A TEE endogenous lightweight proof method for AI model behavior verifiability

Abstract

The application discloses a TEE endogenous lightweight proof method for AI model behavior verifiability, and belongs to the technical field of big data and artificial intelligence, wherein the method is characterized in that a behavior monitoring probe is arranged inside a TEE, activation values of a model intermediate layer are captured in real time, feature contribution degrees are calculated, behavior records are compressed into behavior abstracts through a Merkle tree, and finally, an authentication report fusing traditional TEE authentication and behavior abstracts is generated, a verifier can verify the compliance of model behavior through the report, and fine-grained auditing of specific reasoning behavior is supported. The application realizes the verifiability of AI model runtime behavior while ensuring the privacy of models and data, solves the problem of efficient and verifiable monitoring of AI model runtime behavior under the premise of protecting the privacy of models and data, and has the characteristics of lightweight, high efficiency and low cost.

Description

Technical Field

[0001] This invention relates to a TEE-based lightweight proof method for verifying the behavior of AI models, belonging to the fields of big data and artificial intelligence technology. Background Technology

[0002] With the widespread application of AI technology in sensitive fields such as finance and healthcare, ensuring that AI models adhere to predetermined compliance strategies (such as fairness and unbiasedness) during actual inference and operation has become crucial. Currently, Trusted Execution Environment (TEE) technologies (such as Intel SGX, AMD SEV, and ARM TrustZone) provide confidentiality and integrity protection for sensitive computing tasks through hardware isolation mechanisms. These technologies, through remote authentication mechanisms, can prove to third parties that code executes in a real TEE environment and has not been tampered with. However, traditional TEE remote authentication can only verify the initial state of the execution environment and the integrity of the loaded code, falling under the category of static authentication and unable to effectively verify and prove runtime dynamic behavior.

[0003] Several existing technical solutions attempt to address this issue: The first solution is to record detailed operation logs inside the TEE and transmit them out for auditing, but this method carries the risk of privacy leaks, as the logs may contain sensitive information; the second solution is to use a dedicated security coprocessor for external monitoring, but this requires additional hardware support, is costly, and difficult to deploy; the third solution is based on full zero-knowledge proofs to generate proofs for the entire computation process, which provides powerful verification capabilities, but the computational overhead is 104 to 106 times that of the original computation, making it almost infeasible in practical AI inference scenarios.

[0004] Furthermore, while existing software-based monitoring solutions do not require hardware modifications, they typically necessitate adding a monitoring layer external to the model. This introduces performance overhead, and because the monitoring layer is separated from the model's runtime environment, it cannot directly access the model's internal state and intermediate results, resulting in limited monitoring granularity. Simultaneously, these solutions struggle to provide verifiable behavioral proofs while protecting data privacy, failing to meet regulatory agencies' verification requirements for the compliance of AI model behavior. Particularly when fine-grained auditing of specific inference behaviors is required, existing solutions often expose raw data or intermediate results, contradicting privacy protection requirements.

[0005] Therefore, there is an urgent need for a technical solution that can efficiently and verifiably monitor the runtime behavior of AI models while protecting data and model privacy, ensuring the accuracy of verification while controlling performance overhead within a reasonable range. Summary of the Invention

[0006] The purpose of this invention is to provide a TEE-based lightweight proof method for verifying the behavior of AI models. This method can achieve verifiability of the runtime behavior of AI models while protecting data and AI model privacy, thereby overcoming the shortcomings of existing technologies.

