Model encryption method and device, model decryption method and device

Abstract

The application discloses a model encryption method and device, a model decryption method and device, and comprises the following steps: performing parameter confusion processing on original parameters of at least one target network layer in a to-be-encrypted model to obtain a model after parameter confusion processing and parameter confusion data, wherein the parameter confusion data is used for restoring the original parameters of the target network layer before the parameter confusion processing; intercepting at least one target byte block from a corresponding target byte stream of the model after the parameter confusion processing; performing encryption processing on each target byte block to obtain a corresponding encrypted byte block and encryption data of each target byte block; replacing each target byte block in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used for indicating the position of the encrypted byte block in the encrypted byte stream; and integrating the encrypted byte stream and the parameter confusion data, the encryption data and the position index data after the encryption processing to obtain model encryption data of the model.

Description

Technical Field

[0001] This application relates to the field of model encryption technology, and in particular to a model encryption method and apparatus, and a model decryption method and apparatus. Background Technology

[0002] With the development of deep learning technology, deep learning-based models are widely used in various industries. As the core technology of model development companies, these companies often encrypt their models to prevent others from obtaining their parameters.

[0003] Currently, model encryption methods typically include the following two types: One is to use encryption algorithms such as AES (Advanced Encryption Standard, a symmetric encryption algorithm) to fully encrypt the model file. This encryption method requires the full decryption of the model file before model inference can be started. Full decryption is time-consuming, slowing down the start-up speed of model inference and resulting in a large model inference latency. Moreover, since the fully decrypted model file exists in plaintext, model parameters are easily leaked. The other type is to use secure multi-party computation, homomorphic encryption, and other techniques to encrypt the model. This encryption method allows the model to be inferred in ciphertext form during model application. Although the possibility of model parameter leakage is small in ciphertext form, the computational and communication overhead of model inference is large, resulting in a large model inference latency.

[0004] Therefore, how to reduce the possibility of model parameter leakage while minimizing the model inference latency caused by model encryption has become an urgent problem to be solved. Summary of the Invention

[0005] This application proposes a model encryption method and apparatus, and a model decryption method and apparatus, with the main purpose of reducing the possibility of model parameter leakage while reducing the model inference latency caused by model encryption.

[0006] To achieve the above objectives, this application mainly provides the following technical solutions:

[0007] In a first aspect, this application provides a model encryption method, which includes: performing parameter obfuscation on the original parameters of at least one target network layer in the model to be encrypted, obtaining a parameter-obfuscated model and parameter-obfuscated data, wherein the parameter-obfuscated data is used to restore the original parameters of the target network layer before parameter obfuscation; extracting at least one target byte block from the corresponding target byte stream of the parameter-obfuscated model; encrypting each target byte block to obtain a corresponding encrypted byte block and encrypted data, wherein the encrypted data is used to restore the corresponding target byte block of the encrypted byte block; replacing each target byte block in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream; and integrating the encrypted byte stream, the parameter-obfuscated data, the encrypted data, and the position index data to obtain the model encryption data of the model to be encrypted.

[0008] Secondly, this application provides a model decryption method, which may include: obtaining model encryption data of a model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted using the model encryption method described in the first aspect; loading the encrypted byte stream included in the model encryption data, and decrypting the encrypted data and position index data included in the model encryption data; locating the encrypted byte blocks in the encrypted byte stream based on the decrypted position index data; performing decryption processing on each encrypted byte block based on the decrypted encrypted data to restore the corresponding target byte block of each encrypted byte block; replacing each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted; performing model conversion processing on the target byte stream to obtain the model to be decrypted; if the model to be decrypted is called for business inference, then for each target network layer applied to the model to be decrypted, the parameter obfuscation data corresponding to the target network layer included in the model encryption data is decrypted, and the original parameters of the target network layer before parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer performs business inference based on the original parameters.

[0009] Thirdly, this application provides a model encryption device, which includes:

[0010] The first processing module is used to perform parameter obfuscation processing on the original parameters of at least one target network layer in the model to be encrypted, to obtain the parameter obfuscated model and parameter obfuscation data. The parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation processing.

[0011] The extraction module is used to extract at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation.

[0012] The second processing module is used to encrypt each target byte block to obtain a corresponding encrypted byte block and encrypted data for each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block.

[0013] The first replacement module is used to replace each target byte block in the target byte stream with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream.

[0014] An integration module is used to integrate the encrypted byte stream with the encrypted parameter obfuscation data, encrypted data, and position index data to obtain the model encryption data of the model to be encrypted.

[0015] Fourthly, this application provides a model decryption apparatus, which includes:

[0016] The acquisition module is used to acquire the encrypted model data of the model to be decrypted, wherein the encrypted model data is obtained by encrypting the model to be decrypted using the model encryption method described in the first aspect;

[0017] The processing module is used to load the encrypted byte stream included in the model encrypted data and decrypt the encrypted data and position index data included in the model encrypted data;

[0018] The positioning module is used to locate the encrypted byte block in the encrypted byte stream based on the decrypted position index data;

[0019] The restoration module is used to decrypt each encrypted byte block based on the decrypted encrypted data and restore the corresponding target byte block for each encrypted byte block.

[0020] The second replacement module is used to replace each target byte block in the encrypted byte stream with a corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted.

[0021] The conversion module is used to perform model conversion processing on the target byte stream to obtain the model to be decrypted;

[0022] The calling module is configured to, if the model to be decrypted is called for business inference, decrypt the parameter obfuscation data of the target network layer included in the encrypted data of the model for each target network layer applied to the model to be decrypted, and restore the original parameters of the target network layer before parameter obfuscation based on the decrypted parameter obfuscation data, so that the target network layer can perform business inference based on the original parameters.

[0023] Fifthly, this application provides a computer-readable storage medium comprising a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the model encryption method described in the first aspect, and / or execute the model decryption method described in the second aspect.

[0024] In a sixth aspect, this application provides an electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the model encryption method described in the first aspect, and / or to perform the model decryption method described in the second aspect.

[0025] The model encryption method and apparatus, and model decryption method and apparatus provided in this application encrypt the model by first obfuscating the original parameters of at least some network layers of the model, then extracting target byte blocks from the byte stream of the obfuscated model and encrypting the target byte blocks, and finally replacing the original extracted target byte blocks with the encrypted byte blocks. It can be seen that the solution provided in this embodiment encrypts the model from two dimensions: parameter obfuscation and byte encryption, thereby achieving at least the following technical effects: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be restored simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the restored byte stream, thus reducing the model inference latency caused by model encryption. Second, since the parameters of at least some network layers of the model are obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thus reducing the possibility of leakage of the model's original parameters. Third, when inferring the model based on the restored byte stream, only the parameters of the currently applied network layers are restored, while the parameters of the network layers not currently applied are not restored. This not only ensures the smooth progress of model inference based on the restored original parameters, but also minimizes the possibility of model parameter leakage.

[0026] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 A flowchart of a model encryption method provided in one embodiment of this application is shown;

[0029] Figure 2 A flowchart of a model decryption method provided in one embodiment of this application is shown;

[0030] Figure 3 This illustration shows a schematic diagram of a target network layer of a model provided in one embodiment of this application;

[0031] Figure 4 A schematic diagram of a model encryption process provided in one embodiment of this application is shown;

[0032] Figure 5 A schematic diagram of a model decryption process provided in one embodiment of this application is shown;

[0033] Figure 6 This illustration shows a schematic diagram of a model encryption device according to an embodiment of this application;

[0034] Figure 7 A schematic diagram of a model encryption device provided in another embodiment of this application is shown;

[0035] Figure 8 This illustration shows a schematic diagram of a model decryption device according to an embodiment of this application;

[0036] Figure 9 A schematic diagram of a model decryption device provided in another embodiment of this application is shown. Detailed Implementation

[0037] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0038] Models are the core technology of model development companies. If the parameters of a model become known to others, it will lead to at least two negative consequences: First, the party with access to the model can directly use it, which is tantamount to infringing on the rights of the model development company and weakening its technological competitiveness. Second, the party with access to the model can launch a white-box attack based on the model parameters, causing the model to misjudge or malfunction, thereby creating negative public opinion about the model's application, damaging its reputation, and weakening its market competitiveness. Based on these two negative consequences, model development companies typically encrypt their models to reduce the possibility of model parameters being leaked.

[0039] Existing model encryption methods that fully encrypt model files using algorithms like AES require complete decryption of the model file before inference can begin. This decryption process is time-consuming, slowing down inference startup and resulting in significant latency. Furthermore, the plaintext nature of the decrypted model file increases the risk of parameter leakage. While existing methods using secure multi-party computation and homomorphic encryption encrypt the model in ciphertext, reducing parameter leakage, the computational and communication overhead of ciphertext inference also increases latency. Therefore, current model encryption methods struggle to simultaneously reduce the likelihood of parameter leakage and the resulting inference latency, ultimately leading to poor model performance.

[0040] Research has shown that when encrypting a model, the original parameters of at least some network layers can be obfuscated first, and the obfuscated data can be recorded. This obfuscated data is used to restore the original parameters of these network layers before obfuscation. Then, byte blocks are extracted from the corresponding byte stream of the obfuscated model and encrypted to obtain the encrypted model. This approach encrypts the model from two dimensions: parameter obfuscation and byte encryption. This achieves at least the following technical benefits: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be restored simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the restored byte stream, thus reducing inference latency caused by model encryption. Second, because the parameters of at least some network layers are obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thus reducing the possibility of original parameter leakage. Third, when inferring based on the restored byte stream, only the parameters of the currently applied network layers that have undergone parameter obfuscation are restored, while the parameters of network layers that have undergone parameter obfuscation but are not currently applied are not restored. This not only ensures the smooth progress of model inference based on the restored original parameters, but also minimizes the possibility of model parameter leakage.

