Model training method and device based on computational decoupling architecture and related equipment

Abstract

The invention provides a model training method and device based on a computational decoupling architecture and related equipment, which are applied to electronic equipment, the electronic equipment comprises a GPU module deployed in a non-trusted environment and a CPU module deployed in a TEE, and a secure communication channel is established between the CPU module and the GPU module for data transmission. The method comprises the steps that a CPU module obtains embedded vector data and weight parameter data of a model; the GPU module determines a first calculation result of the model based on the embedded vector data and the weight parameter data, and samples the first calculation result to obtain a first sampling result; the CPU module determines a second calculation result of the model based on the embedded vector data and the target weight parameter data, and determines an error between the second calculation result and the first sampling result; and when the error is smaller than or equal to a preset threshold value, updating the weight parameter data based on the first calculation result.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a model training method, apparatus and related equipment based on a computationally decoupled architecture. Background Technology

[0002] As open-source artificial intelligence (AI) models continue to upgrade, the "AI egalitarian era" will gradually become a reality. Governments, enterprises, and individual developers are all deploying or using large AI models to empower production and daily life, gradually integrating AI technology into business scenarios. This has also created an urgent need for fine-tuning large models at the L2 and L3 levels for specific industries, domains, or tasks. To achieve efficient adaptation of general-purpose large models to specific domains, their parameters need to be fine-tuned. However, the massive number of parameters in large models (such as the fourth-generation large language model (Generative Pre-trained Transformer 4, GPT-4) with tens of billions of parameters) results in extremely high training costs.

[0003] Currently, model training, such as model fine-tuning, typically uses a graphics processing unit (GPU) as a "black box" to perform computational tasks. Since GPU computation is unreliable, the reliability of model training results cannot be guaranteed. Summary of the Invention

[0004] This application provides a model training method, apparatus, and related equipment based on a computationally decoupled architecture, which can solve the technical problem in related technologies that cannot guarantee the reliability of model training results.

[0005] In a first aspect, embodiments of this application provide a model training method based on a computationally decoupled architecture, applied to an electronic device. The electronic device includes a graphics processing unit (GPU) module deployed in an untrusted environment and a central processing unit (CPU) module deployed in a trusted execution environment (TEE). A secure communication channel is established between the CPU module and the GPU module for data transmission. The method includes:

[0006] The CPU module acquires the model's embedding vector data and weight parameter data;

[0007] The GPU module determines the first calculation result of the model based on the embedded vector data and the weight parameter data, and samples the first sampling result from the first calculation result;

[0008] The CPU module determines the second calculation result of the model based on the embedded vector data and the target weight parameter data, and determines the error between the second calculation result and the first sampling result. The target weight parameter data is the data in the weight parameter data that is associated with the first sampling result.

[0009] When the error is less than or equal to a preset threshold, the CPU module updates the weight parameter data based on the first calculation result.

[0010] Secondly, embodiments of this application provide a model training device based on a computationally decoupled architecture. The device includes: a graphics processing unit (GPU) module deployed in an untrusted environment and a central processing unit (CPU) module deployed in a trusted execution environment (TEE). A secure communication channel is established between the CPU module and the GPU module for data transmission.

[0011] The CPU module is used to acquire the model's embedding vector data and weight parameter data;

[0012] The GPU module is used to determine the first calculation result of the model based on the embedded vector data and the weight parameter data, and to sample the first sampling result from the first calculation result.

[0013] The CPU module is used to determine a second calculation result of the model based on the embedded vector data and the target weight parameter data, and to determine the error between the second calculation result and the first sampling result, wherein the target weight parameter data is the data in the weight parameter data associated with the first sampling result; and to update the weight parameter data based on the first calculation result if the error is less than or equal to a preset threshold.

[0014] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the model training method based on a computationally decoupled architecture as described in the first aspect.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the model training method based on a computationally decoupled architecture as described in the first aspect.

[0016] Fifthly, embodiments of this application provide a computer program product, including computer instructions that, when executed by a processor, implement the steps of the model training method based on a computationally decoupled architecture as described in the first aspect.