[0007] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A lightweight, endogenous proof method for verifying the behavior of AI models via TEE includes the following steps: S1. In a TEE device supporting TEE technology, a policy loading and parsing module, an endogenous behavior probe module, a Merkle tree processing module, and a proof generation module are set up. The policy loading and parsing module is responsible for reading and verifying the behavior monitoring policy; the endogenous behavior probe module is used to capture the activation values ​​of the intermediate layers of the model in real time and calculate the feature contribution, realizing the embedding of monitoring logic inside the AI ​​model; the Merkle tree processing module is responsible for the cryptographic compression of behavior records; and the proof generation module is used to generate a fusion authentication report. In the verifier environment, a remote authentication verification module and a behavior audit module are set up. The remote authentication verification module is used to verify the authenticity of the TEE environment; the behavior audit module is used to perform compliance checks on the model behavior. S2. The model provider uses the standard AES-256-GCM algorithm to encrypt its proprietary AI model. The encryption key is a randomly generated 256-bit key K_model. This key K_model is then encrypted again using the asymmetric public key PK_tee of the TEE device, forming double protection. S3. The data holder uses the public key PK_tee of the TEE device to encrypt its sensitive data; the encrypted data and key are transmitted to the secure storage system of the computing service provider through a secure channel; S4. The verifier initiates a remote authentication request, sending an authentication challenge containing a random number Nonce_auth to the TEE device; upon receiving the request, the TEE device collects authentication measurements of the current environment, including: the Enclave's MRENCLAVE value, MRSIGNER value, ATTRIBUTES value, and user-defined data; these data are signed using the TEE hardware's endorsement key to generate a standard authentication report. The S5.TEE device retrieves encrypted models, data, and policy files from the secure storage system and decrypts them; The policy loading and parsing module in the S6.TEE device first verifies the digital signature of the policy file; it then uses the ECC public key and ECDSA verification algorithm provided by the model provider to confirm the integrity and authenticity of the policy file. After verification, the policy loading and parsing module parses the policy content in JSON format and extracts the specific monitoring parameters. The endogenous behavior probe module in the S7.TEE device registers forward propagation hooks at a specified layer of the AI ​​model according to the parsed policy configuration. The S8.TEE device performs AI model inference; the input data propagates forward in the model, passing through each layer of the network architecture in sequence. When the computation reaches a layer that has registered monitoring hooks, the deep learning framework automatically triggers the corresponding hook function. S9. The endogenous behavior probe captures the intermediate activation values ​​of the model in the hook function and calculates the contribution score of the specified feature according to the attribution algorithm configured by the policy. S10. Encapsulate the monitoring results of each sampling into a structured behavior record; S11. The Merkle tree processing module periodically reads accumulated behavior records from the secure memory area, performs normalized serialization on each record to ensure that the field order and encoding are consistent, and then calculates the SHA-256 hash value of each record as the leaf node of the Merkle tree; S12. The Merkle tree processing module uses an incremental construction algorithm to organize the leaf node hash values ​​into a complete Merkle tree, and the final calculated root hash value serves as the behavior summary for the current time period. S13. When the number of behavior records reaches a predetermined threshold or a specific time interval has elapsed, the Merkle tree processing module generates the final behavior summary root hash and updates the internal state; S14. The verifier initiates an audit challenge to the TEE device. The proof generation module of the TEE device receives the challenge request and verifies the legality of the request. S15. The proof generation module of the TEE device collects current state information to generate a report. The collected data includes: standard TEE certification measurement values, the latest behavior digest root hash, the Nonce_audit provided by the verifier, and optional timestamps and serial numbers. These data are serialized according to a fixed structure, and the serialized data is used as a message to be signed, ready for hardware signing. S16. The proof generation module of the TEE device requests the TEE hardware to digitally sign the message to be signed using the endorsement key and generate a fusion authentication report; the generated fusion authentication report is returned to the verifier through a secure channel. S17. After receiving the fusion certification report, the verifier first verifies the validity of the hardware signature. After the signature verification is passed, the verifier confirms that the report comes from a real TEE environment and that the content has not been tampered with. S18. The verifier extracts the root hash of the behavior summary from the report and uses it as proof of the integrity of all behavior records from the last authentication to the current moment; the verifier compares the received root hash with the expected value or compliance benchmark stored locally; and judges the overall behavior compliance based on the comparison results.

[0008] As a preferred embodiment, in step S3, when the data holder uses the public key PK_tee of the TEE device to encrypt its sensitive data, the encryption process adopts a hybrid encryption scheme: first, a random 256-bit symmetric key K_data is generated, the actual data is encrypted using the standard AES-256-GCM algorithm, and then K_data is encrypted using the asymmetric public key PK_tee of the TEE device.

[0009] As a preferred embodiment, in step S3, the secure storage system employs an encrypted distributed file system, all stored data is encrypted using AES-256, and access control is based on roles and attributes to ensure that only authorized TEE instances can access the corresponding data.

[0010] As a preferred embodiment, in step S5, the symmetric keys K_model and K_data are first decrypted using the private key SK_tee of the TEE device. The decryption process employs a corresponding asymmetric decryption algorithm. Then, the actual model file and data file are decrypted using the AES-256-GCM algorithm with the decrypted symmetric key.

[0011] As a preferred embodiment, step S6 includes the following parsing process: verifying whether each layer name in monitored_layers actually exists in the AI ​​model; checking whether the range of feature_indices is valid; confirming that the algorithm specified by attribute_algorithm has been implemented; verifying that threshold is a reasonable floating-point number; and ensuring that sampling_rate is between 0 and 1.

