Parameter-level vulnerability testing method for edge deployment depth model

Abstract

The edge deployment depth model-oriented parameter-level vulnerability test method provided by the invention comprises the following steps: performing structure analysis on a depth model to be detected to obtain a parameter set, extracting parameter features, determining quantitative participation of the parameter set based on quantification and compression rules, and screening out a risk parameter subset; defining an index mapping relationship of the risk parameter subsets, embedding difference perturbation among parameters, obtaining an original index mapping table, and verifying the embedded difference perturbation in a reasoning process to identify vulnerabilities of the depth model; configuring a quantitative simulation environment to carry out quantitative simulation, extracting difference disturbance from the risk parameter subset after quantitative simulation, and respectively calculating a disturbance recovery rate and a detection trigger rate; and a vulnerability risk score is calculated according to the disturbance recovery rate and the detection trigger rate, and a parameter-level vulnerability test report is generated, so that active detection, quantitative evaluation and risk report generation of potential vulnerabilities of the deep model are realized, and credible and safe deployment of the deep model in edge equipment is guaranteed.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, specifically relating to a parameter-level vulnerability testing method for edge-deployed deep models. Background Technology

[0002] With the rapid development of deep learning technology, pre-trained models are widely used in fields such as image recognition, speech recognition, and natural language processing. To achieve efficient deployment in resource-constrained environments, the industry generally adopts a development model based on the model supply chain. This involves obtaining third-party pre-trained models from open-source platforms, then fine-tuning, compressing, and deploying them at the edge. However, while this chain-like "pre-training—sharing—deployment" model brings development convenience, it also introduces new security risks. Since model files typically contain millions to hundreds of millions of floating-point parameters, attackers may exploit the redundancy of this parameter space to embed hidden data or malicious payloads into the model, leading to risks such as model supply chain contamination, backdoor injection, or information leakage.

[0003] Existing model security detection primarily focuses on input / output behavior analysis or backdoor trigger sample detection, which struggles to effectively identify anomalies at the model parameter level. For example, patent CN117648952A discloses a method and system for optimizing model deployment at the edge based on vector interpolation. The method includes: quantizing a YOLOv5 model, converting a 32-bit floating-point number to a low-width integer; executing the quantized model to obtain the matrix data of the quantized inference data and the original framework model; performing vector interpolation on the quantized data to identify operators whose precision errors exceed a set threshold; optimizing the model for the identified operators; re-quantizing the optimized model; and deploying the model to an edge device when the error introduced by the re-quantized model is within a set range. By constructing specific interpolation mappings or modifying the least significant bits of model parameters, additional information can be hidden without affecting the model's predictive performance. However, such parameter-level vulnerabilities are difficult to detect during routine functional verification and may remain recoverable during the compression and quantization processes of edge deployment, thus posing a potential threat to the security of deep learning model systems.

[0004] On the other hand, edge deployment environments are typically limited by computing power, storage, and bandwidth. Models require lightweight processing such as quantization, pruning, and distillation before deployment. These operations alter the distribution of model parameters, rendering traditional detection methods based on global statistics or gradient features ineffective or reducing their sensitivity. Furthermore, deployment toolchains, such as TensorRT, support low-precision computation, significantly reducing memory usage and improving inference speed while maintaining high accuracy. However, it can only run on NVIDIA GPUs, and debugging is difficult when optimization errors occur or accuracy degrades, with unintuitive error messages. ONNXRuntime is built around standardized model formats, graph optimization engines, and pluggable execution providers, solving multi-platform project issues and achieving model interoperability, but suffers from fragmented documentation, difficulties in converting certain model architectures, and complex initial setup. TensorFlowLite integrates well on Android and is well-optimized, performing excellently on target Android devices and when hardware acceleration is required, but converting complex models is difficult, iOS deployment is poor, and error messages are obscure. Therefore, these deployment toolchains may readjust parameter arrangements and numerical precision during model export and optimization, further increasing the complexity of potential vulnerability detection.