[0017] In this embodiment, a CPU module deployed in a TEE acquires the model's embedding vector data and weight parameter data. A GPU module deployed in an untrusted environment determines a first calculation result of the model based on the embedding vector data and the weight parameter data, and samples a first sampling result from the first calculation result. The CPU module in the TEE, based on the embedding vector data and target weight parameter data, determines a second calculation result of the model and determines the error between the second calculation result and the first sampling result. The target weight parameter data is the data in the weight parameter data associated with the first sampling result. If the error is less than or equal to a preset threshold, the weight parameter data is updated based on the first calculation result. Thus, sensitive operations during model training are executed in the TEE, high-performance computing is offloaded to the GPU module in the untrusted environment, and the TEE recalculates the sampled result from the GPU module's output calculation result to verify its correctness. This improves the reliability and robustness of the model training results without affecting overall computational efficiency. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a model training method based on a computationally decoupled architecture provided in an embodiment of this application;

[0020] Figure 2 This is a flowchart illustrating a specific example of a model training method based on a computationally decoupled architecture, provided in an embodiment of this application.

[0021] Figure 3 This is a schematic diagram of the structure of a model training device based on a computational decoupling architecture provided in an embodiment of this application;

[0022] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] With the continuous upgrades of open-source AI models like DeepSeek, the "AI equality era" is gradually becoming a reality. Governments, enterprises, and individual developers are all deploying or using large AI models to empower production and daily life, gradually integrating AI technology into business scenarios. This has also created an urgent need for fine-tuning large models at the L2 and L3 levels for specific industries, domains, or tasks. To achieve efficient adaptation of general-purpose large models to specific domains, their parameters need to be fine-tuned. However, the massive number of parameters in large models (such as GPT-4 with tens of billions of parameters) leads to extremely high training costs. The CEO of OpenAI has publicly stated that the training cost of GPT-4 exceeded $100 million. At the same time, the fine-tuning and training process also harbors serious data security risks: not only are there risks of data misuse and privacy leaks, but there is also the possibility of illegal disclosure of the model's core knowledge and parameters.

[0025] Privacy-preserving computation refers to the use of technologies such as encryption, secure multi-party computation, federated learning, and trusted execution environments to achieve data usability without visibility, while ensuring data privacy and security. This enables different participants to conduct joint computation and analysis without disclosing the original data, thereby promoting the release of data value and compliant utilization in multiple fields such as finance, healthcare, and government.

[0026] For model training and fine-tuning, commonly used technologies include multi-party secure computation, federated learning, trusted execution environments, homomorphic encryption, differential privacy, and encryption-based model training frameworks. These technologies have the following main drawbacks:

[0027] 1. The problem of plaintext storage of data and models in GPU memory has not been effectively solved, and the risk of leakage of fine-tuning datasets, training datasets and large model parameters during the fine-tuning training of large models cannot be resolved.

[0028] 2. The lack of a security verification mechanism for the graphics processing unit (GPU) computing process makes it impossible to guarantee the reliability of the processing results.

[0029] The technical problems to be solved by the embodiments of this application include:

[0030] 1. Risk of data and model leakage during large model fine-tuning / training: In traditional GPU training, data and model weights need to reside in GPU memory in plaintext, which poses a risk of being stolen by malware or side-channel attacks, such as gradient inversion attacks.

[0031] 2. Trusted Execution Environment (TEE) computing power bottleneck: Existing TEE-based solutions are limited by the memory capacity of the central processing unit (CPU) (usually in the range of 1 billion bytes (GB)) and limited parallel computing capabilities, making it difficult to meet the training and fine-tuning requirements of models with hundreds of billions of parameters.

[0032] 3. Lack of security verification: Currently, GPUs perform computing tasks as "black boxes," lacking a reliable verification mechanism for the computing process and results.