[0012] As a preferred embodiment, in step S7, the implementation of registering forward propagation hooks relies on the hook mechanism of the deep learning framework: register_forward_hook is used in PyTorch, and tf.custom_gradient or inter-layer interceptors are used in TensorFlow. The hook functions are configured to be automatically triggered when the model forward propagates to the target layer, and each hook function contains the following logic: checking whether detailed monitoring is needed; capturing the input and output tensors of the layer; recording the metadata of the tensors; and preparing to call the attribution algorithm to calculate the feature contribution.

[0013] As a preferred embodiment, the data captured in step S9 specifically includes: the input tensor, output tensor, weight parameters, and gradient information of the current layer.

[0014] As a preferred option, in step S12, the construction process adopts a standard binary tree structure: leaf nodes form the bottom layer, and every two adjacent nodes are hashed and concatenated to form a parent node, and the process is recursively repeated until the root node is reached; for performance optimization, a sparse Merkle tree variant is adopted, using Merkle mountain or Verkle tree structures to reduce the computational overhead during large-scale updates.

[0015] As a preferred embodiment, in step S13, the update process includes: storing the current root hash associated with a time range; initializing a new Merkle tree instance for subsequent recording; safely cleaning up old behavior records; the cleaning process ensures that records already included in the Merkle tree are safely erased to prevent memory leaks, while retaining necessary metadata to support historical auditing.

[0016] As a preferred embodiment, step S19 is also included: when a deep audit of a specific reasoning behavior is required, the verifier can request a Merkle proof from the TEE device for a specific request identifier. The request includes the target request_id and a new random number Nonce_proof. The TEE device finds the corresponding behavior record based on the request_id and generates a path proof of the record in the Merkle tree. The path proof includes the hash values ​​of all sibling nodes from the leaf node to the root node. The verifier uses the proof to verify the authenticity of the record: starting from the leaf node hash, the parent node hash is calculated layer by layer, and finally compared with the certified root hash. If the verification is successful, the authenticity and integrity of the specific behavior record are confirmed.

[0017] Beneficial Effects: This invention mainly comprises two parts: the first part involves capturing activation values ​​of intermediate layers of the model in real time within the TEE using an endogenous monitoring probe and calculating feature contributions to generate behavior records; the second part creatively constructs these behavior records into Merkle trees and generates behavior summaries, which are then fused with traditional TEE remote authentication to generate a verifiable fusion authentication report. This allows verifiers to verify the overall compliance of the behavior through the report, and also to perform fine-grained auditing of specific behaviors through Merkle proofs. This method differs from traditional full log auditing or costly zero-knowledge proof schemes.

[0018] Compared with existing technologies, this invention achieves verifiability of AI model runtime behavior while ensuring model and data privacy. It solves the problem of efficiently and verifiably monitoring AI model runtime behavior while protecting model and data privacy. It is highly accurate, low-cost, lightweight, efficient, and low-overhead. The verification granularity can be accurate to the internal state of a single inference behavior. The verification process is lightweight, efficient, and can produce cryptographic proofs. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the overall device architecture and process of the present invention. Detailed Implementation

[0020] To further illustrate the technical means and effects of the present invention in achieving the intended purpose, the following detailed description of the specific implementation methods, structures, features and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0021] This invention deploys behavior monitoring probes within a TEE (Tracking Equipment) to capture activation values ​​of the model's intermediate layers in real time and calculate feature contributions. The behavior records are then compressed into behavior summaries using a Merkle tree, ultimately generating an authentication report that integrates traditional TEE authentication with the behavior summary. Verifiers can use this report to verify the compliance of the model's behavior and support fine-grained auditing of specific inference behaviors.

[0022] The device of this invention consists of two parts: one part is deployed on the computing service provider in the form of a TEE enclave, and the other part is deployed on the verifier's end in the form of a verification tool. The TEE enclave primarily provides policy loading and parsing functions, verifying and parsing behavior monitoring policies; endogenous behavior monitoring functions, capturing intermediate activation values ​​and calculating feature contributions during model inference through a hook mechanism; behavior summary generation functions, constructing behavior records into a Merkle tree and generating a root hash; and fusion authentication report generation functions, combining behavior summaries with traditional TEE authentication to generate a verifiable report. The verification tool is mainly responsible for communicating with the TEE enclave, initiating remote authentication and behavior auditing requests; verifying the authenticity of the fusion authentication report; and performing in-depth auditing of specific behaviors through Merkle proofs.