[0005] Therefore, there is an urgent need for a parameter-level vulnerability testing method for edge deployment scenarios, which can perform fine-grained analysis of the parameter space of the model before deployment, simulate potential risks by constructing differential perturbation test cases, and evaluate the security and robustness of the model under a quantitative simulation process. This will enable proactive detection, quantitative assessment and risk report generation of potential vulnerabilities in deep learning models, and ensure the trustworthy and secure deployment of deep learning models in edge devices. Summary of the Invention

[0006] To overcome the difficulty in discovering and quantifying hidden anomalies in deep learning models at the parameter level and their residual risks in edge deployment links in existing technologies, this invention provides a parameter-level vulnerability testing method for edge-deployed deep models. By performing feature analysis on the parameters of the deep model, constructing interpolation perturbation test cases, and conducting detection and evaluation through deployment link simulation, it outputs reproducible detection evidence and risk reports to detect potential security vulnerabilities of deep models during edge deployment.

[0007] To achieve the above-mentioned objectives, this invention provides a parameter-level vulnerability testing method for edge-deployed deep models, comprising the following steps: The deep model to be detected is structurally analyzed to obtain a parameter set. Parameter features are extracted from the parameter set. The quantization participation of the parameter set is analyzed in conjunction with the quantization and compression rules of the target edge deployment platform. A subset of risk parameters is selected based on the parameter features and the quantization participation of the parameter set. Define the index mapping relationship of the risk parameter subset to determine the embedding relationship between parameters in the risk parameter subset. Based on the output of the index mapping, embed the difference perturbation between parameters and obtain the original index mapping table. Then, verify the embedded difference perturbation during the inference process of the deep model to identify the vulnerabilities of the deep model. Configure a quantitative simulation environment to perform quantitative simulation of the deep model, extract the difference perturbation from the risk parameter subset after quantitative simulation, calculate the perturbation recovery rate based on the difference perturbation before and after quantization, and then verify whether the difference perturbation after quantitative simulation can be successfully triggered and calculate the detection trigger rate. Vulnerability risk scores are calculated based on disturbance recovery rate and detection trigger rate, and parameter-level vulnerability test reports are generated.

[0008] In one embodiment, the parameter set includes: a weight matrix, a bias vector, normalized layer parameters, and a sliding statistic.

[0009] In one embodiment, the extracted parameter features include: data type, numerical range, distribution pattern, and hierarchical position.

[0010] In one embodiment, the analysis of the quantization participation of the parameter set based on the quantization and compression rules of the target edge deployment platform includes: whether each parameter in the parameter set based on the quantization and compression rules of the target edge deployment platform participates in the multiplication and integer quantization process during the inference process of the deep model, so as to determine the quantization participation of each parameter.

[0011] In one embodiment, a subset of risk parameters is selected based on parameter characteristics and the quantization participation of the parameter set, including: selecting a subset of risk parameters that were not quantized to integers during the quantization process but have high precision retention characteristics, wherein the high precision retention characteristics refer to the characteristic of being retained as a 32-bit floating-point number format.

[0012] Furthermore, the subset of risk parameters includes: bias vector, normalized layer parameters, and sliding statistics.

[0013] In one embodiment, defining the index mapping relationship of the risk parameter subset includes: using the selected risk parameter subset as a parameter sequence, dividing the parameter sequence into multiple groups, each group having a length of [missing information]. A difference embedding mapping function is constructed to map each group to a unique integer index in order to define the index mapping relationship.

[0014] In one embodiment, embedding interpolation perturbations between parameters based on the output of the index mapping includes: Define the parameter difference as By adjusting the sign and amplitude of the difference, the difference disturbance is made to satisfy: ;in, Indicates the first One parameter, Indicates the first One parameter, For parameter index, For parameter differences, For parameter difference index, The difference between the target parameters. The perturbation step size is used to determine the strength of the inter-parameter perturbation embedded between constraints. Based on the difference perturbation constraint, the embedding process is combined with a key strategy to plan the order of embedding difference perturbations. Specifically, this includes: defining a key sequence, determining a pseudo-random mapping function based on the key sequence to change the embedding position of the difference perturbation, determining the order of embedding the difference perturbation, and realizing the embedding of difference perturbations between parameters.

[0015] In one embodiment, the original index mapping table includes: the embedding location of the difference perturbation, the target difference perturbation to be embedded, and metadata containing the group number and key sequence of the embedded difference perturbation.

[0016] In one embodiment, when embedding difference perturbations between parameters, it is also necessary to set upper limit constraints and detection constraints for difference perturbations, which are used to ensure the stability of the deep model and the detectability and triggerability of difference perturbations under quantization simulation, respectively. The upper limit constraint for the difference disturbance is expressed as follows: , The standard deviation of the parameter distribution. For the safety factor; the construction of detection constraints includes: determining the theoretical embedding capacity based on the number of parameters in the risk parameter subset and the length of each group, and introducing embedding sparsity on the basis of the theoretical embedding capacity to determine the actual embedding capacity, which is used to prevent the embedding signal from being weakened during the quantization or compression process of the deep model, thus completing the construction of detection constraints.