[0033] The model training method based on a computationally decoupled architecture provided in this application aims to solve the aforementioned technical problems and is applied to electronic devices, primarily involving security, artificial intelligence, blockchain, and other technical fields. This electronic device can consist of at least one device, which forms the architecture of a model training system. The electronic device may include multiple functional modules, such as a GPU module deployed in an untrusted environment and a CPU module deployed in a Trusted Execution Environment (TEE). This enables trusted fine-tuning of large models based on a computationally decoupled architecture, thereby solving the technical challenge of balancing computational performance and training data security in AI large model fine-tuning scenarios. This system achieves comprehensive security protection for model parameters and the computation process by separating sensitive operations from high-performance computing tasks and combining them with an active trusted verification mechanism.

[0034] The overall architecture of the solution consists of two core modules: a CPU module deployed on the TEE and a GPU module deployed in an untrusted environment. The CPU module on the TEE is responsible for performing operations involving sensitive data, including data decryption, parameter updates, and gradient noise addition, ensuring that sensitive data is not exposed to the untrusted environment. Meanwhile, the GPU module deployed in the untrusted environment focuses on performing high-performance computing tasks, such as General Matrix Multiplication (GEMM), convolution operations, and backpropagation, thus achieving a collaborative paradigm where "sensitive data operations are handled by the TEE, and general-purpose computing is handled by the GPU."

[0035] To ensure the security of model parameters during transmission, the solution introduces a weight slicing mechanism. The GPU module only retrieves the weight parameter data required for the current computation level from the CPU module when needed, avoiding loading all parameters at once and reducing the risk of leakage. After each weight parameter data transmission, the GPU module's memory area is reset using masking technology to ensure that unused portions cannot be illegally accessed or reused, thereby maintaining model integrity.

[0036] Furthermore, this application also employs an active trusted verification mechanism. The CPU module randomly recalculates 5-10% of the key computational results (such as the attention matrix) from the computational results output by the GPU module, and dynamically adjusts the sampling rate based on a Bayesian anomaly detection algorithm to address potential computational biases or attack behaviors. This mechanism can improve the system's trustworthiness and robustness without affecting overall computational efficiency.

[0037] The following provides a detailed description of the model training method based on a computationally decoupled architecture provided in the embodiments of this application.

[0038] See Figure 1 , Figure 1 This is a flowchart illustrating a model training method based on a computationally decoupled architecture, provided in an embodiment of this application. The method is applied to an electronic device, which includes a graphics processing unit (GPU) module deployed in an untrusted environment and a central processing unit (CPU) module deployed in a trusted execution environment (TEE). A secure communication channel is established between the CPU module and the GPU module for data transmission. Figure 1 As shown, the method includes the following steps:

[0039] Step 101: The CPU module acquires the model's embedding vector data and weight parameter data;

[0040] Step 102: The GPU module determines the first calculation result of the model based on the embedded vector data and the weight parameter data, and samples the first sampling result from the first calculation result;

[0041] Step 103: The CPU module determines the second calculation result of the model based on the embedded vector data and the target weight parameter data, and determines the error between the second calculation result and the first sampling result. The target weight parameter data is the data in the weight parameter data that is associated with the first sampling result.

[0042] Step 104: If the error is less than or equal to a preset threshold, the CPU module updates the weight parameter data based on the first calculation result.

[0043] Before step 101, a secure communication channel can be established between the CPU module and the GPU module, as well as a secure communication channel can be established between the CPU module and other functional modules in the model training system. This secure communication channel is constructed using the Transport Layer Security 1.3 (TLS 1.3) protocol to ensure the integrity and confidentiality of subsequent weight transfers and computation result feedback. During this stage, the GPU module loads computing libraries, including CUDA and cuBLAS, and allocates GPU memory resources. And initialize the multi-threaded execution context, but at this time, video memory resources... The weight parameters of the model that have not yet been loaded are the sensitive weights.

[0044] In some embodiments, the CPU module can directly load the model and its weight parameter data from the protected storage area.

