment, the first weight tensor being obtained by transforming the trained weight tensor of the first model layer using the orientation transformation parameters; a generation module 420 configured to generate a first feature tensor for the first model layer by processing the input feature representation using the first weight tensor in the processing unit; a transmission module 430 configured to transmit the input feature representation and the first feature tensor to the trusted execution environment; a processing module 440 configured to process the input feature representation using the orientation transformation parameters in the trusted execution environment to generate an orientation correction tensor; and a correction module 450 configured to correct the first feature tensor based on the orientation correction tensor in the trusted execution environment to determine an output feature representation corresponding to the first model layer.

[0101] In some embodiments, the processing unit includes a first type of processing unit, and a trusted execution environment is deployed in a second type of processing unit.

[0102] In some embodiments, the acquisition module 410 is further configured to: receive, in the processing unit, an output feature representation corresponding to a second model layer in the machine learning model prior to the first model layer from a trusted execution environment, as an input feature representation for the first model layer.

[0103] In some embodiments, the generation module 420 is further configured to: process the input feature representation using a first weight tensor in a processing unit to generate a second feature tensor; and update the order of at least a portion of the components in the second feature tensor using order transformation parameters in a trusted execution environment to obtain a first feature tensor, wherein the order transformation parameters are deployed in the trusted execution environment.

[0104] In some embodiments, the correction module 450 is further configured to: in a trusted execution environment, correct the direction and magnitude of the feature components of the first feature tensor in each dimension based on the direction correction tensor and tensor scaling information, so as to obtain the output feature representation of the first model layer.

[0105] In some embodiments, the tensor scaling information includes a first scaling factor and a second scaling factor corresponding to the feature components in each dimension of the first feature tensor, and the correction module 450 is further configured to: adjust the size of the orientation correction tensor relative to the dimension using the first scaling factor corresponding to the feature components in that dimension; correct the orientation of the feature components using the adjusted orientation correction tensor to obtain the corrected feature components; and adjust the size of the corrected feature components using the second scaling factor.

[0106] In some embodiments, the apparatus 400 further includes a providing module configured to provide an output feature representation corresponding to the first model layer from a trusted execution environment to a processing unit as an input feature representation for a third model layer in a machine learning model following the first model layer.

[0107] In some embodiments, the apparatus 400 further includes: an obtaining module configured to obtain a first weight tensor by: transforming the orientation of the weight components of the trained weight tensor in each dimension using orientation transformation parameters to obtain an orientation-transformed weight tensor; and adjusting the order of at least some weight components in the orientation-transformed weight tensor using order transformation parameters to obtain the first weight tensor.

[0108] In some embodiments, the obtaining module is further configured to: adjust the magnitude of the orientation transformation parameter relative to the dimension using a first scaling factor in the tensor scaling information corresponding to the dimension, to obtain the adjusted orientation transformation parameter; adjust the magnitude of the weight component using a second scaling factor in the tensor scaling information corresponding to the dimension, to obtain the adjusted weight component; and transform the direction of the adjusted weight component using the adjusted orientation transformation parameter, to obtain the weight component of the orientation-transformed weight tensor in the dimension.

[0109] The units and / or modules included in device 400 can be implemented in various ways, including software, hardware, firmware, or any combination thereof. In some embodiments, one or more units and / or modules may be implemented using software and / or firmware, such as machine-executable instructions stored on a storage medium. In addition to or as an alternative to machine-executable instructions, some or all of the units and / or modules in device 500 may be implemented at least partially by one or more hardware logic components. By way of example and not limitation, exemplary types of hardware logic components that may be used include field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-chips (SoCs), complex programmable logic devices (CPLDs), and so on.

[0110] Figure 5 A block diagram of an electronic device 500 in which one or more embodiments of the present disclosure may be implemented is shown. It should be understood that... Figure 5 The electronic device 500 shown is merely exemplary and should not be construed as limiting the functionality and scope of the embodiments described herein. Figure 5 The illustrated electronic device 500 may include or be implemented as Figure 1 The computing device 110, or Figure 4 Device 400.