[0023] The overall device architecture of the present invention is as follows: Figure 1 As shown, the device is deployed in the Trusted Execution Environment (TEE) of the computing service provider and includes core components, a TEE enclave, and a secure storage system. The core components include the following four modules: a policy loading and parsing module, an endogenous behavior probe module, a Merkle tree processing module, and a proof generation module. The policy loading and parsing module communicates with the endogenous behavior probe module, the endogenous behavior probe module communicates with the Merkle tree processing module and the TEE enclave, the Merkle tree processing module communicates with the proof generation module, the proof generation module communicates with the hardware security module and the verifier, the TEE enclave communicates with the verifier and the secure storage system, and the secure storage system communicates with the data and model holders.

[0024] The process of this invention is as follows Figure 1As shown, the main steps include: 1. Remote authentication request; 2. Authentication report + public key; 3. Encrypted data and key; 4. Encryption model and key + signature policy; 5. Obtain and decrypt data; 6. Verify policy signature; 7. Register monitoring hooks; 8. Perform inference calculation; 9. Monitor behavior and calculation; 10. Construct Merkle tree production behavior root; 11. Audit challenge + random number; 12. Request signature; 13. Signature data; 14. Merge authentication report; 15. Request specific proof; 16. Merkle path proof.

[0025] A lightweight, endogenous proof method for verifying the behavior of AI models via TEE includes the following specific steps: S1 to S4 represent the first stage of system initialization and deployment steps of this invention. The purpose of this stage is to deploy core functional modules in the TEE environment, complete the encrypted transmission of models and data, and establish a trusted foundation through remote authentication to ensure that the execution environment is authentic, trustworthy, and the code is complete.

[0026] S1. The device is deployed in a hardware environment supporting TEE technology, including TEE architectures such as Intel SGX, AMD SEV, or ARM TrustZone. Internally, the device comprises four core modules: a policy loading and parsing module, responsible for reading and verifying behavior monitoring policies; an endogenous behavior probe module, which embeds monitoring logic within the AI ​​model; a Merkle tree processing module, responsible for cryptographic compression of behavior records; and a proof generation module, used to generate a fusion authentication report. The verifier environment is deployed on the regulatory side, including a remote authentication verification module for verifying the authenticity of the TEE environment, and a behavior auditing module for compliance checks on model behavior. Communication between the TEE device and the verifier is conducted via a two-way authenticated TLS 1.3 secure channel, ensuring the confidentiality and integrity of the transmission process.

[0027] S2: The model provider encrypts its proprietary AI model using the standard AES-256-GCM algorithm, with a randomly generated 256-bit key K_model. This key K_model is further encrypted using the TEE device's asymmetric public key PK_tee (using RSA-2048 or ECC-256 algorithms), forming a double layer of protection. The behavior monitoring policy file is defined in JSON format and includes the following key fields: the monitored_layers array specifies the names of the model layers to be monitored; the feature_indices array defines the range of feature indices to be monitored; the attribute_algorithm field specifies the type of attribution algorithm used (such as integrated_gradients, shap, or gradient_saliency); the threshold field sets the contribution threshold; and the sampling_rate field defines the monitoring sampling rate. The policy file is digitally signed using the model provider's ECC-256 private key, with the signing algorithm being ECDSA with SHA-256.

[0028] S3: The data holder uses the public key PK_tee of the TEE device to encrypt its sensitive data. The encryption process employs a hybrid encryption scheme: first, a random 256-bit symmetric key K_data is generated; then, the actual data is encrypted using AES-256-GCM; and finally, K_data is encrypted using PK_tee. The encrypted data and key are transmitted via a secure channel to the computing service provider's secure storage system. The secure storage system uses an encrypted distributed file system, and all stored data is encrypted using AES-256. Access control is based on roles and attributes to ensure that only authorized TEE instances can access the corresponding data.

[0029] S4: The verifier initiates a remote authentication request, sending an authentication challenge containing a random number (Nonce_auth) to the TEE device. Upon receiving the request, the TEE device collects authentication measurements of the current environment, including: the Enclave's MRENCLAVE value (code hash), MRSIGNER value (developer signature), ATTRIBUTES value (environment attributes), and user-defined data (containing the device's public key PK_tee). This data is signed using the TEE hardware's endorsement key (such as Intel SGX's QE endorsement key) to generate a standard authentication report. After the report is returned to the verifier, the verifier verifies it through the following steps: first, verifying the authenticity of the endorsement key using the CPU manufacturer's root certificate chain; then, verifying whether the measurements match expectations; and finally, confirming that the PK_tee in the user-defined data matches expectations.

[0030] S5 to S7 are the second stage of the data loading and policy verification steps of the present invention. The purpose of this stage is to securely decrypt the model, data and policy files in the TEE device, verify the validity of the policy signature, and register monitoring hooks in the specified layer of the AI ​​model to prepare for behavior monitoring.