[0045] In some embodiments, step 101 specifically includes:

[0046] The CPU module obtains the encrypted parameter file of the model;

[0047] The CPU module decrypts the parameter file to obtain the plaintext parameter file of the model;

[0048] The CPU module parses the structure of the plaintext parameter file to obtain the weight parameter data of each level of the model. The weight parameter data of the model includes the weight parameter data of each level of the model.

[0049] This includes the ability to initialize the model fine-tuning environment, and the ability for CPU modules deployed on the TEE to load encrypted parameter files from protected storage. The parameter file W is decrypted in plaintext form using the Advanced Encryption Standard (AES) algorithm in the CPU module. express.

[0050] It is stored in the TEE's secure memory to prevent access by untrusted processes. The CPU module deployed in the TEE simultaneously initializes the random number generator RNG and the video memory mask function M(∙), providing a foundation for subsequent dynamic weight slicing and video memory security.

[0051] In some embodiments, to facilitate subsequent on-demand loading of weights, the CPU module deployed on the TEE parses the structure of the plaintext parameter file to obtain weight parameter data for different levels of the model. It means that, among them, For the weight parameter data of level t, For the input of level t, For the output of level t, the first mapping relationship can be established using... This indicates that the first mapping relationship is a dynamic weight slice mapping, which indicates the mapping relationship between the weight parameter data of different levels of the model and the storage location.

[0052] In some embodiments, the CPU module can directly load the model's embedding vector data.

[0053] In some embodiments, step 101 further includes:

[0054] The CPU module acquires the encrypted training data of the model;

[0055] The CPU module decrypts the encrypted training data to obtain plaintext training data;

[0056] The CPU module performs word segmentation on the plaintext training data to obtain the embedding vector data of the model.

[0057] In some embodiments, the dataset provider may provide training data such as text, images, and speech. Encryption, using This indicates that encrypted training data has been obtained. and through secure communication channels The encrypted training data is sent to the TEE, and the CPU module deployed in the TEE can obtain and decrypt the encrypted training data. This means that the format of the dataset can be verified to ensure that the dataset format is compatible with subsequent fine-tuning methods.

[0058] In some embodiments, the CPU module can use an adapted word segmentation model. Generate plaintext word segmentation vectors for fine-tuning training of large models, using... This means that the model's embedding vector data can be obtained.

[0059] It should be noted that all data processing steps are completed within the TEE, ensuring that plaintext data cannot be obtained in untrusted environments, thus improving the security of model training.

[0060] The CPU module can record decryption and preprocessing operation logs. This includes the dataset vector size, processing steps, and timestamps, providing a basis for subsequent trustworthy verification. This stage ensures that the fine-tuned data is safe and reliable before entering the GPU module and provides standardized input for high-performance computing.

[0061] In step 102, the first calculation result of the model can be determined based on the embedded vector data and weight parameter data. The first calculation result can be an intermediate result in the model calculation process, such as the intermediate result output by the intermediate level of the model, or the result output by the final level of the model.

[0062] In some embodiments, the model includes at least two levels, which are used for inference computation of the model, and step 102 specifically includes:

[0063] The GPU module requests the weight parameter data of the current calculation level t of the model from the CPU module, where t is a positive integer;

[0064] The CPU module obtains the weight parameter data of the model's level t based on a pre-stored first mapping relationship, where the first mapping relationship is the mapping relationship between the weight parameter data of different levels of the model and the storage location.

[0065] The GPU module determines the first calculation result of the model at level t based on the weight parameter data of the model at level t and the first calculation result of the model at level t-1. The first calculation result of the model includes the first calculation result of each level of the model. The first calculation result of the model at level t-1 is calculated based on the weight parameter data of the model at level t-1 and the embedding vector data, or it is the embedding vector data.

[0066] Using a weight slicing mechanism, the GPU module dynamically requests weight parameter data for the current layer of the model from the CPU module. The GPU module can request weight blocks from the CPU module based on the identifier 't' of the layer where the model is currently being computed. The CPU module obtains the weight parameter data for level t of the model and maps them according to the dynamic slice. Extract the encrypted weight parameter data ( And decrypt, using This means that the CPU module only loads the weight parameter data of the current level into the GPU module's video memory. This is to reduce the exposure time of sensitive information.