[0017] Furthermore, The value is 10 -9 ~10 -7 The embedding sparsity is 0.3 to ensure that the embedding of the interpolation perturbation does not affect the stability of the deep model; the embedding sparsity is less than or equal to 0.3 to balance the embedding strength of the interpolation perturbation with the robustness of the deep model.

[0018] In one embodiment, verifying the embedding interpolation perturbation during the inference process of a deep model includes: A detection function is introduced during the quantization inference process of the deep model to extract the difference perturbation during deep model inference. The extracted difference perturbation is then verified to be consistent with the pre-embedded difference perturbation. If the verification is consistent, it confirms that there is a vulnerability in the area where the risk parameter is located, and that it can be triggered and exploited in a real operating environment.

[0019] In one embodiment, extracting the difference perturbation from the subset of risk parameters after quantization simulation, and calculating the perturbation recovery rate based on the difference perturbation before and after quantization, includes: Based on the index mapping relationship and the original index mapping table, the difference perturbation is extracted from the parameter subset after quantization simulation according to the parameter extraction function, and the quantized difference perturbation sequence is recovered by the following formula: In the formula, To recover the difference perturbation sequence, For the first quantization simulation One parameter, For the first quantization simulation One parameter; Establish error constraints This is used to determine whether the difference disturbance after quantization simulation can be recovered. If it can be recovered, it indicates that there is a vulnerability in the deployment link of the parameter subset in the deep model. Based on the error constraint, the number of residual difference perturbations within the error constraint is counted according to the difference perturbation before and after quantization, in order to calculate the perturbation recovery rate: This is used to quantitatively assess the residual state of a vulnerability after quantitative simulation, where... The number of difference perturbations to satisfy the error constraint, This represents the total number of difference disturbances.

[0020] In one embodiment, verifying whether the difference perturbation after quantization simulation can be successfully triggered and calculating the detection trigger rate includes: Based on the deep model after quantization simulation, a detection function is introduced into the inference function and test data is input to check whether the output signature corresponding to the input test data is consistent with the pre-embedded difference perturbation. If they are consistent, it indicates that the difference perturbation after quantization simulation can be successfully triggered; otherwise, the triggering fails. The detection trigger rate is calculated using the following formula to quantify the exploitability of a vulnerability: In the formula, Indicates the number of times it was successfully triggered. This represents the total number of times.

[0021] In one embodiment, the vulnerability risk score is calculated using the following formula: , In the formula, and Disturbance recovery rate and detection trigger rate Weighting coefficients; when If the value exceeds a preset threshold, the deep learning model is deemed to have a parameter-level vulnerability risk, and a parameter-level vulnerability test report is generated; otherwise, the deep learning model is deemed to be secure and controllable under the quantization and deployment chain.

[0022] In one embodiment, a parameter-level vulnerability test report includes the following: risk parameter index, index embedding table, quantified simulation parameters and runtime configuration, statistics on disturbance recovery rate and detection trigger rate, and risk level.

[0023] Compared with the prior art, the beneficial effects of the present invention include at least the following: This invention provides a method and apparatus for generating fine-grained semantic descriptions from motion video data. Based on isolated word sign language recognition datasets and continuous sign language recognition datasets containing word target annotations, a training dataset is established to obtain motion video data and motion description text data for fine-grained semantic description modeling. Through a training architecture comprising an motion video feature encoding module, a multimodal feature fusion module, and a text feature encoding module, combined with user prompts and system prompts and introducing a mask reconstruction mechanism, a pre-trained generation model for fine-grained semantic motion description style is obtained. This model is then fine-tuned using motion video data and a loss function is established to obtain a fine-grained semantic motion description generation model. This model is used to generate high-quality fine-grained semantic motion description data, alleviating the current problem of insufficient fine-grained semantic motion description data. It ensures the stability and accuracy of the generated results when processing highly dynamic and complex scenarios such as sign language videos and interactive actions. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0025] Figure 1 This is a flowchart illustrating the parameter-level vulnerability testing method for edge-deployed deep models provided by the present invention.