[0031] S5: The TEE device retrieves encrypted model, data, and policy files from the secure storage system. First, it decrypts the symmetric keys K_model and K_data using the device's private key SK_tee, employing an appropriate asymmetric decryption algorithm (such as RSA-OAEP or ECC). Then, it uses the decrypted symmetric key to decrypt the actual model and data files using the AES-256-GCM algorithm. The decrypted plaintext data exists only in the TEE's secure memory area (Enclave memory) and is not swapped to insecure memory or storage devices.

[0032] S6: The policy loading and parsing module first verifies the digital signature of the policy file. Using the model provider's ECC public key and ECDSA verification algorithm, it confirms the integrity and authenticity of the policy file's origin. After successful verification, the module parses the JSON-formatted policy content to extract specific monitoring parameters. The parsing process includes: verifying whether each layer name in `monitored_layers` actually exists in the AI ​​model; checking the validity of the range of `feature_indices`; confirming that the algorithm specified by `attribution_algorithm` has been implemented; verifying that `threshold` is a reasonable floating-point number; and ensuring that `sampling_rate` is between 0 and 1. All parsed parameters are stored in a secure configuration structure within the TEE.

[0033] S7: The endogenous behavior probe module registers forward propagation hooks at specified layers of the AI ​​model based on the parsed policy configuration. The specific implementation relies on the hook mechanism of the deep learning framework: `register_forward_hook` in PyTorch, and `tf.custom_gradient` or inter-layer interceptors in TensorFlow. Hook functions are configured to be automatically triggered when the model's forward propagation reaches the target layer. Each hook function contains the following logic: checking if detailed monitoring is needed (based on the sampling rate); capturing the input and output tensors of the layer; recording the tensor's metadata (shape, data type); and preparing to call the attribution algorithm to calculate feature contributions.

[0034] S8 to S10 represent the third stage of the present invention: model inference and behavior monitoring. The purpose of this stage is to trigger monitoring hooks when performing AI model inference, capture intermediate activation values, calculate feature contribution, and generate detailed behavior records stored in secure memory.

[0035] S8: The TEE device begins executing AI model inference. Input data propagates forward within the model, sequentially passing through each layer according to the network architecture. When computation reaches a layer with registered monitoring hooks, the deep learning framework automatically triggers the corresponding hook function. The triggering timing can be selected before layer computation (pre-hook) or after computation (post-hook), depending on monitoring requirements. The execution environment of each hook function is within the same security context as model inference, ensuring direct access to the layer's internal state and intermediate results.

[0036] S9: The endogenous behavior probe captures intermediate activation values ​​of the model in the hook function. Specifically, it captures the input tensor, output tensor, weight parameters, and gradient information (if available) of the current layer. Based on the attribution algorithm configured by the policy, it calculates the contribution score of the specified feature. Taking the integral gradient method as an example, the calculation process includes: selecting a baseline input (such as a zero vector or random noise); generating several path points through linear interpolation between the baseline input and the true input; calculating the gradient of the model output relative to the target feature at each path point; and integrating these gradients to obtain the final contribution score. The calculation process is completed internally within the TEE, ensuring that intermediate results are not leaked.

[0037] S10: Encapsulate the monitoring results of each sample into a structured behavior record. The record format uses ProtocolBuffers and includes the following fields: request_id (unique request identifier, using UUIDv4); timestamp (high-precision timestamp, from the TEE secure clock); layer_name (the name of the layer that triggered the monitoring); feature_indices (a list of monitored feature indices); contribution_scores (an array of contribution scores for each feature); and threshold_violation (marks whether the threshold has been exceeded). After serialization, the record is written to a secure memory area of ​​the TEE. This memory area is protected by copy-on-write and memory encryption to prevent sensitive information from being leaked through memory snapshots.

[0038] S11 to S13 is the fourth stage of the behavior digest generation step of the present invention. The purpose of this stage is to periodically construct behavior records into Merkle trees, generate cryptographic behavior digests, and efficiently manage the integrity proof of behavior data through an incremental update mechanism.

[0039] S11: The Merkle tree processing module periodically (e.g., every 100 inferences or every 5 seconds) reads accumulated behavior records from a secure memory area. Each record is normalized and serialized to ensure consistent field order and encoding. Then, the SHA-256 hash value of each record is calculated, serving as a leaf node in the Merkle tree. The hash calculation uses a cryptographic library within the TEE to prevent side-channel attacks. The mapping between each leaf node hash and the original record is stored in a secure index structure, supporting subsequent proof generation.