[0041] Based on the above findings, this embodiment provides a specific model encryption technical solution, which includes: obfuscating the original parameters of at least one target network layer in the model to be encrypted to obtain an obfuscated model and obfuscated parameter data, wherein the obfuscated parameter data is used to restore the original parameters of the target network layer before obfuscation; extracting at least one target byte block from the corresponding target byte stream of the obfuscated model; encrypting each target byte block to obtain an encrypted byte block and encrypted data for each target byte block, wherein the encrypted data is used to restore the corresponding target byte block of the encrypted byte block; replacing each target byte block in the target byte stream with the corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream; and integrating the encrypted byte stream, the obfuscated parameter data, the encrypted data, and the position index data to obtain the model encryption data of the model to be encrypted.

[0042] Accordingly, based on the above-mentioned model encryption technical solution, this embodiment also proposes a model decryption technical solution, specifically as follows: Obtain the model encryption data of the model to be decrypted, which is obtained by encrypting the model to be decrypted using the above-mentioned model encryption technical solution; load the encrypted byte stream included in the model encryption data, and decrypt the encrypted data and position index data included in the model encryption data; locate the encrypted byte blocks in the encrypted byte stream based on the decrypted position index data; perform decryption processing on each encrypted byte block based on the decrypted encrypted data to restore the corresponding target byte block for each encrypted byte block; replace each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted; perform model conversion processing on the target byte stream to obtain the model to be decrypted; if the model to be decrypted is called for business inference, then for each target network layer applied to the model to be decrypted, the parameter obfuscation data corresponding to the target network layer included in the model encryption data is decrypted, and the original parameters of the target network layer before parameter obfuscation processing are restored based on the decrypted parameter obfuscation data, so that the target network layer can perform business inference based on the original parameters.

[0043] The model encryption and decryption technical solutions provided in this embodiment can be applied to any type of model, and this embodiment does not limit the type of model. For example, the model may include, but is not limited to, large models based on deep learning technology. Furthermore, the model's inference capabilities can be flexibly selected based on business needs. For example, the model's inference capabilities may include, but are not limited to, network security assessment, image recognition, and speech recognition. Based on the above model encryption and decryption technical solutions, this embodiment specifically provides a model encryption method and apparatus, and a model decryption method and apparatus. The model encryption method and apparatus and the model decryption method and apparatus provided in this embodiment will be described in detail below.

[0044] This application provides a model encryption method, such as... Figure 1 As shown, the model encryption method provided in this embodiment may include at least the following steps 101 to 105.

[0045] 101. Perform parameter obfuscation on the original parameters of at least one target network layer in the encryption model to obtain the obfuscated model and parameter obfuscation data. The parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation.

[0046] The methods for determining the model to be encrypted can include the following two: First, monitor whether a newly added model exists in a designated space, which is used to store models that need to be encrypted; if so, the newly added model is determined as the model to be encrypted. The newly added model may include, but is not limited to, newly developed models and upgraded versions of previously developed models. Second, listen for whether a specified instruction for the model to be encrypted is received; if so, the model specified by the specified instruction is determined as the model to be encrypted. The specified instruction can be delivered via voice, text, or other means. At least one of the above two methods for determining the model to be encrypted can be flexibly selected based on business needs; this embodiment does not limit this selection.

[0047] After determining the model to be encrypted, at least one target network layer needs to be selected from the network layers included in the model to obfuscate the original parameters of the target network layer. This obfuscation hides the original parameters of the target network layer, thereby reducing the possibility of the original parameters being leaked. Based on this, the model encryption method provided in this embodiment may further include a step of selecting a target network layer. The implementation methods for this step can include at least the following five:

[0048] The first method involves selecting the key network layer in the model to be encrypted as the target network layer.

[0049] The key network layer is the network layer that influences the model's inference, determining its functionality and performance. Once the original parameters of the key network layer are known to others, those who know them can train or fine-tune the same model based on these original parameters, and can also launch white-box attacks on the model based on these original parameters, causing it to misjudge or malfunction. Based on this, the key network layer in the model to be encrypted is selected as the target network layer.

[0050] In some embodiments, different types of models have different key network layers. Based on this, the key network layers are determined according to the type of the model to be encrypted. For example, if the model to be encrypted is a convolutional neural network, the determined key network layers include convolutional layers, pooling layers, and fully connected layers. As another example, if the model to be encrypted is a recurrent neural network, the determined key network layers include recurrent layers and embedding layers.

[0051] The second method involves selecting a first target number of network layers suitable for the total number of network layers in the model to be encrypted, based on the pre-defined correspondence between at least one range of the total number of network layers and the target number; and selecting the first target number of target network layers from the network layers of the model to be encrypted.

[0052] In some embodiments, to improve the efficiency of selecting target network layers, a correspondence between at least one range of the total number of network layers and the target number can be summarized in advance based on a large amount of encryption experience from past models. Thus, after determining the model to be encrypted, a first target number of network layers applicable to the total number of network layers in the model to be encrypted is directly selected based on the correspondence, and a first target number of target network layers are selected from the network layers of the model to be encrypted.

[0053] It should be noted that the selected target network layers have any of the following characteristics: First, the first target number of target network layers are consecutive network layers in the model to be encrypted. For example, if the first number is 5, then the 10th to 14th network layers in the model to be encrypted are selected as target network layers. Second, there is at least one pair of first network layers in the first target number of target network layers, and the two first network layers in each pair are adjacent in the target network layers, and the two first network layers are separated by at least one network layer in the model to be encrypted. For example, if the first number is 5, then the 10th, 13th, 14th, 15th, and 16th network layers in the model to be encrypted are selected as target network layers. It can be seen that the 10th and 13th network layers are adjacent in all target network layers, and the 10th and 13th network layers are separated by the 11th to 12th network layers in the model to be encrypted. Third, in the second target number of target network layers, any two adjacent target network layers are separated by at least one network layer in the model to be encrypted, and there are at least two pairs of adjacent target network layers separated by different numbers of network layers. For example, if the first number is 5, then the 10th, 13th, 14th, 15th, and 17th network layers in the model to be encrypted are selected as target network layers. It can be seen that the 10th and 13th network layers are separated by the 11th and 12th network layers in the model to be encrypted, and the 15th and 17th network layers are separated by the 16th network layer in the model to be encrypted. The characteristics of the above three target network layers can be flexibly selected based on business needs, and this embodiment does not limit this. It should be noted that the more complex the characteristics of the target network layers, the higher the security brought by parameter obfuscation processing of the original parameters of these target network layers, the harder it is for malicious actors to find the cracking pattern, and the less likely it is to obtain the original parameters of the target network layers.

[0054] The third method involves selecting a target set of layer numbers suitable for the total number of network layers in the model to be encrypted, based on the pre-defined correspondence between at least one range of the total number of network layers and the set of layer numbers; and selecting the network layers whose layer numbers in the model to be encrypted are included in the target set of layer numbers as the target network layers.

[0055] In some embodiments, to improve the efficiency of selecting target network layers, a correspondence between at least one range of the total number of network layers and a set of layer numbers can be summarized in advance based on a large amount of encryption experience with past models. The set of layer numbers represents the layer numbers corresponding to the target network layers applicable to the corresponding range of the total number of network layers. Thus, after determining the model to be encrypted, the target set of layer numbers applicable to the total number of network layers in the model to be encrypted is directly selected based on the correspondence, and the network layers whose layer numbers in the model to be encrypted are included in the target set of layer numbers are selected as target network layers. For example, if the total number of network layers in the model to be encrypted is 20, and the target set of layer numbers applicable to the total number of network layers of 20 includes layer numbers 3, 6, and 8, then the 3rd, 6th, and 8th network layers in the model to be encrypted are selected as target network layers.

[0056] Fourthly, to enable the encryption party to flexibly select the target network layer based on its own business needs, the encryption party is granted the authority to issue network layer selection instructions. This allows the encryption party to select the network layer that meets its encryption requirements as the target network layer. Based on this, the system monitors whether a network layer selection instruction for the model to be encrypted is received; if so, the network layer specified in the instruction is selected as the target network layer.

[0057] Fifthly, considering that the more network layers involved in parameter obfuscation, the more secure the model, all network layers included in the model to be encrypted are selected as target network layers.

[0058] The above five implementation methods can be selected based on business needs, and this embodiment does not impose any limitations on this. It should be noted that when one method cannot meet the business needs, at least two of the first four implementation methods can be selected and used.

[0059] After selecting the target network layer, the original parameters of at least one target network layer in the encryption model are obfuscated. This step is implemented by performing the following steps 101A to 101C for each target network layer:

[0060] 101A. Determine the corresponding obfuscation factor and obfuscation processing logic for the current target network layer.

[0061] The methods for determining the obfuscation factor and obfuscation logic for the current target network layer can include the following two approaches: First, pre-defined obfuscation factors and logic are used as the corresponding obfuscation factors and logic for the current target network layer. This improves the efficiency of determining the obfuscation factors and logic. Second, a random obfuscation factor generation function is used to generate the corresponding obfuscation factor for the current target network layer, and a corresponding obfuscation logic is randomly selected from a variety of pre-defined obfuscation logics. This enhances the randomness of the obfuscation factors and logic. Based on this highly random obfuscation factor and logic, the original parameters of the current target network layer processed by the obfuscation factor and logic are more difficult to decipher, thus reducing the possibility of parameter leakage.

[0062] It should be noted that when there are at least two target network layers in the model to be encrypted, the obfuscation factors and obfuscation logic of each target network layer can be configured in two ways: First, the obfuscation factors and obfuscation logic of each target network layer are identical. This facilitates the rapid reconstruction of the original parameters of each target network layer before parameter obfuscation during subsequent model decryption, thereby enabling fast model inference and reducing the inference latency caused by model encryption. Second, at least one target network layer in the model to be encrypted contains target data that differs from the target data of other target network layers. This target data includes at least one of the following: obfuscation factor and obfuscation logic. This increases the complexity of the obfuscation factors and obfuscation logic among the target network layers. Based on the higher complexity of the obfuscation factors and obfuscation logic, the difficulty of deciphering the parameters can be increased, thereby reducing the possibility of parameter leakage.

[0063] 101B. Based on the confusion factor, the original parameters of the current target network layer are confused using confusion processing logic.