[0067] Weight parameter data of the current level Transmission via secure communication channel Completed, and TEE will record the access log. And verify data integrity to prevent tampering.

[0068] In some embodiments, before the GPU module determines the first calculation result of the model's level t based on the weight parameter data of the model's level t and the first calculation result of the model's level t-1, the method further includes:

[0069] When the GPU module obtains the first data, it performs a mask reset on the storage area in the GPU module's video memory region that does not store the first data, thereby obtaining a second mapping relationship and the second data stored in the video memory region. The first data is the weight parameter data of the model's level or the first calculation result of the model's level, and the second mapping relationship is the mapping relationship between the first data and the storage area in the video memory region.

[0070] Based on the second data and the second mapping relationship, the GPU module determines the weight parameter data of the model's level t and the first calculation result of the model's level t-1.

[0071] After obtaining the weight parameter data of the receiving model at level t, the GPU module can apply a memory mask function to the unused memory regions (i.e., regions where no data is stored) in the video memory area. Filling with random noise is represented by the following formula.

[0072]

[0073] Since all the GPU module's video memory is already filled, even if an attacker gains access to the GPU module's video memory, they will not be able to locate the storage area where the current layer's weight parameter data is located. This ensures that dynamically loaded weight parameter data and the first calculation results of the model's layers are not leaked on the GPU module side, achieving a balance between efficient computation and security management. When computation is needed, the weight parameter data of the model's layer t and the first calculation results of the model's layer t-1 can be determined based on the second data and the second mapping relationship.

[0074] Furthermore, the GPU module performs high-performance computations based on the weight parameter data of the current layer, including matrix multiplication, convolution operations, and backpropagation. The formula for calculating the embedding layer of the model is as follows: The first calculation result of the model's level t-1 can be the embedded vector data.

[0075] The formula for calculating the self-attention layer of the model is as follows:

[0076]

[0077]

[0078] It is calculated based on the weight parameter data of the model's level t and the first calculation result of the model's previous level (as an intermediate result). The first calculation result of the model's previous level, i.e., level t-1, is calculated based on the weight parameter data and embedding vector data of the model's level t-1.

[0079] In some embodiments, to accelerate the computational efficiency of the GPU module, CUDA multithreading and cuBLAS can be used to accelerate matrix multiplication in the GPU module. It indicates. Among them, Given the input and weight matrices, This is the scaling factor. The GPU module only handles non-sensitive computational tasks; intermediate results are stored in GPU memory for use in subsequent computations and TEE trusted verification.

[0080] After the GPU module completes the general computation, it will output the intermediate results. The data is temporarily stored in GPU memory, awaiting mask reset and TEE sampling verification. Pipeline and GPU memory reuse optimizations ensure the computational efficiency of the GPU module while guaranteeing the data security of multiple layer weight parameters.

[0081] In some embodiments, the GPU module can perform mask reset on unused areas in the video memory region after completing the calculation of each level t.

[0082] In some embodiments, the GPU module can also perform mask reset on unused areas of the video memory region after calculating weight parameters at multiple levels to prevent leakage of residual information. Assume the video memory region is: The set of indexes for the used storage areas is as follows: .

[0083] For unused areas in the video memory region, the mask is reset. The mask reset formula is as follows:

[0084]

[0085] After the masking is completed, the unused areas in the video memory region are filled with random noise to protect dynamic weights and intermediate results. TEE can be safely sampled for reliable verification, ensuring the safety and reliability of the entire calculation process.

[0086] The CPU module loads the weight parameter data for each layer of the model in separate chunks, while the GPU module performs calculations and resets the memory mask based on the weight parameter data. The calculation formula for each layer is as follows:

[0087]

[0088]

[0089] in, The input to level t of the model can be an intermediate level that is the output of level t-1. The GPU module only loads the weight parameter data of the current level. The system performs calculations and saves intermediate results for use in the next layer or for TEE sampling verification. After the intermediate results of each layer are calculated, the GPU module can protect unused storage areas by resetting the protection through a mask.

