Model weight parameter protection method, terminal equipment and storage medium

Abstract

The invention is suitable for the field of model parameter encryption, and discloses a model weight parameter protection method, terminal equipment and a storage medium. The model weight parameter protection method comprises the steps of performing hierarchical division on a to-be-protected model weight parameter to obtain a plurality of weight hierarchies; performing hierarchical encryption processing on the plurality of weight hierarchies to obtain model weights after hierarchical encryption; if a reasoning task demand is detected, dynamically selecting a necessary part in the model weight to perform local decryption operation to obtain a plaintext model local weight parameter, and responding to the reasoning task demand according to the plaintext model local weight parameter; and if the reasoning task requirement is completed in response, recovering the local weight parameter of the plaintext model to be in an encrypted state. According to the method, the safety of the model weight in the whole process of storage and reasoning is improved.

Description

Technical Field

[0001] This invention belongs to the field of model parameter encryption, and particularly relates to a method, terminal device and storage medium for protecting model weight parameters. Background Technology

[0002] Traditional model weight protection methods struggle to ensure the smooth operation of inference tasks while simultaneously providing comprehensive security for model weights throughout the entire process. For instance, static encryption schemes require the entire weight to be decrypted into memory during model inference, making the plaintext weights vulnerable to unauthorized access via memory reads. This fails to effectively prevent model weight leakage or unauthorized restoration, demonstrating the low security of traditional model weight protection methods. A new technical approach is needed to address these issues. Summary of the Invention

[0003] In view of this, embodiments of the present invention provide a method, terminal device, and storage medium for protecting model weight parameters, which can solve the problem of low security in related technologies for protecting model weight parameters.

[0004] The first aspect of this invention provides a method for protecting model weight parameters, comprising: The weight parameters of the model to be protected are divided into multiple weight levels. The multiple weight levels are subjected to hierarchical encryption to obtain the hierarchically encrypted model weights. If a reasoning task requirement is detected, the necessary part of the model weights is dynamically selected for local decryption to obtain the model local weight parameters of the plaintext, and the reasoning task requirement is responded to based on the model local weight parameters of the plaintext. If the response completes the inference task requirement, the model local weight parameters of the plaintext will be restored to an encrypted state.

[0005] Optionally, in a first implementation of the first aspect of the present invention, the step of dividing the model weight parameters to be protected into multiple weight levels includes: Based on the structural hierarchy, functional modules, and / or parameter sensitivity of the model to be protected, the weight parameters of the model to be protected are grouped to obtain the multiple weight levels. The structural hierarchy includes an input layer, a hidden layer, and an output layer, and the functional modules include a model feature extraction module and a decision generation module.

[0006] Optionally, in a second implementation of the first aspect of the present invention, the step of performing layered encryption processing on the plurality of weight levels to obtain the layered encrypted model weights includes: Assign an independent encryption key to each of the weight levels; For each weight level, a symmetric encryption algorithm, an asymmetric encryption algorithm, and / or a preset encryption algorithm are invoked, and the encryption key is used to encrypt each weight level to obtain the layered encrypted model weights.

[0007] Optionally, in a third implementation of the first aspect of the present invention, the step of assigning an independent encryption key to each weight level includes: An independent key management system is used to assign an independent encryption key to each weight of the protected model at each weight level, and the key management system is used to store and distribute the encryption key.

[0008] Optionally, in a fourth implementation of the first aspect of the present invention, after the step of storing and distributing the encryption key through the key management system, the method further includes: If a request to distribute the encryption key is detected, an authentication operation is performed; If authentication is successful, the encryption key is issued through the key management system in response to the issuance request.

[0009] Optionally, in a fifth implementation of the first aspect of the present invention, after the step of storing and distributing the encryption key through the key management system, the method further includes: The encryption key for at least one of the weight levels shall be updated periodically.

[0010] Optionally, in a sixth implementation of the first aspect of the present invention, the step of dynamically selecting necessary parts of the model weights for local decryption to obtain plaintext model local weight parameters if a reasoning task requirement is detected includes: If an inference task requirement is detected, determine the target weight level corresponding to the current inference task; Based on the target weight level, the necessary part of the model weights is dynamically selected, wherein the non-target weight levels that are not selected remain encrypted. The necessary parts are decrypted to obtain the model local weight parameters of the plaintext.