[0064] The obfuscation processing logic transforms the original parameters of the current target network layer into other parameters based on an obfuscation factor, thereby preserving the original parameters of the current target network layer. The obfuscation factor includes at least an obfuscation scaling factor and an obfuscation offset factor, and the obfuscation processing logic includes at least obfuscation scaling logic and obfuscation offset logic. The obfuscation scaling logic is used to scale the original parameters of the current target network layer based on the scaling factor. The obfuscation scaling logic can include, but is not limited to, any of the following: multiplication logic and division logic. The obfuscation offset logic is used to further offset the parameters obtained from the obfuscation scaling logic based on the offset factor. The obfuscation offset logic can include, but is not limited to, any of the following: addition logic and subtraction logic.

[0065] Based on this, the process of obfuscating the original parameters of the target network layer using obfuscation processing logic based on obfuscation factors can include: scaling the original parameters of the target network layer using obfuscation scaling logic based on obfuscation scaling factors; and offsetting the scaled parameters using obfuscation offset logic based on obfuscation offset factors to obtain the obfuscated parameters of the target network layer.

[0066] The parameters used in the parameter obfuscation process of the model to be encrypted can be flexibly selected based on business needs, and this embodiment does not impose any limitations on this. For example, the parameters used in the parameter obfuscation process of the model to be encrypted may include, but are not limited to, at least one of the following: weights, biases, scaling parameters, and offset parameters.

[0067] The following example uses the parameters of the model to be encrypted, which are involved in parameter obfuscation, as weights to illustrate the specific process of obfuscating the original parameters of the target network layer based on obfuscation factors and obfuscation processing logic. For example, if the obfuscation factors of the current target network layer k include an obfuscation scaling factor Ak and an obfuscation offset factor Bk, and the obfuscation processing logic includes obfuscation scaling logic (multiplication operation logic) and obfuscation offset logic (addition operation logic), then the specific process of obtaining the obfuscated parameters of the current target network layer can be expressed by the following formula: Wk' = Ak × Wk + Bk. Wk' represents the obfuscated parameters of the current target network layer k, Ak represents the obfuscation scaling factor Ak of ​​the current target network layer k, Bk represents the obfuscation offset factor of the current target network layer k, and Wk represents the original parameters of the current target network layer k before obfuscation.

[0068] 101C. Replace the original parameters of the current target network layer with the obfuscated parameters.

[0069] The original parameters of the current target network layer are replaced with obfuscated parameters to protect the original parameters of the current target network layer. This way, even if the obfuscated parameters are leaked, it will not affect the model itself.

[0070] After the original parameters of each target network layer of the model to be encrypted have been obfuscated, the obfuscated model and obfuscated data are obtained. The obfuscated model serves as the basis for subsequent encryption operations. The obfuscated data is used to restore the original parameters of the target network layers before obfuscation. The obfuscated data includes at least the identifier of each target network layer, as well as the corresponding obfuscation factor and obfuscation logic for each target network, to restore the original parameters of each target network layer before obfuscation. It should be noted that, to further ensure the security of the model, for any target network layer, the obfuscated data only supports restoring the original parameters of that target network layer before obfuscation when the model is called for business inference and the business inference is applied to that target network layer, so that the target network layer can perform business inference based on the restored original parameters. This method of restoring the original parameters of the target network layer while the model is inferring minimizes the possibility of the original parameters of the target network layer being leaked.

[0071] 102. Extract at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation.

[0072] After the original parameters of each target network layer of the model to be encrypted have been obfuscated, in order to further ensure the security of the model, further encryption operations are required. The first step of this encryption operation is to extract at least one target byte block from the target byte stream of the model after parameter obfuscation, so as to encrypt the model to be encrypted from the byte dimension based on the target byte block.

[0073] Before extracting at least one target byte block from the target byte stream of the model after parameter obfuscation, the model after parameter obfuscation needs to be converted into the corresponding target byte stream. This conversion process may include: determining the format of the model to be encrypted (e.g., bin format or safetensor format), and using a serialization tool corresponding to the format to convert the model after parameter obfuscation into the corresponding target byte stream.

[0074] After obtaining the target byte stream, the step of extracting at least one target byte block from the target byte stream of the model after parameter obfuscation is performed. The implementation methods for this step can include at least the following three:

[0075] Method 1, the specific process of extracting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation can include the following: based on the length of the first byte and the total length of the target byte stream, determine the first number of target byte blocks to be extracted from the target byte stream; select the first number of first bytes from the target byte stream according to the byte order of the target byte stream; starting with each first byte, extract the target byte block corresponding to each first byte with the length of the first byte.

[0076] This method extracts target sub-byte blocks based on the total length of the target byte stream and the preset first byte length. The first byte length is the empirical byte length evaluated from past model encryption instances, or the first byte length is the byte length customized by the encryption personnel for the model to be encrypted based on business needs.

[0077] When determining the initial quantity, first determine the ratio between the total byte length and the length of the first byte. Based on business needs, determine a quantity no greater than this ratio as the initial quantity of target byte blocks to be extracted from the target byte stream. It should be noted that the principles for determining the initial quantity are: first, if security is the primary concern, the initial quantity should be as close as possible to or exactly equal to the ratio; second, considering that a larger initial quantity increases the difficulty of encryption and decryption, the initial quantity can be much smaller than the ratio, but this much smaller initial quantity must still be a value that ensures the security of the model.

[0078] Following the byte order of the target byte stream, a first number of first bytes are selected from the target byte stream. Starting with each first byte, a target byte block of length one byte is extracted from each first byte. The first byte is the starting byte of each target byte block to be extracted. Each first byte is separated from its adjacent first byte by at least one byte in length to ensure that there are no byte overlaps between the extracted target byte blocks, thereby avoiding byte corruption in subsequent encrypted byte streams due to byte overlaps.

[0079] Method 2 involves extracting at least one target byte block from the target byte stream of the model after parameter obfuscation. The specific process may include the following: determining the second byte length of each target byte block to be extracted from the target byte stream; selecting the second byte required to extract each target byte block from the target byte stream according to the byte order of the target byte stream; extracting the target byte block with the corresponding second byte length from each second byte, starting with each second byte; wherein each second byte is separated from the next adjacent second byte by at least the corresponding second byte length.

[0080] Method 2 extracts target sub-byte blocks based on the second byte length of each target byte block. The second byte length is customized by the encryption personnel for each target byte block to be extracted according to business needs. The relationship between the second byte lengths of each target byte block to be extracted falls into two categories: first, all target byte blocks have the same second byte length; second, at least two target byte blocks have different second byte lengths. These two scenarios can be flexibly selected based on business needs, and this embodiment does not impose limitations on them.

[0081] Following the byte order of the target byte stream, the second byte required to extract each target byte block is selected from the target byte stream. Starting with each second byte, a target byte block of the corresponding second byte length is extracted. These second bytes serve as the starting bytes for each target byte block to be extracted. Each second byte is separated from its adjacent second byte by at least the corresponding second byte length. This ensures that there are no byte overlaps between the extracted target byte blocks, thus avoiding byte corruption in subsequent encrypted byte streams caused by byte overlaps.

[0082] Method three involves extracting at least one target byte block from the target byte stream of the model after parameter obfuscation. The specific process may include the following: Based on a pre-defined correspondence between the total data interval of at least one network layer and the sample layer sequence number set, a target sample layer sequence number set suitable for the total number of network layers in the model to be encrypted is selected. This target sample layer sequence number set includes at least one pair of layer sequence numbers, where one layer sequence number follows the other, and the layer sequence number intervals covered by different pairs of layer sequence numbers do not overlap. Based on each pair of layer sequence numbers included in the target sample layer sequence number set, the corresponding target byte block for each pair of layer sequence numbers is extracted from the target byte stream.

[0083] In some embodiments, to improve the efficiency of target byte block extraction, a correspondence between at least one total data range of a network layer and a set of sample layer indices can be summarized in advance based on a large amount of encryption experience from past models. Thus, after determining the byte stream, the target sample layer indices set applicable to the total number of network layers in the model can be directly selected based on the correspondence, and the target byte blocks corresponding to each pair of layer indices included in the target sample layer indices set can be extracted from the target byte stream.

[0084] The above three methods for extracting at least one target byte block from the target byte stream of the model after parameter obfuscation can be flexibly selected based on business needs, and this embodiment does not limit the choice of any one of them.

[0085] 103. Encrypt each target byte block to obtain the corresponding encrypted byte block and encrypted data for each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block.

[0086] After extracting the target byte block, it needs to be encrypted to protect the bytes included in the target byte block and prevent byte leakage. The methods for encrypting each target byte block to obtain the corresponding encrypted byte block and encrypted data can include at least the following two approaches:

[0087] The first method involves encrypting each target byte block to obtain the corresponding encrypted byte block and encrypted data. The specific process is as follows: For each target byte block, perform the following steps 103A to 103C:

[0088] 103A. Select at least one first byte block from at least one target byte block for the current target byte block.

[0089] To ensure encryption security, at least one first byte block is selected from the at least one extracted target byte block to serve as the key for the current target byte block. Before selecting the first byte block, the order in which the at least one extracted target byte block appears in the target byte stream is determined, and the selection of the first byte block is based on this order.

[0090] Specifically, if it is determined that the current target byte block is at the beginning of the order of occurrence, then the first number of target byte blocks adjacent to the current target byte block, or the target byte block in the reverse order of occurrence that is in the first number of positions, is selected as the first byte block of the current target byte block. Both the first and second numbers can be determined based on business needs, and this embodiment does not limit them.

[0091] For example, both the first quantity and the second quantity are set to 1. The target byte blocks are extracted in the following order of appearance: target byte block 1, target byte block 2, and target byte block 3. When the current target byte block is target byte block 1, then target byte block 2 is determined as the first byte block of the current target byte block, or target byte block 3 is determined as the first byte block of the current target byte block.