[0090] In some embodiments, the GPU module can extract an intermediate result of a level from the first calculation result. Correspondingly, in step 103, the CPU module can determine the second calculation result of the model based on the embedded vector data and the target weight parameter data of the extracted level, and accordingly, determine the error between the second calculation result and the first sampling result.

[0091] In some embodiments, after the GPU module calculates an intermediate result for each level, the CPU module can randomly sample a preset number of intermediate results, such as 5%-10%, for reliable verification, thereby improving the robustness and security of the entire fine-tuning process. Specifically, in some embodiments, the CPU module determines the second calculation result of the model based on the embedded vector data and the target weight parameter data, including:

[0092] The CPU module determines the second calculation result of the model at level t-1 based on the first calculation result of the model at level t-1 and the weight parameter data of the model at level t. The target weight parameter data is the weight parameter data of the model at level t.

[0093] Determining the error between the second calculation result and the first sampling result includes:

[0094] Determine the error between the first sampling result in the first calculation result of the model at level t and the second sampling result in the second calculation result of the model at level t, wherein the sampling position of the second sampling result corresponds to that of the first sampling result.

[0095] The CPU module randomly samples the computation results output by the GPU module. (i.e., the first sampling result), and perform verification calculations, using This indicates that the second sampling result in the CPU module's calculation results was verified. The first sampled result from the computational results output by the GPU module is used to ensure the reliability of the GPU module's computation. Since the computational workload of the weight parameter data at the current level is relatively small, the efficiency of using the CPU module for computation can still be guaranteed.

[0096] After verification, if the error is abnormal, i.e., the error is greater than the preset threshold, the sampling rate can be adjusted to further enhance the monitoring of the GPU module's computation. Specifically, the method further includes determining the error between the first sampling result in the first calculation result for the model's level t and the second sampling result in the second calculation result for the model's level t.

[0097] When the error exceeds the preset threshold, the CPU module adjusts the sampling rate based on the error. The sampling rate is used to sample the first calculation result of level t+1 of the model.

[0098] In other words, when the error exceeds the preset threshold... In the event of such an error, an anomaly detection mechanism will be triggered. The CPU module will dynamically adjust the sampling rate based on the error using Bayesian anomaly detection. It can be expressed by the following formula.

[0099]

[0100] in, and With fixed parameters, an active sampling verification mechanism can detect potential attacks or deviations without significantly reducing computational efficiency, thereby improving the overall credibility of the fine-tuning process.

[0101] The GPU module can feed back the initial calculation result to the CPU module. If the CPU module determines that the error is less than or equal to a preset threshold, it can update the weight parameter data based on the initial calculation result. After all weight parameter data has been updated and training is complete, the CPU module can perform integrity verification on the results stored in secure memory and perform asymmetric encryption on them. This indicates that the encrypted parameter file will then be transmitted via a secure communication channel. The output is given to the model trainer to ensure that the model's weight parameters are not exposed, while retaining the advantages of high-performance computing, ensuring that the entire fine-tuning process is safe, efficient and reliable.

[0102] The following example illustrates in detail the model training method based on a computationally decoupled architecture provided in the embodiments of this application.

[0103] Figure 2 This is an implementation architecture diagram of a model training method based on a computationally decoupled architecture, as provided in an embodiment of this application. Figure 2 As shown, its implementation process includes the following steps:

[0104] Step 201: Initialize the fine-tuning environment. The CPU module deployed in the TEE loads the encrypted parameter file of the model, performs structural parsing, and initializes the secure communication channel.

[0105] Step 202: The dataset provider encrypts the training data and transmits it to the CPU module deployed on the TEE through a secure communication channel. The CPU module decrypts the data and performs word segmentation.

[0106] Step 203: The GPU module requests the weight parameter data for each level. After the CPU module decrypts the data, it synchronously transmits it to the CPU module's video memory area through a secure communication channel and fills the unused storage area with noise.