[0026] Figure 2 This is a schematic diagram illustrating the principle of the parameter-level vulnerability testing method for edge-deployed deep models provided by the present invention.

[0027] Figure 3 This is a flowchart of parameter-level vulnerability testing when ResNet-18, an image classification model, is selected as the target depth model in the embodiment. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and given in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0029] The inventive concept of this invention is as follows: In order to overcome the problem that it is difficult to discover and quantify the hidden anomalies of deep learning models at the parameter level and the residual risks in the edge deployment link in the prior art, this invention provides a parameter-level vulnerability testing method for edge-deployed deep models. By performing feature analysis on the parameters of the deep model, constructing interpolation perturbation test cases, and detecting and evaluating the deployment link simulation, this invention outputs reproducible detection evidence and risk reports to detect potential security vulnerabilities of deep models in the edge deployment process.

[0030] Based on this, such as Figure 1 and Figure 2 As shown, the present invention provides a parameter-level vulnerability testing method for edge-deployed deep models, comprising the following steps: S1. Perform structural analysis on the deep model to be detected to obtain a parameter set. Extract parameter features from the parameter set, and analyze the quantization participation of the parameter set in conjunction with the quantization and compression rules of the target edge deployment platform. Based on the parameter features and the quantization participation of the parameter set, select a subset of risk parameters. Details are as follows: S1-1 Model Parameter Analysis: This step involves structural analysis of the deep model to be detected, extracting the deep model structure and parameter information for each layer. Weight matrices, bias vectors, normalized layer parameters (scaling factors, translations), and moving statistics (running mean, variance) are read from the deep model file to form a complete parameter set for subsequent analysis.

[0031] S1-2 Parameter Feature Extraction: For each type of parameter in the parsed parameter set, basic feature information is extracted, including data type, numerical range, distribution pattern, and hierarchical position. By analyzing this parameter feature information, the types of parameters in the model that exhibit drastic numerical changes, are quantitatively sensitive, or remain stable over a long period can be preliminarily distinguished. The extracted results are summarized into a parameter feature table to support subsequent risk identification.

[0032] S1-3 Quantization Participation Analysis: Combining the quantization and compression rules of the target edge deployment platform, determine whether each parameter participates in multiplication operations and integer quantization processes during inference.

[0033] Taking typical symmetric integer quantization as an example, its parameter mapping relationship is as follows: , In the formula, For parameter mapping relationships of symmetric integer quantization, These are the original floating-point parameters. As a quantitative scaling factor, This is an approximate value after dequantization.

[0034] In actual deployments, the weight matrix parameters of convolutional and fully connected layers in deep models typically participate in the symmetric integer quantization process, while the bias vector, normalized layer parameters, and sliding statistics are often retained in floating-point format. The quantization participation of parameters is marked based on these differences.

[0035] S1-4 Risk Area Identification: Based on the characteristic information and quantization participation of the parameters, a set of parameters that were not quantized to integers during the quantization process but have high precision retention characteristics are selected and defined as the risk parameter subset. The risk parameter subset typically includes: bias vector, normalization layer parameters, and sliding statistics. These risk subset parameters are more likely to retain the original numerical characteristics in quantization or compression links deployed at the edge and have the potential to carry hidden information.

[0036] S2. Define the index mapping relationship of the risk parameter subset to determine the embedding relationship between parameters in the risk parameter subset. Based on the output of the index mapping, embed interpolation perturbations between parameters and obtain the original index mapping table. Then, verify the embedded interpolation perturbations during the inference process of the deep model to identify vulnerabilities in the deep model. Specifically: S2-1 Index Mapping Relationship Establishment: To ensure the controllability and reproducibility of the embedded difference perturbation, a subset of risk parameters is first defined. The index mapping relationship is used to determine the embedding relationship between parameters in the risk parameter subset. Specifically: The selected subset of risk parameters is used as the parameter sequence. Divide the parameter sequence into A length of The group; Define the interpolation embedding mapping function: , of which each Groups are mapped to unique integer indices. This is used to determine the embedding correspondence between target parameter pairs.

[0037] For example, when Sometimes, there may be , , , This function guarantees that each set of parameters is uniquely mapped and the order is traceable, which facilitates subsequent embedding and extraction of difference perturbations.