[0092] Specifically, if the current target byte block is not the first in the order of appearance, then the third number of target byte blocks adjacent to the current target byte block are selected as the first byte block of the current target byte block. In other words, for a target byte block that is not the first in the order of appearance, its key is determined by the byte blocks preceding it in the order of appearance. The third number can be determined based on business needs, and this embodiment does not limit this.

[0093] For example, both the first and second quantities are set to 1. The extracted target byte blocks are, in order of appearance: target byte block 1, target byte block 2, and target byte block 3. When the current target byte block is target byte block 2, then target byte block 1 is determined as the first byte block of the current target byte block. When the current target byte block is target byte block 3, then target byte block 2 is determined as the first byte block of the current target byte block. In this way, the encryption of the next target byte block depends on the adjacent previous target byte block, thereby achieving recursive encryption and improving encryption security.

[0094] Furthermore, to reduce the complexity of encryption, the target byte block that appears first in the order of occurrence can directly use an externally provided key, without needing to set a key based on the byte blocks included in other byte blocks. Based on this, if it is determined that the current target byte block appears first in the order of occurrence, it is determined whether an initial key has been set for the first target byte block. If so, the initial key is set to the corresponding key for the current target byte block; otherwise, step 103A is executed to select at least one first byte block from the at least one truncated target byte block for the current target byte block.

[0095] 103B. Based on at least a portion of the bytes included in the at least one first byte block, set the corresponding key for the current target byte block.

[0096] The bytes included in the first byte block are likely not publicly known bytes, therefore the encryption performance of the key determined based on these bytes is better. Based on this, the key corresponding to the current target byte block is set based on at least a portion of the bytes included in the at least one first byte block. The bytes included in the first byte block used to set the key corresponding to the current target byte block can be in the following ways: First, the bytes used to set the key are all the bytes included in the first byte block corresponding to the current target byte block; second, the bytes used to set the key are a portion of the bytes included in each corresponding first byte block. Which bytes in the first byte block are used to set the key for the current target byte block can be selected based on business needs, and this embodiment does not limit this. For example, if the first byte block of the current target byte block is the target byte block that appears one position earlier in the order, the first 16 bytes of this first byte block are taken as the key corresponding to the current target byte block. The above two cases can be flexibly selected based on business needs, and this embodiment does not limit this.

[0097] 103C. Encrypt the current target byte block based on the key to obtain the corresponding encrypted byte block.

[0098] An encryption tool is invoked to encrypt the current target byte block based on the key, resulting in an encrypted byte block. The encryption tool can be flexibly selected based on business needs, and this embodiment does not impose any limitations on it. Furthermore, to further improve the encryption effect, a preset key can be used to encrypt the key of the current target byte block first, and then the current target byte block can be encrypted based on the encrypted key to obtain the corresponding encrypted byte block.

[0099] The second method involves encrypting each target byte block to obtain the corresponding encrypted byte block and encrypted data. The specific process is as follows: For each target byte block, perform the following steps 103D to 103E:

[0100] 103D. Select the corresponding target key for the current target byte block and set the target key as the corresponding key for the current target byte block.

[0101] The target key can fall into two categories: First, the target key is the same for each captured target byte block, reducing the difficulty of subsequent encryption. Second, the target keys for at least two captured target byte blocks are different, improving the effectiveness of subsequent encryption. The choice between these two scenarios can be made flexibly based on business needs, and this embodiment does not impose any limitations on them.

[0102] 103E. Encrypt the current target byte block based on the set key to obtain the corresponding encrypted byte block.

[0103] The encryption process can be categorized into two scenarios: First, all captured target byte blocks are encrypted using the same method to reduce encryption difficulty. Second, at least two captured target byte blocks are encrypted using different methods to improve encryption effectiveness. The choice between these two scenarios can be made flexibly based on business needs, and this embodiment does not impose any limitations on either.

[0104] The two methods described above for encrypting each target byte block to obtain the corresponding encrypted byte block and encrypted data can be flexibly selected based on business needs, and this embodiment does not limit them.

[0105] Along with obtaining the corresponding encrypted byte block for each target byte block, encrypted data is also obtained. This encrypted data is used to reconstruct the corresponding target byte block from the encrypted byte block. The encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. This decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block; for example, it may contain the key used to encrypt the byte block or the rules for setting the key.

[0106] 104. Replace each target byte block in the target byte stream with the corresponding encrypted byte block to obtain the encrypted byte stream and position index data. The position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream.

[0107] After obtaining the corresponding encrypted byte block for each target byte block, each target byte block in the target byte stream is replaced with the corresponding encrypted byte block to avoid exposing the original bytes in the target byte block.

[0108] Along with obtaining the encrypted byte stream, position index data is also obtained. The position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream. The specific position can be expressed by the start and end index positions of the encrypted byte block in the encrypted byte stream.

[0109] 105. Integrate the encrypted byte stream with the encrypted parameter obfuscation data, encrypted data, and position index data to obtain the model encryption data of the model to be encrypted.

[0110] To ensure data security, a first encryption algorithm is used to encrypt the parameter obfuscation data, encrypted data, and location index data. The first encryption algorithm can be flexibly selected based on business needs, and this embodiment does not limit its selection. For example, the preset algorithm may include, but is not limited to, the RSA encryption algorithm.

[0111] After obtaining the encrypted parameter obfuscation data, encrypted data, and position index data, these data are integrated with the encrypted byte stream to obtain the encrypted model data of the model to be encrypted. This integration may include, but is not limited to, encrypting the encrypted byte stream and the encrypted parameter obfuscation data, encrypted data, and position index data into an encrypted file using a second encryption algorithm.

[0112] When it is necessary to apply the model to be encrypted, the encrypted data of the model to be encrypted can be decrypted. After decryption, business reasoning can be realized in the application process based on the model to be encrypted. For the model decryption process, please refer to the model decryption method below, which will not be repeated here.

[0113] The model encryption method provided in this application, when a model to be encrypted exists, firstly obfuscates the original parameters of at least one target network layer in the model to be encrypted, obtaining a model with obfuscated parameters and obfuscated parameter data used to restore the original parameters of the target network layer before obfuscation. Then, at least one target byte block is extracted from the corresponding target byte stream of the model with obfuscation, and each target byte block is encrypted, obtaining an encrypted byte block for each target byte block and encrypted data used to restore the corresponding target byte block. Next, each target byte block in the target byte stream is replaced with the corresponding encrypted byte block, obtaining an encrypted byte stream and position index data indicating the position of the encrypted byte block in the encrypted byte stream. Finally, the encrypted byte stream, the obfuscated parameter data, the encrypted data, and the position index data are integrated to obtain the model encryption data of the model to be encrypted. It can be seen that the scheme provided in this embodiment encrypts the model by first obfuscating the original parameters of at least some network layers of the model, then extracting and encrypting target byte blocks from the byte stream of the model with obfuscation, and finally replacing the original extracted target byte blocks with the encrypted byte blocks. As can be seen, the solution provided in this embodiment encrypts the model from two dimensions: parameter obfuscation and byte encryption. This achieves at least the following technical effects: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be reconstructed simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the reconstructed byte stream, thereby reducing the model inference latency caused by encryption. Second, because the parameters of at least some network layers in the model are obfuscated, the original parameters of these network layers cannot be obtained from the reconstructed byte stream, thus reducing the possibility of leaking the model's original parameters. Third, when inference is performed based on the reconstructed byte stream, only the parameters of the currently applied network layers are restored, while those of unapplied network layers are not. This not only ensures smooth model inference based on the restored original parameters but also minimizes the possibility of model parameter leakage.

[0114] In some embodiments of this application, to facilitate model encryption, before performing parameter obfuscation on the original parameters of at least one target network layer in the model to be encrypted in step 101 above, the model encryption method provided in this embodiment may further include the following steps: determining whether the format of the model to be encrypted is a preset format; if so, executing step 101; otherwise, converting the model to be encrypted into a preset format, and executing step 101 after conversion to the preset format. The preset format can be selected based on business needs; for example, the preset format may include, but is not limited to, bin format and safetensor format.

[0115] In some embodiments of this application, when the model is applied, in addition to the model's own data, auxiliary code is also required to support model loading and deployment. Based on this, the model encryption method provided in this embodiment may further include the following steps: obfuscating and compiling the auxiliary code of the model to be encrypted, the auxiliary code being used to support model loading and deployment; and encapsulating the obfuscated and compiled auxiliary code and the encrypted data into a model application package. When the model is provided to any terminal, the terminal can load and deploy the model based on the auxiliary code in the model application package, and then decrypt the model based on the encrypted byte stream and the encrypted parameter obfuscated data, encrypted data, and position index data included in the model application, thereby applying the decrypted model to perform corresponding business reasoning.

[0116] This application provides a model decryption method, such as... Figure 2 As shown, the model decryption method provided in this embodiment may include at least the following steps 201 to 207:

[0117] 201. Obtain the encrypted data of the model to be decrypted.

[0118] The model to be decrypted is the model selected by the user for which corresponding business reasoning is required, and its business reasoning capabilities meet the user's needs. After selecting the model to be decrypted, the encrypted data of the model to be decrypted is obtained. This encrypted data is obtained by encrypting the model to be decrypted using the model encryption method described above. The process of obtaining this data is detailed in the specific explanation of the model encryption method described above, and will not be repeated here.

[0119] 202. Load the encrypted byte stream of the model's encrypted data and decrypt the encrypted data and position index data included in the model's encrypted data.

[0120] Obtain the auxiliary code corresponding to the model to be decrypted to support model loading, and call the auxiliary code to load the encrypted byte stream including the encrypted data of the model. When decrypting the encrypted data and position index data including the encrypted data of the model, use the decryption process corresponding to the encryption process in step 105 above to decrypt and obtain the encrypted data and position index data. The encrypted data is used to restore the corresponding target byte block of the encrypted byte block, and the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream. By combining the encrypted data and the position index data, the encrypted bytes in the encrypted byte stream can be restored to the corresponding target byte block.

[0121] 203. Based on the decrypted position index data, locate the encrypted byte block in the encrypted byte stream.