[0040] S12: The Merkle tree processing module uses an efficient incremental construction algorithm to organize the leaf node hash values ​​into a complete Merkle tree. The construction process adopts a standard binary tree structure: leaf nodes form the bottom layer, and the hashes of every two adjacent nodes are concatenated and hashed again to form the parent node, recursively until the root node. For performance optimization, a sparse Merkle tree variant is used, employing Merkle Mountain Ranges or Verkle tree structures to reduce the computational overhead during large-scale updates. The final calculated root hash value serves as the behavior summary for the current time period.

[0041] S13: When the number of behavior records reaches a predetermined threshold (e.g., 1000 records) or a specific time interval (e.g., 1 hour) has elapsed, the Merkle tree processing module generates the final behavior digest root hash and updates its internal state. The update process includes: associating the current root hash with a time range for storage; initializing a new Merkle tree instance for subsequent records; and safely cleaning up old behavior records. The cleanup process ensures that records already included in the Merkle tree are safely erased to prevent memory leaks, while retaining necessary metadata to support historical auditing.

[0042] S14 to S16 are the fifth stage of the fusion certification report generation steps of the present invention. The purpose of this stage is to respond to the verifier audit challenge, collect the environmental state and behavior summary, generate the fusion certification report by TEE hardware signature, and prove the compliance of runtime behavior.

[0043] S14: The verifier initiates an audit challenge to the TEE device. The challenge request includes a random number, Nonce_audit (at least 128 bits of randomness), to prevent replay attacks. Challenges can be initiated in two ways: periodic proactive challenges, where the verifier requests authentication at fixed time intervals; and event-triggered challenges, initiated when suspicious activity is detected or specific verification is required. The TEE device's proof generation module receives the challenge request and verifies its legitimacy, including checking the Nonce format and the identity of the request source.

[0044] S15: The proof generation module collects current state information to generate a report. The collected data includes: standard TEE certification measurements (MRENCLAVE, MRSIGNER, etc.); the latest behavior digest root hash (the root of the current Merkle tree); the Nonce_audit provided by the verifier; and optional timestamps and sequence numbers. This data is serialized according to a fixed structure to ensure a consistent report format each time. The serialized data serves as a message to be signed, ready for hardware signing.

[0045] S16: The proof generation module requests the TEE hardware to digitally sign the message to be signed using the endorsement key. The signing process is completed internally within the hardware security module, and the private key never leaves the security boundary. The generated fusion authentication report includes the following parts: hardware signature data (a signature containing all state information); plaintext state information (for verifier verification); and a certificate chain (optional, proving the validity of the endorsement key). The report is returned to the verifier via a secure channel, maintaining encryption and integrity protection during transmission.

[0046] S17 to S19 constitute the sixth stage of the audit verification process of this invention. The purpose of this stage is for the verifier to verify the authenticity of the report signature, assess overall compliance through behavioral summaries, and support in-depth audits of specific behaviors based on Merkle proofs.

[0047] S17: After receiving the fusion authentication report, the verifier first verifies the validity of the hardware signature. The verification process includes: verifying the endorsement key certificate chain using the CPU vendor's root certificate; verifying the integrity and authenticity of the signature data using the public key of the endorsement key; and checking the consistency of Nonce_audit with the data at the time the challenge was initiated. After the signature verification is successful, the verifier confirms that the report comes from a genuine TEE environment and that its content has not been tampered with.

[0048] S18: The verifier extracts the root hash of the behavior summary from the report and uses it as proof of the integrity of all behavior records from the last authentication to the current moment. The verifier compares the received root hash with the expected value or compliance benchmark stored locally. Several strategies can be used for comparison: exact match, requiring the root hash to be completely consistent with the expectation; range verification, allowing multiple valid root hashes within a certain time window; incremental verification, verifying the continuity of the current state based on historical root hashes. The overall behavior compliance is determined by the comparison results.

[0049] S19: When a deep audit of a specific reasoning behavior is required, the verifier can request a Merkle proof from the TEE device for a specific request identifier. The request includes the target request_id and a new random number Nonce_proof. The TEE device looks up the corresponding behavior record based on the request_id and generates a path proof for that record in the Merkle tree. The path proof contains the hashes of all sibling nodes from the leaf node to the root node. The verifier uses this proof to verify the authenticity of the record: starting from the leaf node hash, the parent node hashes are calculated layer by layer, and finally compared with the certified root hash. Successful verification confirms the authenticity and integrity of the specific behavior record.