[0107] Step 204: The GPU module performs general calculations, temporarily stores intermediate results, and resets the mask of unused storage areas in the video memory region; repeat the above steps to load the weight parameter data of each layer in sequence and perform general calculations.

[0108] Step 205: The CPU module randomly selects some intermediate results for recalculation. If an anomaly is found, the subsequent sampling rate is adjusted.

[0109] Step 206: The CPU module performs integrity verification on the results stored in secure memory and transmits them to the model trainer via a secure communication channel after encryption.

[0110] This application's embodiments employ a computationally decoupled architecture, executing sensitive operations (such as data decryption, parameter updates, and gradient noise addition) entirely within the TEE, while offloading high-performance computing (such as GEMM, convolution, and backpropagation) to the GPU module. This achieves a collaborative paradigm where "sensitive data operations are handled by the TEE, and general-purpose computing power is handled by the GPU."

[0111] This application embodiment uses a dynamic weight slicing mechanism, where the GPU module only obtains the encrypted weight blocks (such as single-layer weight parameter data) required for the current calculation, and uses masking technology to ensure the integrity of the model's weight parameter data and calculation results.

[0112] The embodiments of this application can realize proactive trusted verification. The TEE randomly recalculates 5-10% of the intermediate calculation results output by the GPU module to verify whether the calculation results of the GPU module are correct, and dynamically adjusts the sampling rate based on Bayesian anomaly detection.

[0113] Compared with related technologies, the embodiments of this application have the following technical advantages:

[0114] The embodiments of this application can effectively solve the risk of data and model leakage. By performing all sensitive operations (such as data decryption, parameter update, and gradient noise addition) in TEE, it ensures that sensitive data will not be exposed in untrusted environments. At the same time, the dynamic weight slicing mechanism only loads encrypted weight blocks to the GPU module's video memory as needed, and resets unused areas through masking technology after use, which greatly reduces the exposure time and leakage risk of model parameters on the GPU side, thereby significantly improving the overall data and model security of the system.

[0115] It can overcome the TEE computing power bottleneck and achieve high-performance computing. High-performance computing tasks (such as GEMM, convolution, and backpropagation) can be offloaded to the GPU module for execution, making full use of the parallel computing capabilities of the GPU module. This avoids the problem that pure TEE solutions cannot support the training and fine-tuning of models with hundreds of billions of parameters due to limitations in CPU memory and parallel capabilities, thereby significantly improving computing efficiency and model training performance while ensuring security.

[0116] Introducing an active trusted verification mechanism can enhance system trustworthiness. By randomly recalculating 5-10% of the computation results output by the GPU module through TEE and dynamically adjusting the sampling rate in conjunction with the Bayesian anomaly detection algorithm, potential computational deviations or attacks can be detected and addressed in a timely manner without affecting overall computational efficiency. This effectively compensates for the lack of result trustworthiness verification in traditional GPUs as "black boxes," thereby improving the robustness and trustworthiness of the system.

[0117] It can achieve synergistic optimization of security and performance. Through the collaborative paradigm of "sensitive data operations are handled by TEE and general computing power is handled by GPU", it achieves an organic unity of security and computing performance. It solves the technical problem that traditional large AI models are difficult to balance data protection and computing efficiency during training and fine-tuning, and provides a feasible solution for the deployment of large models in privacy-sensitive scenarios.

[0118] This application's embodiments achieve a core architecture of "sensitive data operations handled by TEE, general-purpose computing power handled by GPU" through a collaborative computing paradigm of TEE and GPU. Combined with dynamic weight slice transmission and a Bayesian-driven active verification mechanism, it maintains high-performance computing efficiency while ensuring the privacy and security of training data. It effectively addresses the fine-tuning needs of large models in sensitive fields such as financial risk control, medical diagnosis, and government intelligence, supporting both private deployment and cloud service models. It provides compliant and reliable model optimization solutions for AI service providers, cloud platform operators, and vertical industry customers, helping enterprises overcome data security barriers, unleash the value of AI applications, and promote the large-scale deployment of privacy computing technology in scenarios with hundreds of billions of parameters.