[0122] The location index data includes the start and end index positions of each encrypted byte block within the encrypted byte stream. Based on this, the encrypted byte blocks are located within the encrypted byte stream according to their start and end index positions.

[0123] 204. Decrypt each encrypted byte block based on the decrypted encrypted data to restore the corresponding target byte block for each encrypted byte block.

[0124] After locating the encrypted byte block, each encrypted byte block is decrypted based on the encrypted data to obtain the corresponding target byte block for each encrypted byte block.

[0125] 205. Replace each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted.

[0126] Since only the encrypted byte blocks in the encrypted byte stream are decrypted, instead of the entire encrypted byte stream, the decryption time is relatively short. This allows for the rapid acquisition of the byte stream of the model to be decrypted to start model inference, thereby reducing the model inference latency caused by model encryption.

[0127] 206. Perform model conversion processing on the target byte stream to obtain the model to be decrypted.

[0128] The deserialization tool, used to convert the byte stream into a model, is invoked to deserialize the target byte stream, yielding the model to be decrypted. The deserialization tool is dependent on the type of the model to be decrypted and can be flexibly selected based on this type. The model to be decrypted is one in which the original parameters of at least some of the target network layers have been obfuscated, and it can be invoked to initiate corresponding business inference.

[0129] 207. If the model to be decrypted is called for business reasoning, then for each target network layer in the model to be decrypted, the encrypted data of the model is decrypted, including the corresponding parameter obfuscation data of the target network layer. Based on the decrypted parameter obfuscation data, the original parameters of the target network layer before parameter obfuscation are restored, so that the target network layer can perform business reasoning based on the original parameters.

[0130] The original parameters of the target network layer in the model to be decrypted have been obfuscated. As the inference process progresses, the parameters of only the target network layer currently used in the business inference need to be restored. This not only enables correct inference based on the restored original parameters of the target network layer, but also reduces the possibility of model parameter leakage because the parameters of other unused target network layers are not restored. Therefore, if the model to be decrypted is used for business inference, to ensure the accuracy of the inference, for each target network layer in the model to be decrypted, the corresponding obfuscated parameter data of the target network layer included in the encrypted model data is decrypted. Based on the decrypted obfuscated parameter data, the original parameters of the target network layer before the parameter obfuscation process are restored, so that the target network layer can perform business inference based on the restored original parameters. The process of restoring the original parameters of the target network layer here is the inverse operation of the parameter obfuscation operation mentioned in step 101 above, so it will not be elaborated further here. A detailed explanation of step 101 will follow.

[0131] The model decryption method provided in this application provides at least the following technical effects: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be restored simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the restored byte stream, thereby reducing the model inference latency caused by model encryption. Second, since the parameters of at least some network layers in the model are obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thus reducing the possibility of leaking the model's original parameters. Third, when the model is called for inference based on the restored byte stream, only the parameters of the currently applied network layers are restored, while those of the currently unapplied network layers are not restored. This not only ensures smooth model inference based on the restored original parameters but also minimizes the possibility of model parameter leakage.

[0132] In some embodiments of this application, to further enhance model security, an encrypted byte stream is loaded into a first secure isolation environment to support the decryption of the model to be applied. This first secure isolation environment has a corresponding model invocation interface. Therefore, the model decryption method provided in this embodiment may further include: if the model invocation interface receives a model invocation instruction, it is determined that the model to be decrypted has been invoked for business reasoning. The first secure isolation environment is a specially constructed environment to support the use of the model to be applied, which can block external attacks, thereby preventing data leakage of the model to be applied. The first secure isolation environment has a corresponding model invocation interface; if the model invocation interface receives a model invocation instruction, it is determined that the model to be decrypted has been invoked for business reasoning. In this way, the probability of the model to be decrypted being exposed to external attacks when invoked is low, thereby reducing the possibility of model parameters being leaked in model applications.

[0133] In some embodiments of this application, the encrypted parameter obfuscation data, including the encrypted model data, is stored in a second secure isolation environment, which has a data access interface. Based on this, the specific execution process of decrypting the network layer's corresponding parameter obfuscation data in step 207 of the above-mentioned model encrypted data, and restoring the network layer's parameters before parameter obfuscation based on the decrypted parameter obfuscation data, may include the following steps: calling a decryption tool in the second secure isolation environment to decrypt the target network layer's corresponding parameter obfuscation data; and calling the target network layer's corresponding parameter obfuscation data from the data access interface to restore the target network layer's parameters before parameter obfuscation.

[0134] Considering that parameter leakage can seriously jeopardize the technological and market competitiveness of model development companies, and that obfuscated parameter data is crucial for reconstructing the original parameters of network layers, leakage of obfuscated parameter data could lead to the leakage of network layer parameters. Therefore, to further reduce the possibility of network layer parameter leakage, this embodiment stores the encrypted obfuscated parameter data, including the model encryption data, in a second secure isolation environment. The obfuscated parameter data is then decrypted within this second secure isolation environment, thus minimizing the possibility of leakage. Furthermore, to enable the reconstruction of the original parameters of the target network using the obfuscated parameter data, the corresponding obfuscated parameter data for the target network layer can be accessed through the data access interface of the second secure isolation environment. This minimizes the exposure of the obfuscated parameter data, thereby reducing the probability of its leakage.

[0135] In some embodiments of this application, the specific process of applying the model encryption and decryption methods provided in this embodiment to a target model is described below. In this embodiment, the target model is selected as the model to be encrypted in order to reduce the possibility of model parameter leakage of the target model and reduce the inference latency of the target model caused by model encryption. The specific process of encrypting the target model may include the following steps (1) to (8):

[0136] (1) The target model is determined as the model to be encrypted.

[0137] In this embodiment, since model encryption requires the use of the model's byte stream, if the target model is determined to be in bin format or safetensor format (these formats can be converted to byte streams), then step (2) is executed. If the target model is determined not to be in bin format or safetensor format, then the target model is converted to bin format or safetensor format.

[0138] (2) Load the target model, read the network layers of the target model, and select at least one target network layer from the read network layers.

[0139] In this embodiment, the target model is determined to include M network layers, and k target network layers are selected from the M network layers. In order to reduce encryption complexity, k is much smaller than the total number of network layers M of the target model, and both k and M are positive integers greater than 1.

[0140] (3) Perform parameter obfuscation on the original parameters of each target network layer in the target model to obtain the parameter obfuscated model and parameter obfuscated data.

[0141] In this embodiment, the original parameters of the target network layer are selected as weights. Specifically, the following steps are performed for each target network layer: The obfuscation factors of the current target network layer k are determined, including an obfuscation scaling factor Ak and an obfuscation offset factor Bk, and the obfuscation processing logic includes obfuscation scaling logic (multiplication operation logic) and obfuscation offset logic (addition operation logic); based on the obfuscation scaling factor, the original parameters of the target network layer are scaled using the obfuscation scaling logic; based on the obfuscation offset factor, the scaled parameters are offset using the obfuscation offset logic to obtain the obfuscated parameters of the current target network layer. The specific process of the aforementioned steps can be expressed by the following formula: Wk' = Ak × Wk + Bk. Wk' represents the obfuscated weights of the current target network layer k, Ak represents the obfuscation scaling factor Ak of ​​the current target network layer k, Bk represents the obfuscation offset factor of the current target network layer k, and Wk represents the original weights of the current target network layer k before obfuscation. Figure 3 As shown, Figure 3 The diagram shows that k network layers (1 to k) were selected from the target model, with original weights W1 to Wk for each layer. After parameter obfuscation, the obfuscated weights of the target network layers are: Figure 3 The range is from (W1' = A1 × W1 + B1) to (Wk' = Ak × Wk + Bk). It should be noted that... Figure 3 This is merely an illustration of the target network layer; it does not specify the exact structure of the target network layer.

[0142] After obfuscating the original parameters of each target network layer in the target model, obfuscated parameter data is obtained. This obfuscated parameter data is used to restore the original parameters of the target network layers before obfuscation. It records the identifier of each target network layer, as well as the corresponding obfuscation factor and obfuscation logic for each target network. Based on this data, the original parameters of each target network layer before obfuscation can be restored. The obfuscated parameter data is equivalent to a network layer lock file (i.e., a layer lock), which can be stored as a network layer lock file, for example, a network layer lock file named layer.shuffle.

[0143] (4) Convert the target model after parameter obfuscation into a target byte stream, and intercept at least one target byte block from the target byte stream.

[0144] In this embodiment, after the parameter obfuscation in the above step (3), it is also necessary to encrypt the model at the byte dimension to further improve the effect of model encryption. Based on this, intercept at least one target byte block from the target byte stream of the target model to encrypt the target byte block.

[0145] Exemplarily, as Figure 4 shown, the total byte length of the target byte stream of the target model is N, and the byte length of a preset single target byte block needs to be set as the first byte length r. Based on the first byte length r and the total byte length N of the target byte stream, select n first bytes from the target byte stream in the order of byte appearance in the target byte stream, and record the selected n first bytes as [x1, x2,..., xn] according to the index positions of the first bytes in the target byte stream, where 1 < xi < N - r, and the byte length between adjacent xi is greater than r, xi is the i-th byte in the first bytes, and the value range of i is [1, n]. Then, starting from each first byte, respectively intercept the target byte block with the first byte length r corresponding to each first byte. The target byte blocks are recorded as [G1, G2,..., Gn], Gj represents the j-th target byte block in the intercepted target byte blocks, and the value range of j is [1, n]. It can be seen from Figure 4 that the byte range involved in G1 is [x1, x1 + r], the byte range involved in G2 is [x2, x2 + r], and so on, and the byte range involved in Gn is [xn, xn + r].

[0146] (5) Perform encryption processing on each target byte block to obtain the encrypted byte block and encrypted data corresponding to each target byte block. In this embodiment, in order to reduce the complexity of encryption, the target byte block at the first position in the appearance order (the appearance order is the order in which the target byte block appears in the target byte stream) needs to be directly encrypted using a preset initial key.