[0011] Optionally, in the seventh implementation of the first aspect of the present invention, after the step of performing layered encryption processing on the plurality of weight levels to obtain the layered encrypted model weights, the method further includes: When abnormal access behavior is detected, the target weight of the abnormal access behavior in the model weights is determined; Temporarily freeze the decryption permission of the target weight and do not issue a decryption key.

[0012] Secondly, embodiments of the present invention provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for protecting model weight parameters.

[0013] Thirdly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described method for protecting model weight parameters.

[0014] Fourthly, embodiments of the present invention provide a computer program product that, when run on a terminal device, causes the terminal device to execute the aforementioned method for protecting model weight parameters.

[0015] The beneficial effects of the embodiments of the present invention compared with the prior art are as follows: by dividing the model weight parameters to be protected into layers and implementing layered encryption, when the inference task requirement is detected, only the necessary parts are dynamically selected for partial decryption to respond to the task, and the part is restored to the encrypted state after the task response is completed. This can avoid the model weights being in a fully plaintext state at any time, thereby effectively preventing the leakage or illegal restoration of model weights while ensuring the normal execution of the inference task, and improving the security of model weights in the entire process of storage and inference. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of an embodiment of the method for protecting model weight parameters in this invention; Figure 2 This is a schematic diagram of a specific embodiment of step S101 of the method for protecting model weight parameters in this invention. Figure 3 This is a schematic diagram of a specific embodiment of step S102 of the method for protecting model weight parameters in an embodiment of the present invention; Figure 4 This is a schematic diagram of a specific embodiment of step S103 of the method for protecting model weight parameters in an embodiment of the present invention; Figure 5 This is a schematic diagram of one embodiment of the terminal device in this invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are protected by this invention.

[0019] It should be noted that the terms "comprising," "including," and "having," and any variations thereof, in the specification, claims, and accompanying drawings of this invention, are intended to cover non-exclusive inclusion. For example, a process, method, terminal, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices. In the claims, specification, and accompanying drawings of this invention, relational terms such as "first" and "second" are used merely to distinguish one entity / operation / object from another entity / operation / object, and do not necessarily require or imply any such immediate relationship or order between these entities / operations / objects.

[0020] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0021] Traditional model weight protection methods struggle to ensure the smooth operation of inference tasks while simultaneously providing comprehensive security for model weights throughout the entire process. For instance, static encryption schemes require the entire weight to be decrypted into memory during model inference, making the plaintext weights vulnerable to unauthorized access via memory reads. This fails to effectively prevent model weight leakage or unauthorized restoration, demonstrating the low security of traditional model weight protection methods. A new technical approach is needed to address these issues.

[0022] In view of this, embodiments of the present invention provide a method, terminal device, and storage medium for protecting model weight parameters. By dividing the model weight parameters to be protected into layers and implementing layered encryption, when an inference task requirement is detected, only the necessary parts are dynamically selected for partial decryption to respond to the task, and the part is restored to the encrypted state after the task response is completed. This can prevent the model weights from being in a fully plaintext state at any time, thereby effectively preventing the leakage or illegal restoration of model weights while ensuring the normal execution of the inference task, and improving the security of model weights in the entire process of storage and inference.

[0023] To illustrate the technical solution of the present invention, specific embodiments are described below.

[0024] Figure 1 This illustration shows a flowchart of a method for protecting model weight parameters according to an embodiment of the present invention. This method can be applied to terminal devices. Terminal devices can be mobile phones, tablets, laptops, ultra-mobile personal computers (UMPCs), netbooks, etc.

[0025] Specifically, the method for protecting the above-mentioned model weight parameters may include the following steps S101 to S103.

[0026] Step S101: The weight parameters of the model to be protected are divided into layers to obtain multiple weight levels.

[0027] In an embodiment of the present invention, the model weight parameters to be protected are obtained. These model weight parameters are the core data foundation supporting the model in performing inference calculations. Then, according to a preset partitioning rule, all model weight parameters to be protected are partitioned hierarchically.