[0038] S2-2 Difference Perturbation Embedding: Based on the mapping function The output results, in adjacent parameter pairs A controlled difference disturbance is applied between them. Specifically: Define the parameter difference as By adjusting the sign and amplitude of the difference, the difference disturbance is made to satisfy: ;in, Indicates the first One parameter, Indicates the first One parameter, For parameter index, For parameter differences, For parameter difference index, The difference between the target parameters. The perturbation step size is used to constrain the strength of the embedded interpolation perturbations between parameters. This process enables fine-grained perturbation embedding of deep model parameters, that is, introducing controllable interpolation patterns into the numerical space without affecting the overall functional performance of the deep model.

[0039] S2-3 Dynamic Embedding Strategy and Robustness Constraints: To enhance the randomness of perturbation embedding and the reliability of detection, dynamic key-driven embedding order planning is adopted during the embedding process.

[0040] Let the key sequence be , For the first One key, If the total number of keys is [value], then the embedding order is determined by a pseudo-random mapping function: , It is a pseudo-random mapping function. For parameter blocks, For the disturbance difference, This is the perturbation scheduling function.

[0041] The embedding position is dynamically changed according to the evolution of the key sequence to avoid static detection and improve the statistical concealment of the difference perturbation.

[0042] Simultaneously set a disturbance upper limit constraint: , The standard deviation of the parameter distribution. For safety reasons, The value is 10 -9 ~10-7 This is used to ensure that the embedding of the difference perturbation does not affect the stability of the deep model.

[0043] S2-4 Embedding Capacity and Detection Constraint Control: Determine the theoretical maximum embedding capacity based on the number of parameters in the risk parameter subset and the length of each group. ; To prevent the embedded signal from being weakened during quantization or compression of deep models, sparse embedding coefficients are introduced. Control the actual embedded capacity: General settings To balance the embedding strength of the difference perturbation with the robustness of the deep model, ensuring that the difference perturbation mode remains detectable and triggerable under quantization simulation.

[0044] S2-5 Test Case Model Generation: After completing the interpolation perturbation embedding, a detection function is introduced during the inference process of the deep model. It is used to extract difference perturbations during deep model inference and to verify the consistency between the extracted difference perturbations and the pre-embedded difference perturbations.

[0045] If the verification is consistent, it indicates that the perturbation pattern detected during the quantitative inference stage can still be fully recovered. This confirms that there is a vulnerability in the area where the risk parameter is located, and that it can be triggered and exploited in the real operating environment. This parameter area is recorded as the potential vulnerability location, and a test case model file is generated for subsequent quantitative simulation evaluation.

[0046] S3. Configure a quantization simulation environment to perform quantization simulation of the deep model. Extract the difference perturbation from the risk parameter subset after quantization simulation. Calculate the perturbation recovery rate based on the difference perturbation before and after quantization. Then verify whether the difference perturbation after quantization simulation can be successfully triggered and calculate the detection trigger rate. Details are as follows: S3-1 Quantization Simulation Environment Configuration: Based on the actual quantization strategy of the target deployment platform (such as TensorRT, TFLite, ONNXRuntime, etc.), establish a quantization simulation environment to perform integer quantization or mixed-precision quantization operations.

[0047] Let the original parameters be The quantization scale factor is S, and the offset is The typical symmetric integer quantization process is then represented as: .

[0048] By simulating the above process, the actual parameter transformation behavior of the deep learning model when deployed on edge devices can be simulated. A complete forward inference and dequantization restoration are performed on the test model to detect the degree of residual interpolation perturbation in the numerical space.

[0049] S3-2 Disturbance Recovery and Extraction Function Design: After completing the quantization simulation, the parameter extraction function is called. The perturbation patterns in the deep model are identified and reconstructed. Specifically: Extraction function Based on the index mapping relationship and the original index mapping table, from the parameter subset after quantization simulation Extract the difference perturbation and recover the quantized difference perturbation sequence using the following formula: In the formula, To recover the difference perturbation sequence, For the first quantization simulation One parameter, For the first quantization simulation One parameter; Error constraints were then established. This is used to determine whether the difference perturbation after quantization simulation can be recovered. If it can be recovered, it indicates that there is a residual vulnerability in the deployment chain of the deep model. Based on the error constraint, the number of residual difference perturbations within the error constraint is counted according to the difference perturbation before and after quantization, in order to calculate the perturbation recovery rate: This is used to quantitatively assess the residual state of a vulnerability after quantitative simulation, where... The number of difference perturbations to satisfy the error constraint, This represents the total number of difference disturbances.