[0147] Based on this, as Figure 4As shown, the steps for encrypting each target byte block can be as follows: Following the numerical order from smallest to largest, take a value j from the range [1, n] and execute the following process: Determine if the current value of j is 1; if it is 1, it means that the target byte block Gj corresponding to the current value is the first target byte block appearing in the target byte stream, and then use the initial key key1 to perform AES encryption on the current target byte block G1 to generate the corresponding encrypted byte block F1; if j is not 1, it means that the target byte block Gj corresponding to the current value is not the first target byte block appearing in the target byte stream, then determine the target byte block G(j-1) located one position before the target byte block Gj as the first byte block of the target byte block Gj (the bytes in the first byte block are used to set the corresponding key of the target byte block Gj), use the first 16 bytes of the target byte block G(j-1) as the corresponding key keyj of the target byte block Gj, and use the key keyj to perform AES encryption on the current target byte block Gj to generate the corresponding encrypted byte block Fj of the current target byte block Gj.

[0148] The encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. The decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block; for example, it may contain the key used to encrypt the byte block (e.g., the initial key key1) or the key setting rules. Specifically, the starting index position of each target byte block in the target byte stream can be represented as [x1, x2, ..., xn]. The length of the encrypted byte block corresponding to each target byte block can be a length sequence: [S1, S2, ..., Sn].

[0149] (6) Replace each target byte block in the target byte stream with the corresponding encrypted byte block to obtain the encrypted byte stream and position index data. Specifically, replace the corresponding target byte block with the encrypted byte block, concatenate them into a new byte sequence and save it to form an encrypted byte stream.

[0150] Position index data is used to indicate the position of the encrypted byte block within the encrypted byte stream. The position can be specifically expressed by the start and end index positions of the encrypted byte block within the encrypted byte stream. For example, Figure 4As shown, when j is 1, the position index data of the encrypted byte block F1 is expressed as [x1, x1+s1], when j is 2, the position index data of the encrypted byte block F1 is expressed as [x2+s1-r, x2+s1-r+s2], and so on, when j is n, the position index data of the encrypted byte block F1 is expressed as [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r]. If the start and end positions of each encrypted byte block index position are retrieved as [Yj, Yjj], then the position index data can be expressed as: [(Y1,Y11), (Y2,Y22),…,(Yn,Ynn)]. In some embodiments, the encrypted data and position index data can be encrypted into an encrypted file named model.index.

[0151] (7) Use the RSA encryption algorithm to encrypt and save layer.shuffle and model.index.

[0152] (8) Integrate the encrypted byte stream and the encrypted parameter obfuscated data, encrypted data, and position index data to obtain the model encrypted data of the target model, and obfuscate and compile the auxiliary code of the target model. Then, encapsulate the obfuscated and compiled auxiliary code and model encrypted data into a model application package for use by the target model in corresponding business reasoning.

[0153] In this embodiment, the auxiliary code is code used to support the loading and deployment of the target model. In this embodiment, when the target model is selected for application on the corresponding terminal to perform corresponding business reasoning, the target model needs to be decrypted. The specific process of decrypting the target model may include the following steps (9) to (15):

[0154] (9) Obtain the encrypted model data of the target model.

[0155] (10) Load the encrypted byte stream of the model encrypted data and decrypt the encrypted data and position index data included in the model encrypted data.

[0156] In this embodiment, the decrypted encrypted data and position index data are obtained by decrypting the model.index file. The decrypted encrypted data includes the starting index position of each target byte block in the target byte stream, the length of the encrypted byte block corresponding to each target byte block, and decryption information. The decryption information is used to decrypt the corresponding encrypted byte block to obtain the corresponding target byte block. Specifically, the starting index position of each target byte block in the target byte stream can be represented as: [x1, x2, ..., xn]. The length of the encrypted byte block corresponding to each target byte block can be a length sequence: [S1, S2, ..., Sn]. The position index data indicates the position of each encrypted byte block in the encrypted byte stream, specifically, as shown below. Figure 5As shown, when j is 1, the position index data of the encrypted byte block F1 is expressed as [x1, x1+s1], when j is 2, the position index data of the encrypted byte block F1 is expressed as [x2+s1-r, x2+s1-r+s2], and so on. When j is n, the position index data of the encrypted byte block Fn is expressed as [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r].

[0157] (11) Based on the decrypted location index data, locate the encrypted byte block in the encrypted byte stream.

[0158] Based on this, such as Figure 5 As shown, following the ascending numerical order, starting with value j in the range [1, n], the following process is executed: First, determine if the current value of j is 1. If it is 1, it means the encrypted byte block Fj corresponding to the current value is the first encrypted byte block appearing in the encrypted byte stream. Then, based on the position index data [x1, x1+s1], locate the encrypted byte block F1 in the encrypted byte stream. If it is not 1, it means the encrypted byte block Fj corresponding to the current value is not the first encrypted byte block appearing in the encrypted byte stream. Then, based on the corresponding data in the position index data, locate the encrypted byte block Fj in the encrypted byte stream. For example, when j is 2, the encrypted byte block F2 is located in the encrypted byte stream based on the position index data [x2+s1-r, x2+s1-r+s2]. Similarly, when j is n, the encrypted byte block Fn is located in the encrypted byte stream based on the position index data [xn+∑s(j-1)-r, xn+sn+∑s(j-1)-r].

[0159] (12) Decrypt each encrypted byte block based on the decrypted encrypted data and restore the corresponding target byte block for each encrypted byte block.

[0160] In this embodiment, as Figure 5 As shown, following the ascending numerical order, starting with j in the range [1, n], the following process is executed: First, determine if the current value of j is 1. If it is 1, it means the encrypted byte block Fj corresponding to the current value is the first encrypted byte block appearing in the encrypted byte stream. Then, use the initial key key1 to decrypt the encrypted byte block Fj using AES, restoring the target byte block G1 corresponding to encrypted byte block F1. If j is not 1, it means the encrypted byte block Fj corresponding to the current value is not the first encrypted byte block appearing in the encrypted byte stream. Then, use the first 16 bytes of the encrypted byte block G(j-1) as the key keyj corresponding to the encrypted byte block Fj, and use the key keyj to decrypt the encrypted byte block Fj using AES, restoring the target byte block Gj corresponding to the encrypted byte block Fj.

[0161] (13) Replace each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the target model. In this embodiment, based on the starting index position [x1, x2, ..., xn] of each target byte block in the encrypted data in the target byte stream, and the length [S1, S2, ..., Sn] of the encrypted byte block corresponding to each target byte block, replace each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the model to be encrypted. Figure 5 As shown, F1 in the encrypted byte stream is replaced with G1, and the index of the replaced G1 is [x1, x1+s1]. F2 in the encrypted byte stream is replaced with G2, and the index of the replaced G2 is [x2, x2+s2]. Similarly, Fn in the encrypted byte stream is replaced with Gn, and the index of the replaced Gn is [xn, xn+sn]. Finally, the target byte stream corresponding to the target model is obtained.

[0162] (14) Perform model conversion processing on the target byte stream to obtain the target model.

[0163] (15) If the target model is invoked for business inference, then for each target network layer in the target model applied, the corresponding parameter obfuscation data of the target network layer included in the model encryption data is decrypted. Based on the decrypted parameter obfuscation data, the original parameters of the target network layer before parameter obfuscation are restored, so that the target network layer can perform business inference based on the original parameters of the target network layer. In this example, when the model is performing inference, for each target network layer in the target model applied, if it is determined that the target network layer is a network layer that has undergone parameter obfuscation, then the inverse operation of parameter obfuscation in the above model encryption method is used to restore the original parameters of the target network layer before parameter obfuscation, i.e., the weights in this embodiment, so that the target network layer can perform business inference based on the original weights of the target network layer.

[0164] Furthermore, one embodiment of this application also provides a model encryption device, such as... Figure 6 As shown, the model encryption device provided in this embodiment may include at least:

[0165] The first processing module 31 is used to perform parameter obfuscation processing on the original parameters of at least one target network layer in the model to be encrypted, to obtain the parameter obfuscated model and parameter obfuscation data, wherein the parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation processing.

[0166] The interception module 32 is used to intercept at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation processing by the first processing module 31.

[0167] The second processing module 33 is used to encrypt each target byte block intercepted by the interception module 32 to obtain the corresponding encrypted byte block and encrypted data for each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block.

[0168] The first replacement module 34 is used to replace each target byte block in the target byte stream with the corresponding encrypted byte block obtained by the second processing module 33, so as to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream.

[0169] The integration module 35 is used to integrate the encrypted byte stream obtained by the first replacement module 34, the parameter obfuscation data obtained by the first processing module 31 after encryption processing, the encrypted data obtained by the second processing module 33, and the position index data obtained by the first replacement module 34 to obtain the model encryption data of the model to be encrypted.

[0170] The model encryption apparatus provided in this application, when a model to be encrypted exists, performs parameter obfuscation on the original parameters of at least one target network layer in the model to be encrypted, obtaining a parameter-obfuscated model and parameter obfuscated data used to restore the original parameters of the target network layer before parameter obfuscation. Then, at least one target byte block is extracted from the corresponding target byte stream of the parameter-obfuscated model, and each target byte block is encrypted, obtaining an encrypted byte block corresponding to each target byte block and encrypted data used to restore the corresponding target byte block. Next, each target byte block in the target byte stream is replaced with the corresponding encrypted byte block, obtaining an encrypted byte stream and position index data indicating the position of the encrypted byte block in the encrypted byte stream. Finally, the encrypted byte stream, the encrypted parameter obfuscated data, the encrypted data, and the position index data are integrated to obtain the model encryption data of the model to be encrypted. It can be seen that the scheme provided in this embodiment encrypts the model by first performing parameter obfuscation on the original parameters of at least some network layers of the model, then extracting and encrypting target byte blocks from the byte stream of the parameter-obfuscated model, and finally replacing the originally extracted target byte blocks with the encrypted byte blocks. As can be seen, the solution provided in this embodiment encrypts the model from two dimensions: parameter obfuscation and byte encryption. This achieves at least the following technical effects: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be reconstructed simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the reconstructed byte stream, thereby reducing the model inference latency caused by encryption. Second, because the parameters of at least some network layers in the model are obfuscated, the original parameters of these network layers cannot be obtained from the reconstructed byte stream, thus reducing the possibility of leaking the model's original parameters. Third, when inference is performed based on the reconstructed byte stream, only the parameters of the currently applied network layers are restored, while those of unapplied network layers are not. This not only ensures smooth model inference based on the restored original parameters but also minimizes the possibility of model parameter leakage.