[0028] Specifically, by identifying the inherent relationships between parameters (such as computational logic correlation and data dependency), the overall weight parameters are decomposed into multiple independent weight levels. Each level contains a set of weight parameters with specific functional attributes, ultimately resulting in multiple weight levels.

[0029] Optionally, when setting the partitioning rules, adjustments can be made flexibly based on the actual application scenario. For example, based on the calling frequency of the weight parameters during the inference process, high-frequency calling parameters can be grouped into one level, and low-frequency calling parameters can be grouped into other levels; or based on the data scale of the parameters, large-scale parameters and small-scale parameters can be divided into different levels to adapt to the efficiency requirements of subsequent encryption operations.

[0030] Step S102: Perform layered encryption processing on multiple weight levels to obtain the layered encrypted model weights.

[0031] In an embodiment of the present invention, layered encryption processing is performed for each obtained weight level. Corresponding encryption logic is configured for each weight level, and encryption calculations are performed on the weight parameters within the level to ultimately generate the complete model weights after layered encryption.

[0032] Optionally, an encryption algorithm can be selected based on security requirements, such as using a symmetric encryption algorithm for efficient encryption or using an asymmetric encryption algorithm to improve key security; at the same time, the layered encrypted model weights can be stored in a local storage area with access control (such as an encrypted hard drive or a secure memory partition).

[0033] Optionally, a high-security parameter protection mechanism can be implemented by encrypting the parameters used in each stage of the model inference process. Specifically, for the parameters of each stage T, a dedicated transformation function is used. After processing it into a form that cannot be used directly, we get: ; This transformation function can include various structure preservation techniques to ensure that the transformed parameters cannot be directly used for inference calculations without a specific recovery mechanism, thus achieving the effect that the model cannot function properly when directly called in an encrypted state.

[0034] During model runtime, the parameters required at each stage are not directly exposed or preloaded. Instead, they are restored when triggered during model runtime, achieving a dynamic decryption effect and preventing attackers from obtaining the original parameters through memory attacks. ; in, This represents the authentication conditions or runtime environment variables required for decryption, such as the running device identifier, authorization timestamp, and user identity token. The decryption process at this stage can only be completed if the authorization conditions are met. After the inference at this stage is completed, the currently decrypted weights will be re-encrypted. This ensures that the model does not exist in memory in complete plaintext form during the entire inference process.

[0035] Step S103: If a reasoning task requirement is detected, the necessary part of the model weights is dynamically selected for local decryption to obtain the local model weight parameters of the plaintext, and the reasoning task requirement is responded to based on the local model weight parameters of the plaintext.

[0036] In embodiments of the present invention, continuous monitoring is performed to determine whether there is an externally initiated inference task requirement. The monitoring method can cover both active scanning and passive reception modes.

[0037] When a reasoning task requirement is detected, the core computational requirements of the reasoning task are analyzed. Based on this, the necessary parts of the model weights for completing the current reasoning task are dynamically identified, i.e., the weights that will prevent the reasoning computation from proceeding if these parts are missing. Then, only the identified necessary parts are partially decrypted, converting them from ciphertext to plaintext that can be directly used in the computation, thus obtaining the plaintext model local weight parameters. Finally, the plaintext model local weight parameters are called to access the reasoning computation process, complete the data calculation and result generation according to the reasoning logic, and feed the reasoning results back to the request initiator, thereby responding to the reasoning task requirement.

[0038] Optionally, when dynamically selecting necessary parts, the judgment can be refined in conjunction with the execution stage of the inference task. For example, in the initial stage of inference, only weights related to input data preprocessing can be selected as necessary parts, and in the intermediate stage of inference, weights related to core computation can be selected as necessary parts. When performing partial decryption, the corresponding decryption key can be obtained from the local secure key storage module, or a temporary decryption key can be requested from the external key management system through a secure channel.

[0039] Step S104: If the response meets the requirement to complete the inference task, the plaintext model local weight parameters are restored to the encrypted state.