[0050] S3-3 Trigger Detection and Stability Verification: To simulate potential attack scenarios, trigger detection operations are performed on a deep model of quantized simulation. Specifically, this includes: Based on the deep model obtained from quantization simulation, a detection function is introduced into the inference function. Input test data and calculate the output signature value. : , In the formula, This represents a hash function used to check whether the output signature corresponding to the input test data is consistent with the pre-embedded difference perturbation. If the output signature value... If the difference perturbation is consistent with the pre-embedded difference perturbation, it indicates that the difference perturbation after quantization simulation can be successfully triggered, thus determining that there is a recoverable parameter vulnerability in the deep model; otherwise, the triggering fails. The detection trigger rate is calculated using the following formula to quantify the exploitability of a vulnerability: In the formula, Indicates the number of times it was successfully triggered. For the total number of times, The higher the value, the stronger the exploitability of parameter-level vulnerabilities.

[0051] S4. Calculate the vulnerability risk score based on the disturbance recovery rate and detection trigger rate, and generate a parameter-level vulnerability test report.

[0052] Safety Assessment and Result Determination: The model's safety is assessed based on a comprehensive index of the calculated perturbation recovery rate and detection trigger rate. Specifically: Based on the calculated disturbance recovery rate and detection trigger rate, the vulnerability risk score is calculated using the following formula: , In the formula, and Disturbance recovery rate and detection trigger rate Weighting coefficients; when Greater than When the threshold is set, the deep learning model is deemed to have a parameter-level vulnerability risk, and a parameter-level vulnerability test report is generated; otherwise, the deep learning model is deemed to be secure and controllable under the quantization and deployment chain.

[0053] The parameter-level vulnerability test report includes the following: risk parameter index, index embedding table, quantified simulation parameters and running configuration, statistics on disturbance recovery rate and detection trigger rate, and risk level (low, medium, high).

[0054] Parameter-level vulnerability test report files can serve as input for deep model supply chain security audits or trusted deployment verification, supporting vulnerability risk tracing and comparative analysis before deep model release, thereby improving the security and trustworthiness of deep models in edge deployments.

[0055] To verify the effectiveness and feasibility of the method described in this invention, the publicly available image classification model ResNet-18 was selected as the target depth model. A quantization simulation environment was built on the edge deployment platform TensorRT INT8 to test the target depth model. Figure 3 The process shown is for parameter-level vulnerability testing. The specific steps are as follows: (1) Constructing and training a normal model: First, a standard ResNet-18 model is trained based on the ImageNet-1K public dataset.

[0056] The training parameters are set as follows: the optimizer is Adam, and the initial learning rate is... The batch size is 64, and the training epochs are 90. After training, a convergent model is obtained. Its Top-1 accuracy on the validation set is 70.2%, and its Top-5 accuracy is 89.7%.

[0057] The parameter set of the standard ResNet-18 model is defined as follows: ,in, Indicates the weights of the convolutional layer. Indicates the bias term. For batch normalization layer scaling and offset factors, For sliding statistics, For parameter index, The number of parameters.

[0058] (2) Parameter analysis and high-risk area identification: The converged model obtained after training The parameter file (state_dict) is parsed to extract the tensor dimension, numerical range, and data type of each layer. Simultaneously, the quantization rules of the edge deployment platform TensorRT INT8 are used to analyze the participation of each parameter in the inference chain: convolutional layer weights. Participating in integer quantization; bias term Batch normalization layer scaling and offset coefficients and sliding statistics Maintain FP32 accuracy.

[0059] Based on the aforementioned participation and floating-point retention indicators, a subset of risk parameters was selected. : , Statistics show that the risk parameter subset accounts for approximately 8.7% of the total number of parameters in the deep learning model, mainly concentrated in BatchNorm and the bias layer, which are potential carriers of parameter-level vulnerabilities.

[0060] (3) Construction of difference disturbance detection test cases subset of risk parameters By group length Perform the partitioning and define the difference mapping function: , , , sparsity coefficient The value is set to 0.25, meaning 25% of the parameter groups are randomly selected to embed the difference perturbation. For the parameter pairs within the selected group... Perform controlled perturbations: ; The parameter difference is defined as The constraint perturbation strength during the embedding process satisfies: This is to ensure the stability of the depth model's accuracy.

[0061] After the interpolation perturbation embedding is completed, a detection function is introduced into the deep model inference stage: This is used for subsequent extraction of perturbation patterns and signature verification.