[0171] In some embodiments of this application, such as Figure 7 As shown, the first processing module 31 may include: a first determining unit 311, used to determine the corresponding obfuscation factor and obfuscation processing logic of the target network layer; and a first processing unit 312, used to obfuscate the original parameters of the target network layer based on the obfuscation factor and the obfuscation processing logic, and replace the original parameters of the target network layer with the obfuscated parameters; wherein, the first determining unit 311 and the first processing unit 312 are configured to be executed for each target network layer respectively.

[0172] In some embodiments of this application, such as Figure 7 As shown, the obfuscation factor includes at least an obfuscation scaling factor and an obfuscation offset factor, and the obfuscation processing logic includes at least obfuscation scaling logic and obfuscation offset logic. Therefore, the first processing unit 312 is specifically used to scale the original parameters of the target network layer based on the obfuscation scaling factor through the obfuscation scaling logic; and to offset the scaled parameters based on the obfuscation offset factor through the obfuscation offset logic to obtain the obfuscated parameters of the target network layer.

[0173] In some embodiments of this application, such as Figure 7 As shown, the number of target network layers of the model to be encrypted is at least two, and the first determining unit 311 sets that there is at least one target data corresponding to the target network layer of the model to be encrypted, which is different from the target data of other target network layers. The target data includes at least one of the following: obfuscation factor and obfuscation processing logic.

[0174] In some embodiments of this application, such as Figure 7 As shown, the interception module 32 may include: a first interception unit 321, configured to determine a first number of target byte blocks to be intercepted from the target byte stream based on the length of the first byte and the total length of the target byte stream; select a first number of first bytes from the target byte stream according to the byte order of the target byte stream; and intercept target byte blocks with a length of the first byte corresponding to each first byte, starting with each first byte; wherein each first byte is separated from the next adjacent first byte by at least a byte of the first byte length.

[0175] In some embodiments of this application, such as Figure 7 As shown, the interception module 32 may include: a second interception unit 322, configured to determine the corresponding second byte length of each target byte block to be intercepted from the target byte stream; select the second byte required to intercept each target byte block from the target byte stream according to the byte order of the target byte stream; and intercept the target byte block with the corresponding second byte length corresponding to each second byte, starting from each second byte; wherein each second byte is separated from the next adjacent second byte by at least a byte of the corresponding second byte length.

[0176] In some embodiments of this application, such as Figure 7 As shown, the second processing module 33 includes:

[0177] The first selection unit 331 is configured to select at least one first byte block from the at least one target byte block for the current target byte block;

[0178] Setting unit 332 is used to set the corresponding key for the current target byte block based on at least a portion of the bytes included in the at least one first byte block;

[0179] Encryption unit 333 is used to encrypt the current target byte block based on the key to obtain the corresponding encrypted byte block of the current target byte block;

[0180] The first selection unit 331, the setting unit 332, and the encryption unit 333 are configured to be executed for each of the target byte blocks.

[0181] In some embodiments of this application, such as Figure 7 As shown, the second processing module 33 may include: a second determining unit 334, used to determine the appearance order of the at least one target byte block in the target byte stream; then, the first selecting unit 331 is specifically used to select the first number of target byte blocks adjacent to the current target byte block or the target byte block located in the first number of positions in the reverse order of the appearance order as the first byte block of the current target byte block if the current target byte block is not located at the first position of the appearance order; and to select the third number of target byte blocks adjacent to the current target byte block as the first byte block of the current target byte block if the current target byte block is not located at the first position of the appearance order.

[0182] In some embodiments of this application, such as Figure 7 As shown, the first selection unit 331 is further configured to determine whether an initial key has been set for the first target byte block if the current target byte block is determined to be at the first position in the order of occurrence. If yes, the setting unit 332 is triggered to set the initial key to the corresponding key of the current target byte block. If no, the step of selecting at least one first byte block from the at least one target byte block for the current target byte block is executed.

[0183] In some embodiments of this application, such as Figure 7 As shown, the model encryption device provided in this embodiment may further include: a first selection module 36, used to select the key network layer in the model to be encrypted as the target network layer, wherein the key network layer is the network layer that affects model inference.

[0184] In some embodiments of this application, such as Figure 7As shown, the model encryption device provided in this embodiment may further include: a second selection module 37, used to select a first target number of network layers applicable to the total number of network layers of the model to be encrypted based on a preset correspondence between at least one range of the total number of network layers and a target number; and to select the first target number of target network layers from the network layers of the model to be encrypted; wherein the selected target network layers have any of the following characteristics: the first target number of target network layers are consecutive network layers in the model to be encrypted; or, there is at least one pair of first network layers in the first target number of target network layers, the two first network layers in each pair of first network layers are adjacent in the target network layers, and the two first network layers are separated by at least one network layer in the model to be encrypted; or, any two adjacent target network layers in the second target number of target network layers are separated by at least one network layer in the model to be encrypted, and at least two pairs of adjacent target network layers are separated by different numbers of network layers.

[0185] In some embodiments of this application, such as Figure 7 As shown, the model encryption device provided in this embodiment may further include: a third selection module 38, used to select a target layer number set applicable to the total number of network layers of the model to be encrypted based on the correspondence between a preset range of at least one network layer total number and a set of layer numbers; and to select network layers whose layer numbers in the model to be encrypted are included in the target layer number set as target network layers.

[0186] In some embodiments of this application, such as Figure 7 As shown, the model encryption device provided in this embodiment may further include: an encapsulation module 39, used to obfuscate and compile the auxiliary code of the model to be encrypted, the auxiliary code being used to support the loading and deployment of the model; and to encapsulate the obfuscated and compiled auxiliary code and the encrypted data into a model application package.

[0187] For a detailed explanation of the various functional modules used in the model encryption device provided in this application embodiment, please refer to the corresponding detailed explanation of the above model encryption method embodiment, which will not be repeated here.

[0188] Furthermore, one embodiment of this application also provides a model decryption apparatus, such as... Figure 8 As shown, the model decryption device provided in this embodiment may include at least:

[0189] The acquisition module 41 is used to acquire the model encryption data of the model to be decrypted, wherein the model encryption data is obtained by encrypting the model to be decrypted through the aforementioned model encryption device;

[0190] The processing module 42 is used to load the encrypted byte stream included in the model encrypted data and decrypt the encrypted data and position index data included in the model encrypted data;

[0191] The positioning module 43 is used to locate the encrypted byte block in the encrypted byte stream based on the position index data decrypted by the processing module 42.

[0192] The restoration module 44 is used to decrypt each encrypted byte block located by the positioning module 43 based on the encrypted data decrypted by the processing module 42, and restore the corresponding target byte block of each encrypted byte block.

[0193] The second replacement module 45 is used to replace each target byte block in the encrypted byte stream obtained by the restoration module 44 with the corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted.

[0194] The conversion module 46 is used to perform model conversion processing on the target byte stream obtained by the second replacement module 45 to obtain the model to be decrypted;

[0195] The calling module 47 is used to, if the decrypted model obtained by the conversion module 46 is called for business reasoning, then for each target network layer in the model to be decrypted, the corresponding parameter obfuscation data of the target network layer included in the encrypted data of the model is decrypted, and the original parameters of the target network layer before parameter obfuscation are restored based on the decrypted parameter obfuscation data, so that the target network layer can perform business reasoning based on the original parameters.

[0196] The model decryption apparatus provided in this application provides at least the following technical effects: First, since only the target byte blocks extracted from the byte stream are encrypted, the model's byte stream can be restored simply by decrypting the target byte blocks during model application. This reduces decryption time and allows for rapid model inference based on the restored byte stream, thereby reducing the model inference latency caused by model encryption. Second, since the parameters of at least some network layers in the model are obfuscated, the original parameters of these network layers cannot be obtained from the restored byte stream, thus reducing the possibility of leaking the model's original parameters. Third, when the model is called for inference based on the restored byte stream, only the parameters of the currently applied network layers are restored, while those of the currently unapplied network layers are not restored. This not only ensures smooth model inference based on the restored original parameters but also minimizes the possibility of model parameter leakage.

[0197] In some embodiments of this application, such as Figure 8As shown, the encrypted byte stream is loaded into a first secure isolation environment for supporting the decryption of the model to be applied, and the first secure isolation environment has a corresponding model call interface. Then, the call module 47 may include: a listening unit 471, which is used to determine that the model to be decrypted is called for business reasoning if the model call interface receives a model call instruction.

[0198] In some embodiments of this application, such as Figure 8 As shown, the encrypted model data includes encrypted parameter obfuscation data stored in a second secure isolation environment. The second secure isolation environment has a data call interface. Therefore, the call module 47 may include: a call unit 472, used to call a decryption tool to decrypt the corresponding parameter obfuscation data of the target network layer in the second secure isolation environment; and to call the corresponding parameter obfuscation data of the target network layer from the data call interface to restore the parameters of the target network layer before parameter obfuscation processing.

[0199] For detailed explanations of the various functional modules used in the model decryption device provided in this application embodiment, please refer to the corresponding detailed explanations of the above-described model decryption method embodiments, which will not be repeated here.

[0200] Furthermore, one embodiment of this application also provides a computer-readable storage medium, the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the above-described model encryption method, and / or execute the above-described model decryption method.

[0201] Furthermore, one embodiment of this application also provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the above-described model encryption method, and / or to execute the above-described model decryption method.

[0202] Furthermore, one embodiment of this application also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the above-described model encryption method and / or executes the above-described model decryption method.

[0203] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail in a certain embodiment can be referred to in the relevant descriptions of other embodiments. It is understood that related features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of each embodiment. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0204] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing preferred embodiments of this application.