[0040] In an embodiment of the present invention, after confirming that the inference task requirements have been fully met, an encryption operation is performed on the plaintext model local weight parameters previously obtained through partial decryption. This involves calling encryption logic that matches the weight level to which the plaintext model local weight parameters belong, converting the plaintext model local weight parameters back to ciphertext, ensuring that the plaintext model local weight parameters are no longer stored in plaintext form. Optionally, when restoring encryption, the terminal device can use the original encryption algorithm and key for that weight level, or it can generate new encryption parameters based on a real-time security policy. Simultaneously, after restoring encryption, the terminal device can trigger a memory cleanup mechanism to remove any remaining plaintext model local weight parameter data from memory, further eliminating the potential risk of plaintext leakage.

[0041] The beneficial effects of the embodiments of the present invention compared with the prior art are as follows: by dividing the model weight parameters to be protected into layers and implementing layered encryption, when the inference task requirement is detected, only the necessary parts are dynamically selected for partial decryption to respond to the task, and the part is restored to the encrypted state after the task response is completed. This can avoid the model weights being in a fully plaintext state at any time, thereby effectively preventing the leakage or illegal restoration of model weights while ensuring the normal execution of the inference task, and improving the security of model weights in the entire process of storage and inference.

[0042] Traditional model weight hierarchical partitioning techniques lack a basis tailored to the model's inherent characteristics, often employing simple random partitioning methods. This can easily lead to a disconnect between the resulting weight hierarchy and the model's structural functionality, ultimately impacting the efficiency of dynamic decryption. Therefore, this invention proposes an optional embodiment. (Refer to...) Figure 2 , Figure 2 This is a schematic diagram of a specific embodiment of step S101 of the method for protecting model weight parameters in this invention. Step S101 further includes the following specific implementation: Step S1011: Based on the structural hierarchy, functional modules and / or parameter sensitivity of the model to be protected, the weight parameters of the model to be protected are grouped to obtain multiple weight levels. The structural hierarchy includes an input layer, a hidden layer and an output layer, and the functional modules include a model feature extraction module and a decision generation module.

[0043] In embodiments of this invention, basic information about the model to be protected is obtained, including the model's structural design document, functional module division description, and sensitivity analysis data for the weight parameters. The structural design document is used to determine whether the model contains typical structural layers such as input layers, hidden layers, and output layers; the functional module division description is used to define the weight ranges corresponding to core functions such as feature extraction and decision generation; and the sensitivity analysis data is used to distinguish the sensitivity of different weight parameters to the model's core logic and intellectual property value.

[0044] Optionally, a preset model parsing tool can be invoked to automatically extract structural hierarchy and functional module information from the model file.

[0045] Based on actual protection needs, at least one of the following can be selected as the basis for weight grouping: model structure hierarchy, functional modules, and parameter sensitivity. If priority is given to adapting to the functional call logic during model inference, the functional modules can be used as the basis, grouping all weight parameters involved in the feature extraction module into one weight hierarchy and all weight parameters involved in the decision generation module into another weight hierarchy. If priority is given to matching the model's computational flow, the structural hierarchy can be used as the basis, dividing the input layer weights, the weights of each hidden layer, and the output layer weights into independent weight hierarchy. If priority is given to strengthening protection for high-value parameters, parameter sensitivity can be used as the basis, dividing high-sensitivity parameters, medium-sensitivity parameters, and low-sensitivity parameters into different weight hierarchy.

[0046] Optionally, the system can be divided into two main functional modules: feature extraction and decision generation. Each module can then be further subdivided into high-sensitivity and low-sensitivity sub-levels based on parameter sensitivity, thereby improving the accuracy of grouping.

[0047] Optionally, grouping operations are performed on all model weight parameters to be protected according to the selected grouping criteria. During the grouping process, each weight parameter is precisely assigned to its corresponding weight level by using its identifier or its position in the model computation chain.

[0048] Optionally, after grouping is completed, a hierarchy mapping table can be generated to record the hierarchy to which each weight parameter belongs and the core attributes of that hierarchy, so as to facilitate quick location of the hierarchy during subsequent encryption and decryption operations.

[0049] In this embodiment of the invention, the hierarchical division of model weight parameters, based on three criteria—model structure hierarchy, functional modules, and parameter sensitivity—avoids the crude approach of traditional random grouping or simply grouping by data volume. This effectively prevents problems such as low encryption efficiency or uncontrolled decryption range caused by chaotic hierarchical division.