[0062] The experimental results show that the accuracy decrease of the depth model is less than 0.05%, indicating that the impact of perturbation on the functionality of the depth model is negligible. The test model is then obtained. .

[0063] (4) Quantitative simulation and inference evaluation Test models in the edge deployment platform TensorRT Perform INT8 integer quantization simulation, with the quantization parameter set to: scale factor. Offset .

[0064] The quantization mapping formula is: After quantization, inference simulation is performed, and the detection logic module is run during the deep model loading phase to extract the perturbation difference: Calculate the disturbance recovery rate. This means that 87% of the perturbation structure remains identifiable after quantization, indicating that the difference pattern can still exist stably after integer quantization.

[0065] (5) Trigger verification and risk assessment During the inference phase, the quantized signature value is calculated. The quantized signature value perfectly matches the pre-embedded difference perturbation, indicating that the perturbation structure was not destroyed during quantization and inference.

[0066] Inference tests were performed with 100 sets of random input samples, and the test was successfully triggered 83 times, resulting in a trigger rate of [missing information]. Calculate the comprehensive risk score Set a threshold ,when At that time, it was determined that the deep learning model had a risk of parameter-level vulnerabilities.

[0067] Therefore, this test model has a high probability of triggering vulnerabilities in the INT8 quantization deployment scenario, and the risk level is rated as high risk.

[0068] (6) Results Output and Analysis Automatically generate parameter-level vulnerability detection reports. Report content includes: high-risk parameter index and hierarchical mapping; differential perturbation embedded parameter table; quantization simulation configuration (TensorRTINT8, ...). , ); Disturbance recovery rate Detection trigger rate Vulnerability risk score ; Changes in depth model accuracy (Top-1 from 70.2% → 70.15%); Risk level: High risk.

[0069] The parameter-level vulnerability detection report recommends reinitializing or retraining the detected high-risk parameters and adopting a weighted quantization recalibration mechanism to prevent the retention of hidden information caused by parameter residue.

[0070] This embodiment verifies the feasibility of the method in actual models and real quantization environments. The results show that there exists a class of quantization-preserving parameters (such as bias terms, normalized statistics, etc.) in deep models that can maintain floating-point precision during quantization; these parameters can be used to embed structural perturbations; and the perturbations can still be stably identified by the detection function after quantization.

[0071] Therefore, the parameter-level vulnerability testing method for edge-deployed deep models proposed in this invention can effectively identify, quantify, and evaluate potential risks at the parameter level of deep models, providing technical support for the security of the deep model supply chain.

[0072] Furthermore, the terms "upper," "lower," "inner," "outer," "front," and "rear" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Unless otherwise specifically stated, the relative steps, numerical expressions, and values ​​of components and steps described in these embodiments do not limit the scope of the invention. Of course, the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of the invention. All equivalent changes or modifications made to the structures, features, and principles described in the claims of this invention should be included within the scope of the claims of this invention.

[0073] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A parameter-level vulnerability testing method for edge-deployed deep models, characterized in that, Includes the following steps: The deep model to be detected is structurally analyzed to obtain a parameter set. Parameter features are extracted from the parameter set. The quantization participation of the parameter set is analyzed in conjunction with the quantization and compression rules of the target edge deployment platform. A subset of risk parameters is selected based on the parameter features and the quantization participation of the parameter set. Define the index mapping relationship of the risk parameter subset to determine the embedding relationship between parameters in the risk parameter subset. Based on the output of the index mapping, embed the difference perturbation between parameters and obtain the original index mapping table. Then, verify the embedded difference perturbation during the inference process of the deep model to identify the vulnerabilities of the deep model. Configure a quantitative simulation environment to perform quantitative simulation of the deep model, extract the difference perturbation from the risk parameter subset after quantitative simulation, calculate the perturbation recovery rate based on the difference perturbation before and after quantization, and then verify whether the difference perturbation after quantitative simulation can be successfully triggered and calculate the detection trigger rate. Vulnerability risk scores are calculated based on disturbance recovery rate and detection trigger rate, and parameter-level vulnerability test reports are generated.

2. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, A subset of risk parameters is selected based on parameter characteristics and the quantization participation of the parameter set, including: selecting a subset of risk parameters that were not quantized to integers during the quantization process but have high precision retention characteristics, wherein the high precision retention characteristics refer to the characteristic of being retained as a 32-bit floating-point number format.

3. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, Define the index mapping relationship for the risk parameter subset, including: using the selected risk parameter subset as the parameter sequence, dividing the parameter sequence into multiple groups, with each group having a length of [length missing]. A difference embedding mapping function is constructed to map each group to a unique integer index in order to define the index mapping relationship.

4. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, Based on the output of the index mapping, interpolation perturbations are embedded between the parameters, including: Define the parameter difference as By adjusting the sign and amplitude of the difference, the difference disturbance is made to satisfy: ;in, Indicates the first One parameter, Indicates the first One parameter, For parameter index, For parameter differences, For parameter difference index, The difference between the target parameters. The perturbation step size is used to determine the strength of the inter-parameter perturbation embedded between constraints. Based on the difference perturbation constraint, the embedding process is combined with a key strategy to plan the order of embedding difference perturbations. Specifically, this includes: defining a key sequence, determining a pseudo-random mapping function based on the key sequence to change the embedding position of the difference perturbation, determining the order of embedding the difference perturbation, and realizing the embedding of difference perturbations between parameters.

5. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, The original index mapping table includes: the embedding location of the difference perturbation, the target difference perturbation to be embedded, and metadata containing the group number and key sequence of the embedded difference perturbation.

6. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, When embedding inter-parameter perturbations, it is also necessary to set upper limit constraints and detection constraints for inter-parameter perturbations, which are used to ensure the stability of the deep model when inter-parameter perturbations are embedded and the inter-parameter perturbations are still detectable and triggerable under quantization simulation. The upper limit constraint for the difference disturbance is expressed as follows: , The standard deviation of the parameter distribution. For the safety factor; the construction of detection constraints includes: determining the theoretical embedding capacity based on the number of parameters in the risk parameter subset and the length of each group, and introducing embedding sparsity on the basis of the theoretical embedding capacity to determine the actual embedding capacity, which is used to prevent the embedding signal from being weakened during the quantization or compression process of the deep model, thus completing the construction of detection constraints.

7. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, Validating the embedding interpolation perturbations during the inference process of deep models includes: A detection function is introduced during the quantization inference process of the deep model to extract the difference perturbation during deep model inference. The extracted difference perturbation is then verified to be consistent with the pre-embedded difference perturbation. If the verification is consistent, it confirms that there is a vulnerability in the area where the risk parameter is located, and that it can be triggered and exploited in a real operating environment.

8. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, The difference perturbation is extracted from the subset of risk parameters after quantization simulation. The perturbation recovery rate is calculated based on the difference perturbation before and after quantization, including: Based on the index mapping relationship and the original index mapping table, the difference perturbation is extracted from the parameter subset after quantization simulation according to the parameter extraction function, and the quantized difference perturbation sequence is recovered by the following formula: In the formula, To recover the difference perturbation sequence, For the first quantization simulation One parameter, For the first quantization simulation One parameter; Establish error constraints This is used to determine whether the difference disturbance after quantization simulation can be recovered. If it can be recovered, it indicates that there is a vulnerability in the deployment link of the parameter subset in the deep model. Based on the error constraint, the number of residual difference perturbations within the error constraint is counted according to the difference perturbation before and after quantization, in order to calculate the perturbation recovery rate: This is used to quantitatively assess the residual state of a vulnerability after quantitative simulation, where... The number of difference perturbations to satisfy the error constraint, This represents the total number of difference disturbances.

9. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, To verify whether the difference perturbation after quantization simulation can be successfully triggered, the detection trigger rate is calculated, including: Based on the deep model after quantization simulation, a detection function is introduced into the inference function and test data is input to check whether the output signature corresponding to the input test data is consistent with the pre-embedded difference perturbation. If they are consistent, it indicates that the difference perturbation after quantization simulation can be successfully triggered; otherwise, the triggering fails. The detection trigger rate is calculated using the following formula to quantify the exploitability of a vulnerability: In the formula, Indicates the number of times it was successfully triggered. This represents the total number of times.

10. The parameter-level vulnerability testing method for edge-deployed deep models according to claim 1, characterized in that, The vulnerability risk score is calculated using the following formula: ， In the formula, and Disturbance recovery rate and detection trigger rate Weighting coefficients; when If the value exceeds a preset threshold, the deep learning model is deemed to have a parameter-level vulnerability risk, and a parameter-level vulnerability test report is generated; otherwise, the deep learning model is deemed to be secure and controllable under the quantization and deployment chain.

Images