[0050] S20 to S21 are the seventh stage of the extended function steps of the present invention. The purpose of this stage is to realize the adaptive sampling strategy to dynamically balance the monitoring overhead and to establish an intelligent alarm mechanism to respond to and notify abnormal behavior in a graded manner.

[0051] S20: The TEE device supports multiple sampling strategies, dynamically adjusting the monitoring intensity based on runtime conditions. Rule-based sampling: automatically increases the sampling rate when abnormal patterns or high-risk operations are detected; random sampling: determines whether to perform detailed monitoring based on a pseudo-random number generator with a fixed probability; adaptive sampling: dynamically adjusts the sampling rate based on system load, the degree of behavioral abnormality, and historical patterns. The parameters of the sampling strategy can be updated at runtime through secure configuration without restarting the TEE environment.

[0052] S21: The device supports a multi-level behavioral alarm mechanism. When the feature contribution consistently exceeds a threshold or an abnormal behavior pattern is detected, the system generates tiered security events: low-level alarms are logged but not immediately notified; medium-level alarms are asynchronously notified to relevant parties via a secure channel; high-level alarms immediately block suspicious operations and trigger an emergency response. Alarm information can be selectively incorporated into the behavioral summary or reported directly to regulators via a dedicated secure channel. The alarm strategy supports machine learning-driven anomaly detection, continuously improving identification accuracy.

[0053] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A lightweight, endogenous proof method for TEE (Technical Explanation Engine) aimed at verifying the behavior of AI models, characterized in that, Includes the following steps: S1. In a TEE device supporting TEE technology, a policy loading and parsing module, an endogenous behavior probe module, a Merkle tree processing module, and a proof generation module are set up. The policy loading and parsing module is responsible for reading and verifying the behavior monitoring policy; the endogenous behavior probe module is used to capture the activation values ​​of the intermediate layers of the model in real time and calculate the feature contribution, realizing the embedding of monitoring logic inside the AI ​​model; the Merkle tree processing module is responsible for the cryptographic compression of behavior records; and the proof generation module is used to generate a fusion authentication report. In the verifier environment, a remote authentication verification module and a behavior audit module are set up. The remote authentication verification module is used to verify the authenticity of the TEE environment; the behavior audit module is used to perform compliance checks on the model behavior. S2. The model provider uses the standard AES-256-GCM algorithm to encrypt its proprietary AI model. The encryption key is a randomly generated 256-bit key K_model. This key K_model is then encrypted again using the asymmetric public key PK_tee of the TEE device. S3. The data holder uses the public key PK_tee of the TEE device to encrypt its sensitive data; the encrypted data and key are transmitted to the secure storage system of the computing service provider through a secure channel; S4. The verifier initiates a remote authentication request, sending an authentication challenge containing a random number Nonce_auth to the TEE device; Upon receiving a request, the TEE device collects authentication measurements of the current environment, including: the Enclave's MRENCLAVE value, MRSIGNER value, ATTRIBUTES value, and user-defined data; these data are signed using the TEE hardware's endorsement key to generate a standard authentication report. The S5.TEE device retrieves encrypted models, data, and policy files from the secure storage system and decrypts them; The policy loading and parsing module in the S6.TEE device first verifies the digital signature of the policy file; it then uses the ECC public key and ECDSA verification algorithm provided by the model provider to confirm the integrity and authenticity of the policy file. After verification, the policy loading and parsing module parses the policy content in JSON format and extracts the specific monitoring parameters. The endogenous behavior probe module in the S7.TEE device registers forward propagation hooks at a specified layer of the AI ​​model according to the parsed policy configuration. The S8.TEE device performs AI model inference; the input data propagates forward in the model, passing through each layer of the network architecture in sequence. When the computation reaches a layer that has registered monitoring hooks, the deep learning framework automatically triggers the corresponding hook function. S9. The endogenous behavior probe captures the intermediate activation values ​​of the model in the hook function and calculates the contribution score of the specified feature according to the attribution algorithm configured by the policy. S10. Encapsulate the monitoring results of each sample into a structured behavior record; the record format uses ProtocolBuffers and includes the following fields: request_id (unique request identifier); timestamp (high-precision timestamp); layer_name (name of the layer that triggered the monitoring); feature_indices (list of monitored feature indices); contribution_scores (array of contribution scores for each feature); and threshold_violation (mark whether the threshold has been exceeded). S11. The Merkle tree processing module periodically reads accumulated behavior records from the secure memory area, performs normalized serialization on each record to ensure that the field order and encoding are consistent, and then calculates the SHA-256 hash value of each record as the leaf node of the Merkle tree; S12. The Merkle tree processing module uses an incremental construction algorithm to organize the leaf node hash values ​​into a complete Merkle tree, and the final calculated root hash value serves as the behavior summary for the current time period. S13. When the number of behavior records reaches a predetermined threshold or a specific time interval has elapsed, the Merkle tree processing module generates the final behavior summary root hash and updates the internal state; S14. The verifier initiates an audit challenge to the TEE device. The proof generation module of the TEE device receives the challenge request and verifies the legality of the request. S15. The proof generation module of the TEE device collects current state information to generate a report. The collected data includes: standard TEE certification measurement values, the latest behavior digest root hash, the Nonce_audit provided by the verifier, and optional timestamps and serial numbers. These data are serialized according to a fixed structure, and the serialized data is used as a message to be signed, ready for hardware signing. S16. The proof generation module of the TEE device requests the TEE hardware to digitally sign the message to be signed using the endorsement key and generate a fusion authentication report; the generated fusion authentication report is returned to the verifier through a secure channel. S17. After receiving the fusion certification report, the verifier first verifies the validity of the hardware signature. After the signature verification is passed, the verifier confirms that the report comes from a real TEE environment and that the content has not been tampered with. S18. The verifier extracts the root hash of the behavior summary from the report and uses it as proof of the integrity of all behavior records from the last authentication to the current moment; the verifier compares the received root hash with the expected value or compliance benchmark stored locally; and judges the overall behavior compliance based on the comparison results.

2. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S3, when the data holder uses the public key PK_tee of the TEE device to encrypt its sensitive data, the encryption process adopts a hybrid encryption scheme: first, a random 256-bit symmetric key K_data is generated, the actual data is encrypted using the standard AES-256-GCM algorithm, and then K_data is encrypted using the asymmetric public key PK_tee of the TEE device.

3. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S3, the secure storage system uses an encrypted distributed file system, all stored data is encrypted using AES-256, and access control is based on roles and attributes to ensure that only authorized TEE instances can access the corresponding data.

4. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S5, the symmetric keys K_model and K_data are first decrypted using the private key SK_tee of the TEE device. The decryption process uses the corresponding asymmetric decryption algorithm. Then, the actual model file and data file are decrypted using the AES-256-GCM algorithm with the decrypted symmetric key.

5. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S6, the parsing process includes: verifying whether each layer name in monitored_layers actually exists in the AI ​​model; checking whether the range of feature_indices is valid; confirming that the algorithm specified by attribute_algorithm has been implemented; verifying that threshold is a reasonable floating-point number; and ensuring that sampling_rate is between 0 and 1.

6. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S7, the implementation of registering forward propagation hooks relies on the hook mechanism of the deep learning framework: register_forward_hook is used in PyTorch, and tf.custom_gradient or inter-layer interceptors are used in TensorFlow. The hook functions are configured to be automatically triggered when the model forward propagates to the target layer. Each hook function contains the following logic: checking whether detailed monitoring is needed; capturing the input and output tensors of the layer; and recording the metadata of the tensors. Prepare to call the attribution algorithm to calculate the feature contribution.

7. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S9, the specific data captured includes: the input tensor, output tensor, weight parameters, and gradient information of the current layer.

8. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S12, the construction process adopts a standard binary tree structure: leaf nodes form the bottom layer, and every two adjacent nodes are hashed and concatenated to form a parent node, and the process is recursively repeated until the root node is reached; for performance optimization, a sparse Merkle tree variant is used, employing Merkle mountain or Verkle tree structures.

9. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, In step S13, the update process includes: storing the current root hash associated with a time range; initializing a new Merkle tree instance for subsequent recording; safely cleaning up old behavior records; the cleaning process ensures that records already included in the Merkle tree are safely erased to prevent memory leaks, while retaining necessary metadata to support historical auditing.

10. The TEE-based lightweight proof method for verifying the behavior of AI models according to claim 1, characterized in that, It also includes step S19, where when a deep audit of a specific reasoning behavior is required, the verifier can request a Merkle proof from the TEE device for a specific request identifier. The request includes the target request_id and a new random number Nonce_proof. The TEE device finds the corresponding behavior record based on the request_id and generates a path proof of the record in the Merkle tree. The path proof includes the hash values ​​of all sibling nodes from the leaf node to the root node. The verifier uses this proof to verify the authenticity of the record: starting from the leaf node hash, the parent node hash is calculated layer by layer, and finally compared with the certified root hash. If the verification is successful, the authenticity and completeness of the corresponding behavior record found based on the request_id are confirmed.

Images