[0050] Traditional model weight encryption techniques often employ either a single key shared by all weights or a fixed single encryption algorithm. The former, if the key is leaked, exposes all weights to the risk of being compromised, resulting in extremely poor security; the latter, if a high-strength asymmetric algorithm is chosen, suffers from low encryption and decryption efficiency, impacting model inference performance. Based on this, the present invention proposes an optional embodiment. (Refer to...) Figure 3 , Figure 3 This is a schematic diagram of a specific embodiment of step S101 of the method for protecting model weight parameters in this invention. Step S102 further includes the following specific implementation: Step S1021: Assign an independent encryption key to each weight level.

[0051] In an embodiment of the present invention, multiple weight levels that have been divided into layers are obtained, and each weight level is uniquely identified to obtain the boundaries and parameter ranges of each level.

[0052] Each identified weight level is assigned an independent encryption key. Each key corresponds to only one weight level, and encryption keys for different levels are not shared, thus avoiding the risk that the weights of all levels will be cracked due to the leakage of a single key.

[0053] Optionally, an independent key management system is used to assign a unique encryption key to the weights of each protected model at each weight level. This key management system then stores and distributes the encryption keys. Specifically, a secure communication connection is established with a pre-defined independent key management system. Upon connection establishment, the user submits their trusted identity credentials to the key management system. A key allocation request is sent to the authenticated key management system, containing clear weight level information, such as the total number of weight levels, a unique identifier for each level, and the security attributes of each level. The key management system generates a unique encryption key for each protected model weight based on the request information and stores the mapping between the level ID and the encryption key in its secure storage module. Then, the key management system only sends a notification of successful key allocation and the key identifiers for each level to the terminal device, without directly transmitting the keys themselves. The terminal device receives the feedback from the key management system and associates the key identifiers for each level with the locally stored weight level information, so that when a key is needed later, it can quickly locate and request the corresponding key using the key identifier.

[0054] Optionally, if a request to distribute an encryption key is detected, an authentication operation is performed; if authentication fails... Specifically, the system monitors in real time for requests to distribute encryption keys, triggered by an internal module of the terminal device. The terminal device checks whether the request contains complete target information; if the information is incomplete or incorrectly formatted, the request is rejected directly and an exception log is recorded. If an authentication failure is received, the terminal device will reject subsequent key-related operations and return an insufficient permission message to the request initiator, while also recording the failure details.

[0055] Optionally, the encryption key for at least one weight level can be updated periodically.

[0056] Optionally, multi-factor authentication can be supported, such as collecting user passwords and dynamic verification codes simultaneously.

[0057] Step S1022: For each weight level, call the symmetric encryption algorithm, the asymmetric encryption algorithm and / or the preset encryption algorithm, and combine them with the encryption key to encrypt each weight level to obtain the layered encrypted model weights.

[0058] In the embodiments of this invention, based on the security and performance requirements of each weight level, a suitable encryption algorithm is selected for each level from symmetric encryption algorithms, asymmetric encryption algorithms, and preset encryption algorithms: for highly sensitive levels with high encryption efficiency requirements, symmetric encryption algorithms can be selected; for highly sensitive levels requiring secure key transmission, asymmetric encryption algorithms can be selected; and for scenarios with customized security requirements, preset self-developed encryption algorithms can be selected. Simultaneously, the encryption algorithm selection results for each level are associated and stored with the corresponding independent key, forming a mapping relationship between levels, algorithms, and keys.

[0059] Optionally, a combination of the main algorithm and the auxiliary verification algorithm can be used for the same weight level, and a hash algorithm can be used to generate data verification values.

[0060] Optionally, encryption is performed on each weight level sequentially according to the mapping relationship between the level, algorithm, and key. Specifically, for a single level, the selected encryption algorithm is invoked, and the plaintext weight parameters of that level and the corresponding independent encryption key are input into the algorithm logic to perform encryption operations, converting the plaintext weights into ciphertext that cannot be directly read. After the encryption of a single level is completed, the ciphertext attributes of that level are recorded, and the above encryption operation is repeated for the remaining weight levels in turn. After all levels of encryption are completed, the ciphertext weights of each level are integrated in the original level order to form the complete layered encrypted model weights, and the integrity of the integration result is verified.