[0111] like Figure 5 As shown, electronic device 500 is in the form of a general-purpose electronic device. Components of electronic device 500 may include, but are not limited to, one or more processors 510, memory 520, storage device 530, one or more communication units 540, one or more input devices 550, and one or more output devices 560. Processor 510 may be a physical or virtual processor and is capable of performing various processes according to executable instructions stored in memory 520. In a multiprocessor system, multiple processors execute computer-executable instructions in parallel to improve the parallel processing capability of electronic device 500.

[0112] Electronic device 500 typically includes multiple computer storage media. Such media can be any accessible media that is accessible to electronic device 500, including but not limited to volatile and non-volatile media, removable and non-removable media. Memory 520 can be volatile memory (e.g., registers, cache, random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory), or some combination thereof. Storage device 530 can be removable or non-removable media and can include machine-readable media, such as flash drives, disks, or any other media that can be used to store information and / or data and can be accessed within electronic device 500.

[0113] Electronic device 500 may further include additional removable / non-removable, volatile / non-volatile storage media. Although not explicitly stated... Figure 5 As shown, disk drives for reading from or writing to removable, non-volatile disks (e.g., "floppy disks") and optical disk drives for reading from or writing to removable, non-volatile optical disks can be provided. In these cases, each drive can be connected to a bus (not shown) via one or more data media interfaces. Memory 520 may include computer program product 525 having one or more executable instruction modules configured to perform various methods or actions of various embodiments of this disclosure.

[0114] Communication unit 540 enables communication with other electronic devices via a communication medium. Additionally, the functionality of components of electronic device 500 can be implemented using a single computing cluster or multiple computing machines capable of communicating via communication connections. Therefore, electronic device 500 can operate in a networked environment using logical connections to one or more other servers, network personal computers (PCs), or another network node.

[0115] Input device 550 can be one or more input devices, such as a mouse, keyboard, trackball, etc. Output device 560 can be one or more output devices, such as a monitor, speaker, printer, etc. Electronic device 500 can also communicate with one or more external devices (not shown) via communication unit 540 as needed. These external devices include storage devices, display devices, etc., and can communicate with one or more devices that enable user interaction with electronic device 500, or with any device that enables electronic device 500 to communicate with one or more other electronic devices (e.g., network card, modem, etc.). Such communication can be performed via input / output (I / O) interface (not shown).

[0116] According to an exemplary implementation of this disclosure, a computer-readable storage medium is provided that stores computer-executable instructions thereon, wherein the computer-executable instructions are executed by a processor to implement the methods described above. According to an exemplary implementation of this disclosure, a computer-executable instruction product is also provided, which is tangibly stored on a non-transient computer-readable medium and includes computer-executable instructions that are executed by a processor to implement the methods described above.

[0117] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatuses, devices, and computer-executable instruction products implemented according to this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable and executable instructions.

[0118] These computer-executable instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-executable instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0119] Computer-executable instructions can be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions that execute on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0120] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer-executable instruction products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, executable instruction, or portion of instructions, which contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0121] Various implementations of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terminology used herein is chosen to best explain the principles, practical applications, or improvements to technology in the market, or to enable others skilled in the art to understand the various implementations disclosed herein.