[0205] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0206] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0207] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data cutover device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data cutover device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0208] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data cutover device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0209] These computer program instructions can also be loaded onto a computer or other programmable data cutover device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0210] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0211] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0212] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0213] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A model encryption method, characterized in that, The method includes: The original parameters of at least one target network layer in the encryption model are obfuscated to obtain the obfuscated model and obfuscated data. The obfuscated data is used to restore the original parameters of the target network layer before the obfuscation process. Extract at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation. Each target byte block is encrypted to obtain a corresponding encrypted byte block and encrypted data for each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block. Each target byte block in the target byte stream is replaced with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream; By integrating the encrypted byte stream, the encrypted parameter obfuscation data, the encrypted data, and the position index data, the model encryption data of the model to be encrypted is obtained.

2. The method according to claim 1, characterized in that, The original parameters of at least one target network layer in the encryption model are obfuscated, including: For each target network layer, the following steps are performed: determine the corresponding obfuscation factor and obfuscation processing logic for the target network layer; based on the obfuscation factor, perform obfuscation processing on the original parameters of the target network layer through the obfuscation processing logic; and replace the original parameters of the target network layer with the obfuscated parameters.

3. The method according to claim 2, characterized in that, The obfuscation factor includes at least an obfuscation scaling factor and an obfuscation offset factor, and the obfuscation processing logic includes at least obfuscation scaling logic and obfuscation offset logic. Therefore, obfuscating the original parameters of the target network layer based on the obfuscation factor and through the obfuscation processing logic includes: scaling the original parameters of the target network layer based on the obfuscation scaling factor and through obfuscation scaling logic; and offsetting the scaled parameters based on the obfuscation offset factor and through obfuscation offset logic to obtain the obfuscated parameters of the target network layer. And / or, The number of target network layers in the model to be encrypted is at least two, and there is at least one target data in the target network layer of the model to be encrypted that is different from the target data of other target network layers. The target data includes at least one of the following: obfuscation factor and obfuscation processing logic.

4. The method according to claim 1, characterized in that, Extracting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation includes: determining a first number of target byte blocks to be extracted from the target byte stream based on the length of a first byte and the total length of the target byte stream; selecting a first number of first bytes from the target byte stream according to the byte order of the target byte stream; and extracting a target byte block with a length of a first byte corresponding to each first byte, starting with each first byte; wherein each first byte is separated from the next adjacent first byte by at least a byte of the length of the first byte. or, Extracting at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation includes: determining the second byte length corresponding to each target byte block to be extracted from the target byte stream; selecting the second byte required to extract each target byte block from the target byte stream according to the byte order of the target byte stream; and extracting target byte blocks with corresponding second byte lengths corresponding to each second byte, starting from each second byte; wherein each second byte is separated from the next adjacent second byte by at least a byte of the corresponding second byte length.

5. The method according to claim 1, characterized in that, Each target byte block is encrypted to obtain a corresponding encrypted byte block and encrypted data for each target byte block, including: For each target byte block, the following steps are performed: at least one first byte block is selected from the at least one target byte block for the current target byte block; based on at least a portion of the bytes included in the at least one first byte block, a corresponding key for the current target byte block is set; the current target byte block is encrypted based on the key to obtain the corresponding encrypted byte block for the current target byte block.

6. The method according to claim 5, characterized in that, The method further includes: determining the order in which the at least one target byte block appears in the target byte stream; Then, selecting at least one first byte block from the at least one target byte block for the current target byte block includes: if the current target byte block is at the beginning of the occurrence order, then selecting the next first number of target byte blocks adjacent to the current target byte block or the target byte block located in the first second number of positions in the reverse order of the occurrence order as the first byte block of the current target byte block; if the current target byte block is not at the beginning of the occurrence order, then selecting the next third number of target byte blocks adjacent to the current target byte block as the first byte block of the current target byte block; And / or, The method further includes: if it is determined that the current target byte block is at the first position in the order of occurrence, then it is determined whether an initial key has been set for the first target byte block. If so, the initial key is set as the corresponding key for the current target byte block. If not, the step of selecting at least one first byte block from the at least one target byte block for the current target byte block is performed.

7. The method according to any one of claims 1-2, characterized in that, The method further includes: selecting a key network layer in the model to be encrypted as a target network layer, wherein the key network layer is a network layer that affects the model's inference. And / or, The method further includes: selecting a first target number of network layers suitable for the total number of network layers in the model to be encrypted, based on a preset correspondence between at least one range of network layers and a target number; selecting the first target number of target network layers from the network layers of the model to be encrypted; wherein the selected target network layers have any of the following characteristics: the first target number of target network layers are consecutive network layers in the model to be encrypted; or, there is at least one pair of first network layers in the first target number of target network layers, the two first network layers in each pair are adjacent in the target network layers, and the two first network layers are separated by at least one network layer in the model to be encrypted; or, any two adjacent target network layers in the first target number of target network layers are separated by at least one network layer in the model to be encrypted, and at least two pairs of adjacent target network layers are separated by different numbers of network layers. And / or, The method further includes: selecting a target set of layer numbers suitable for the total number of network layers in the model to be encrypted, based on the correspondence between at least one preset range of the total number of network layers and a set of layer numbers; and selecting network layers in the model to be encrypted whose layer numbers are included in the target set of layer numbers as target network layers. And / or, The method further includes: obfuscating and compiling the auxiliary code of the model to be encrypted, the auxiliary code being used to support the loading and deployment of the model; and encapsulating the obfuscated and compiled auxiliary code and the encrypted data into a model application package.

8. A model decryption method, characterized in that, The method includes: Obtain the encrypted model data of the model to be decrypted, wherein the encrypted model data is obtained by encrypting the model to be decrypted using the model encryption method described in any one of claims 1-7; Load the encrypted byte stream comprising the encrypted model data, and decrypt the encrypted data and position index data comprising the encrypted model data; Based on the decrypted position index data, locate the encrypted byte block in the encrypted byte stream; Each encrypted byte block is decrypted based on the decrypted encrypted data to restore the corresponding target byte block for each encrypted byte block. Replace each target byte block in the encrypted byte stream with the corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted; The target byte stream is subjected to model conversion processing to obtain the model to be decrypted; If the model to be decrypted is invoked for business reasoning, then for each target network layer applied to the model to be decrypted, the corresponding parameter obfuscation data of the target network layer included in the encrypted data of the model is decrypted, and the original parameters of the target network layer before parameter obfuscation are restored based on the decrypted parameter obfuscation data, so that the target network layer can perform business reasoning based on the original parameters.

9. The method according to claim 8, characterized in that, The encrypted byte stream is loaded into a first secure isolation environment for supporting the decryption of the model to be applied, and the first secure isolation environment has a corresponding model call interface. Then, the method further includes: if the model call interface receives a model call instruction, then it is determined that the model to be decrypted is called for business reasoning. And / or, The encrypted parameter obfuscation data, including the encrypted data, is stored in a second secure isolation environment. This second secure isolation environment has a data access interface. Therefore, decrypting the corresponding obfuscated parameter data of the network layer within the encrypted data, and restoring the network layer's parameters before obfuscation based on the decrypted obfuscated parameter data, includes: The decryption tool is invoked to decrypt the obfuscated parameter data of the target network layer in the second secure isolation environment; The corresponding parameter obfuscation data of the target network layer is invoked from the data call interface to restore the parameters of the target network layer before parameter obfuscation processing.

10. A model encryption device, characterized in that, The device includes: The first processing module is used to perform parameter obfuscation processing on the original parameters of at least one target network layer in the model to be encrypted, to obtain the parameter obfuscated model and parameter obfuscation data. The parameter obfuscation data is used to restore the original parameters of the target network layer before parameter obfuscation processing. The extraction module is used to extract at least one target byte block from the target byte stream corresponding to the model after parameter obfuscation. The second processing module is used to encrypt each target byte block to obtain a corresponding encrypted byte block and encrypted data for each target byte block. The encrypted data is used to restore the target byte block corresponding to the encrypted byte block. The first replacement module is used to replace each target byte block in the target byte stream with a corresponding encrypted byte block to obtain an encrypted byte stream and position index data, wherein the position index data is used to indicate the position of the encrypted byte block in the encrypted byte stream. An integration module is used to integrate the encrypted byte stream with the encrypted parameter obfuscation data, encrypted data, and position index data to obtain the model encryption data of the model to be encrypted.

11. A model decryption device, characterized in that, The device includes: An acquisition module is used to acquire the encrypted model data of the model to be decrypted, wherein the encrypted model data is obtained by encrypting the model to be decrypted using the model encryption method described in any one of claims 1-7; The processing module is used to load the encrypted byte stream included in the model encrypted data and decrypt the encrypted data and position index data included in the model encrypted data; The positioning module is used to locate the encrypted byte block in the encrypted byte stream based on the decrypted position index data; The restoration module is used to decrypt each encrypted byte block based on the decrypted encrypted data and restore the corresponding target byte block for each encrypted byte block. The second replacement module is used to replace each target byte block in the encrypted byte stream with a corresponding target byte block to obtain the target byte stream corresponding to the model to be decrypted. The conversion module is used to perform model conversion processing on the target byte stream to obtain the model to be decrypted; The calling module is configured to, if the model to be decrypted is called for business inference, decrypt the parameter obfuscation data of the target network layer included in the encrypted data of the model for each target network layer applied to the model to be decrypted, and restore the original parameters of the target network layer before parameter obfuscation based on the decrypted parameter obfuscation data, so that the target network layer can perform business inference based on the original parameters.

12. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is running, it controls the device where the storage medium is located to execute the model encryption method according to any one of claims 1 to 7, and / or execute the model decryption method according to any one of claims 8 to 9.

13. An electronic device, characterized in that, The electronic device includes: Memory, used to store programs; A processor, coupled to the memory, is configured to run the program to perform the model encryption method according to any one of claims 1 to 7, and / or to perform the model decryption method according to any one of claims 8 to 9.

Images