[0061] Optionally, an encryption manifest can be generated after integration, recording the encryption algorithm, key identifier, and ciphertext check value for each level, which can be used to verify the level information during subsequent loading or decryption.

[0062] In this embodiment of the invention, by assigning an independent encryption key to each weight level and flexibly selecting a combination of multiple encryption algorithms, the risk of multiple levels sharing a single key in traditional encryption schemes is resolved. Furthermore, by providing multiple options such as symmetric, asymmetric, and preset algorithms, the optimal encryption scheme can be adapted to the security and performance requirements of different weight levels, avoiding the limitations of a single algorithm being either insufficiently secure or inefficient.

[0063] Traditional model weight protection methods often employ either full decryption or fixed-range decryption strategies during the inference phase. The former requires decrypting all encrypted weights into plaintext at once, resulting in the complete model weights being exposed in memory for an extended period, making them vulnerable to theft via memory access tools. The latter pre-defines a fixed decryption range, decrypting only the weights within that range regardless of the current inference task's needs, potentially including a large number of unnecessary weights and still posing a significant risk of plaintext leakage. Based on this, the present invention proposes an optional embodiment. (Refer to...) Figure 4 , Figure 4 This is a schematic diagram of a specific embodiment of step S103 of the method for protecting model weight parameters in this invention. Step S103 further includes the following specific implementation: Step S1031: If a reasoning task requirement is detected, determine the target weight level corresponding to the current reasoning task.

[0064] In embodiments of this invention, a preset monitoring mechanism is used to detect in real time whether there are externally initiated inference task requirements. Upon detection of an inference task requirement, the core computational attributes of the task are analyzed first, including the inference objective, the key computational steps to be executed, and the model functional modules the task depends on. Based on the analysis results, and combined with previously completed weight hierarchy division rules, the target weight hierarchy that the current inference task must depend on is determined through reverse matching. For example, if the inference task is the feature extraction stage of image classification, the weight hierarchy corresponding to the feature extraction module is determined to be the target weight hierarchy; if the task is the initial token processing stage of text generation, the weight hierarchy corresponding to the input layer structure is determined to be the target weight hierarchy.

[0065] Optionally, if multiple inference tasks exist simultaneously, the target weight level of the higher priority task should be judged first, or an independent level judgment thread should be assigned to different tasks.

[0066] Step S1032: Dynamically select the necessary parts of the model weights according to the target weight level, wherein the non-target weight levels that are not selected remain encrypted.

[0067] In this embodiment of the invention, after determining the target weight level corresponding to the current inference task, the necessary parts of the model weights are dynamically selected based solely on the target weight level. That is, only all weight parameters included in the target weight level are designated as the weight content necessary for the current inference. The remaining non-target weight levels, regardless of their parameter attributes, maintain their initial encrypted state and are not subjected to any decryption preprocessing. A list of necessary and non-target parts is generated, clearly indicating the weight range and encryption state of both parts.

[0068] Optionally, if the inference task needs to be executed in multiple stages, the target weight levels can be dynamically adjusted according to each stage. In the first round of inference, only the input layer and the initial feature extraction layer are selected as target levels. In the second round of inference, the intermediate hidden layer and the feature optimization layer are selected as target levels, thus achieving phased weight selection as needed, rather than selecting all target levels at once.

[0069] Step S1033: Decrypt the necessary parts to obtain the plaintext model local weight parameters.

[0070] In an embodiment of the present invention, a local decryption operation is initiated for the selected necessary weights. Specifically, based on the target weight level to which the necessary part belongs, the key identifier of the corresponding level is extracted from the locally stored level-key identifier mapping table, and a decryption key request corresponding to the identifier is initiated to an independent key management system. After obtaining a valid decryption key, the decryption logic matching the encryption algorithm of the weight level is invoked to convert the ciphertext weights of the necessary part into plaintext weights that can be directly used in inference calculations. After decryption, a simple integrity check is performed on the plaintext weights. After confirming that there are no decryption errors, the plaintext weights are determined as the plaintext model local weight parameters for subsequent inference task responses.

[0071] Optionally, a memory isolation mechanism can be enabled during the decryption process to store the local weight parameters of the plaintext model in an independent secure memory partition, physically isolated from other encrypted data of non-target weights, thereby further reducing the risk of plaintext data being interfered with.