Claims

1. A method for protecting a model security, comprising: obtaining an input feature representation for a first model layer in a machine learning model, the first model layer comprising a direction transformation parameter deployed in a trusted execution environment of a computing device and a first weight tensor deployed in a processing unit outside the trusted execution environment, the first weight tensor being transformed from a trained weight tensor of the first model layer using the direction transformation parameter; generating a first feature tensor for the first model layer by at least processing the input feature representation using the first weight tensor in the processing unit; transmitting the input feature representation and the first feature tensor to the trusted execution environment; processing the input feature representation using the direction transformation parameter in the trusted execution environment to generate a direction correction tensor; and correcting the first feature tensor based on the direction correction tensor in the trusted execution environment to determine an output feature representation corresponding to the first model layer; wherein the generating the first feature tensor for the first model layer comprises: processing the input feature representation using the first weight tensor in the processing unit to generate a second feature tensor; and updating, in the trusted execution environment, an order of at least a portion of components in the second feature tensor using a sequential transformation parameter deployed in the trusted execution environment to obtain the first feature tensor. 2.The method of claim 1, wherein the processing unit comprises a first type of processing unit, and the trusted execution environment is deployed in a second type of processing unit. 3.The method of claim 1, wherein the obtaining the input feature representation for the first model layer comprises: receiving, in the processing unit, an output feature representation corresponding to a second model layer preceding the first model layer in the machine learning model from the trusted execution environment as the input feature representation for the first model layer. 4.The method of claim 1, wherein the correcting the first feature tensor based on the direction correction tensor comprises: correcting, in the trusted execution environment, a direction and a size of a feature component in each dimension of the first feature tensor based on the direction correction tensor and tensor scaling information to obtain an output feature representation of the first model layer. 5.The method of claim 4, wherein the tensor scaling information comprises a first scaling factor and a second scaling factor corresponding to the feature component in each dimension of the first feature tensor, and the correcting the direction and the size of the feature component in each dimension of the first feature tensor comprises: adjusting a size of the direction correction tensor for the dimension using the first scaling factor corresponding to the feature component in the dimension; correcting a direction of the feature component using the adjusted direction correction tensor to obtain a corrected feature component; and adjusting a size of the corrected feature component using the second scaling factor. 6.The method of claim 1, further comprising: ​ ​ ​ provide, from the trusted execution environment, an output feature representation corresponding to the first model layer to the processing unit as an input feature representation for a third model layer in the machine learning model subsequent to the first model layer.

7. The method of claim 1, wherein the first weight tensor is obtained by: transforming, with the direction transformation parameter, a direction of a weight component of the trained weight tensor in each dimension to obtain a direction-transformed weight tensor; and adjusting, with a sequential transformation parameter, a sequence of at least some of the weight components in the direction-transformed weight tensor to obtain the first weight tensor.

8. The method of claim 7, wherein transforming the direction of the weight component of the trained weight tensor in each dimension comprises: adjusting, with a first scaling factor corresponding to the dimension in the tensor scaling information, a size of the direction transformation parameter for the dimension to obtain an adjusted direction transformation parameter; adjusting, with a second scaling factor corresponding to the dimension in the tensor scaling information, a size of the weight component to obtain an adjusted weight component; and transforming, with the adjusted direction transformation parameter, a direction of the adjusted weight component to obtain the weight component of the direction-transformed weight tensor in the dimension.

9. An apparatus for protecting a model, comprising: an obtaining module configured to obtain an input feature representation for a first model layer in a machine learning model, the first model layer comprising a direction transformation parameter deployed in a trusted execution environment of a computing device and a first weight tensor deployed in a processing unit outside the trusted execution environment, the first weight tensor being obtained by transforming a trained weight tensor of the first model layer with the direction transformation parameter; a generating module configured to generate a first feature tensor for the first model layer by at least processing the input feature representation with the first weight tensor in the processing unit; a transmitting module configured to transmit the input feature representation and the first feature tensor to the trusted execution environment; a processing module configured to process, in the trusted execution environment, the input feature representation with the direction transformation parameter to generate a direction correction tensor; and a correcting module configured to correct, in the trusted execution environment, the first feature tensor based on the direction correction tensor to determine an output feature representation corresponding to the first model layer; wherein the generating module is further configured to process the input feature representation with the first weight tensor in the processing unit to generate a second feature tensor, and update, in the trusted execution environment, a sequence of at least some components in the second feature tensor with a sequential transformation parameter deployed in the trusted execution environment to obtain the first feature tensor.

10. An electronic device, comprising: at least one processor; and ​ ​ ​ at least one memory coupled to the at least one processor and storing instructions for execution by the at least one processor, the instructions, when executed by the at least one processor, cause the electronic device to perform the method according to any one of claims 1-8.

11. A computer-readable storage medium having computer-executable instructions stored thereon that are executable by a processor to implement the method according to any one of claims 1-8.

12. A computer program product comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the method according to any one of claims 1-8.

Images