[0072] In this embodiment of the invention, the risk of plaintext exposure caused by full weight decryption during the model inference stage is solved by a progressive operation of first determining the target level, then selecting the necessary parts, and only partially decrypting.

[0073] Traditional model weight protection methods lack precise emergency response measures even when abnormal access behavior is detected. Either they cannot pinpoint the specific weight targeted by the abnormal access, only passively intercepting the current operation and failing to prevent attackers from launching new attacks on the same weight; or, to prevent risk propagation, they directly freeze decryption permissions for all weight levels, causing legitimate users to be unable to execute normal inference tasks and resulting in business interruption. Based on this, the present invention proposes an optional embodiment. The following specific implementation methods are included after step S102: Step S201: When abnormal access behavior is detected, determine the target weight of the abnormal access behavior in the model weight.

[0074] In an embodiment of the present invention, after completing the inference task and restoring the local weight parameters of the plaintext model to an encrypted state, operation logs related to the model weights on the terminal device are collected in real time. These logs are then dynamically compared and analyzed using a pre-defined abnormal behavior feature library to determine if any access behavior deviates from normal usage logic. If an operation is detected to match any feature in the abnormal behavior feature library, it is determined that abnormal access behavior has been detected.

[0075] Optionally, custom configuration of abnormal behavior characteristics is supported. For example, based on the actual risks of the private deployment scenario, personalized abnormal characteristics such as adding weighted access by specific accounts during non-working hours can be added.

[0076] Furthermore, upon detecting abnormal access behavior, the target weight localization process is initiated. First, the specific operation objects of the abnormal access behavior are traced back, including the weight storage address of the abnormal request, the weight identifier that attempted to be decrypted, and the weight data interaction records corresponding to the operation; then, these operation objects are matched with the locally stored weight hierarchy, storage address, and identifier information mapping table to determine the specific weight hierarchy or set of weight parameters targeted by the abnormal access behavior, i.e., the target weight.

[0077] Step S202: Temporarily freeze the decryption permission of the target weight and do not issue the decryption key.

[0078] In this embodiment of the invention, after determining the target weight, a temporary freeze operation is performed on the decryption permission of the target weight. First, the terminal device sends a freeze request to an independent key management system. The request includes the unique identifier of the target weight, requesting the key management system to suspend issuing any decryption keys to the target weight until the freeze is lifted. Simultaneously, the terminal device locally intercepts all decryption commands related to the target weight. Even if there are legitimate decryption requests that have passed authentication, as long as the request object is the target weight, the terminal device will directly refuse to perform the decryption operation and return a message indicating that the target weight is temporarily unavailable. Furthermore, the terminal device records the freeze information for subsequent risk assessment and permission restoration.

[0079] Optionally, a default value for the freeze duration can be set. If no new abnormal behavior is detected within the timeout period, an unfreeze request will be automatically initiated; if abnormalities still exist, the freeze duration will be extended.

[0080] In this embodiment of the invention, the problem of the inability to accurately block risks in existing anomaly protection is solved by abnormal behavior detection, target weight positioning, and temporary freezing of decryption permissions.

[0081] like Figure 5 The diagram illustrates a terminal device according to an embodiment of the present invention. The terminal device 500 may include a processor 501, a memory 502, and a computer program 503 stored in the memory 502 and executable on the processor 501, such as a protection program for model weight parameters. When the processor 501 executes the computer program 503, it implements the steps in the various protection embodiments for model weight parameters described above.

[0082] A computer program can be divided into one or more modules / units. One or more modules / units are stored in memory 502 and executed by processor 501 to complete the present invention. One or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in a terminal device.

[0083] The terminal device may include, but is not limited to, processor 501 and memory 502. Those skilled in the art will understand that... Figure 5 This is merely an example of a terminal device and does not constitute a limitation on the terminal device. It may include more or fewer components than shown in the figure, or combine certain components, or different components. For example, a terminal device may also include input / output devices, network access devices, buses, etc.

[0084] The processor 501 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0085] The memory 502 can be an internal storage unit of the terminal device, such as the hard drive or RAM of the terminal device. The memory 502 can also be an external storage device of the terminal device, such as a plug-in hard drive, SmartMediaCard (SMC), SecureDigital (SD) card, or FlashCard. Furthermore, the memory 502 can include both internal and external storage units of the terminal device. The memory 502 is used to store computer programs and other programs and data required by the terminal device. The memory 502 can also be used to temporarily store data that has been output or will be output.

[0086] It should be noted that, for the sake of convenience and brevity, the structure of the terminal device described above can also be referred to the specific description of the structure in the method embodiment, which will not be repeated here.

[0087] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the steps in the above-described method for protecting model weight parameters.

[0088] This invention provides a computer program product that, when run on a mobile terminal, enables the mobile terminal to implement the steps in the above-mentioned method for protecting model weight parameters.

[0089] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0090] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for various specific applications, but such implementations should not be considered beyond the scope of this invention.

[0091] In the embodiments provided by this invention, it should be understood that the disclosed terminal devices and methods can be implemented in other ways. For example, the terminal device embodiments described above are merely illustrative. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0092] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0093] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0094] If an integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0095] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for protecting model weight parameters, characterized in that, include: The weight parameters of the model to be protected are divided into multiple weight levels. The multiple weight levels are subjected to hierarchical encryption to obtain the hierarchically encrypted model weights. If a reasoning task requirement is detected, the necessary part of the model weights is dynamically selected for local decryption to obtain the model local weight parameters of the plaintext, and the reasoning task requirement is responded to based on the model local weight parameters of the plaintext. If the response completes the inference task requirement, the plaintext model local weight parameters are restored to an encrypted state.

2. The method for protecting model weight parameters as described in claim 1, characterized in that, The step of dividing the weight parameters of the model to be protected into multiple weight levels includes: Based on the structural hierarchy, functional modules, and / or parameter sensitivity of the model to be protected, the weight parameters of the model to be protected are grouped to obtain the multiple weight levels. The structural hierarchy includes an input layer, a hidden layer, and an output layer, and the functional modules include a model feature extraction module and a decision generation module.

3. The method for protecting model weight parameters as described in claim 1, characterized in that, The step of performing hierarchical encryption on the multiple weight levels to obtain the hierarchically encrypted model weights includes: Assign an independent encryption key to each of the weight levels; For each weight level, a symmetric encryption algorithm, an asymmetric encryption algorithm, and / or a preset encryption algorithm are invoked, and the encryption key is used to encrypt each weight level to obtain the layered encrypted model weights.

4. The method for protecting model weight parameters as described in claim 3, characterized in that, The step of assigning an independent encryption key to each weight level includes: An independent key management system is used to assign an independent encryption key to each weight of the protected model at each weight level, and the key management system is used to store and distribute the encryption key.

5. The method for protecting model weight parameters as described in claim 4, characterized in that, After the steps of storing and distributing the encryption key through the key management system are completed, the method further includes: If a request to distribute the encryption key is detected, an authentication operation is performed; If authentication is successful, the encryption key is issued through the key management system in response to the issuance request.

6. The method for protecting model weight parameters as described in claim 4, characterized in that, After the steps of storing and distributing the encryption key through the key management system are completed, the method further includes: The encryption key for at least one of the weight levels shall be updated periodically.

7. The method for protecting model weight parameters as described in claim 1, characterized in that, The step of dynamically selecting necessary parts of the model weights for local decryption to obtain the plaintext model local weight parameters if a reasoning task requirement is detected includes: If an inference task requirement is detected, determine the target weight level corresponding to the current inference task; Based on the target weight level, the necessary part of the model weights is dynamically selected, wherein the non-target weight levels that are not selected remain encrypted. The necessary parts are decrypted to obtain the model local weight parameters of the plaintext.

8. The method for protecting model weight parameters as described in claim 1, characterized in that, After the step of performing layered encryption processing on the multiple weight levels to obtain the layered encrypted model weights, the method further includes: When abnormal access behavior is detected, the target weight of the abnormal access behavior in the model weights is determined; Temporarily freeze the decryption permission of the target weight and do not issue a decryption key.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method for protecting model weight parameters as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method for protecting model weight parameters as described in any one of claims 1 to 8.

Images