[0119] See Figure 3 , Figure 3This is a schematic diagram of a model training device based on a computational decoupling architecture provided in an embodiment of this application. The device includes a central processing unit (CPU) module 301 deployed in a trusted execution environment (TEE) and a graphics processing unit (GPU) module 302 deployed in an untrusted environment. A secure communication channel is established between the CPU module 301 and the GPU module 302 for data transmission.

[0120] The CPU module 301 is used to acquire the model's embedding vector data and weight parameter data;

[0121] The GPU module 302 is used to determine the first calculation result of the model based on the embedded vector data and the weight parameter data, and to sample the first sampling result from the first calculation result.

[0122] The CPU module 301 is used to determine a second calculation result of the model based on the embedded vector data and the target weight parameter data, and to determine the error between the second calculation result and the first sampling result, wherein the target weight parameter data is the data in the weight parameter data associated with the first sampling result; and to update the weight parameter data based on the first calculation result if the error is less than or equal to a preset threshold.

[0123] Optionally, the model includes at least two levels, which are used for inference calculations of the model. The GPU module 302 is also used to request weight parameter data of the current calculation level t of the model from the CPU module 301, where t is a positive integer.

[0124] The CPU module 301 is also used to obtain the weight parameter data of the model's level t based on a pre-stored first mapping relationship, wherein the first mapping relationship is the mapping relationship between the weight parameter data of different levels of the model and the storage location.

[0125] The GPU module 302 is further configured to determine the first calculation result of the model at level t based on the weight parameter data of the model at level t and the first calculation result of the model at level t-1. The first calculation result of the model includes the first calculation result of each level of the model. The first calculation result of the model at level t-1 is calculated based on the weight parameter data of the model at level t-1 and the embedding vector data, or it is the embedding vector data.

[0126] Optionally, the CPU module 301 is further configured to determine a second calculation result of the model at level t-1 based on the first calculation result of the model at level t-1 and the weight parameter data of the model at level t, wherein the target weight parameter data is the weight parameter data of the model at level t; and to determine the error between the first sampling result in the first calculation result of the model at level t and the second sampling result in the second calculation result of the model at level t, wherein the sampling position of the second sampling result corresponds to that of the first sampling result.

[0127] Optionally, the CPU module 301 is further configured to adjust the sampling rate based on the error when the error is greater than the preset threshold, wherein the sampling rate is used to sample the first calculation result of the model at level t+1.

[0128] Optionally, the GPU module 302 is further configured to, upon obtaining the first data, mask and reset the storage area in the video memory region of the GPU module 302 that does not store the first data, to obtain a second mapping relationship and the second data stored in the video memory region. The first data is the weight parameter data of the model's level or the first calculation result of the model's level, and the second mapping relationship is the mapping relationship between the first data and the storage area in the video memory region.

[0129] The GPU module 302 is further configured to determine the weight parameter data of the model's level t and the first calculation result of the model's level t-1 based on the second data and the second mapping relationship.

[0130] Optionally, the CPU module 301 is further configured to:

[0131] Obtain the encrypted training data for the model;

[0132] The encrypted training data is decrypted to obtain plaintext training data;

[0133] The plaintext training data is segmented to obtain the embedding vector data of the model.

[0134] Optionally, the CPU module 301 is further configured to:

[0135] Obtain the encrypted parameter file of the model;

[0136] The parameter file is decrypted to obtain the plaintext parameter file of the model;

[0137] The structure of the plaintext parameter file is parsed to obtain the weight parameter data of each level of the model. The weight parameter data of the model includes the weight parameter data of each level of the model.

[0138] The model training device 300 based on the computational decoupling architecture can implement all the processes implemented in the above embodiments of the model training method based on the computational decoupling architecture, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0139] See Figure 4 The figure shows a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Figure 4 As shown, the electronic device 400 includes: a processor 401, a memory 402, a user interface 403, and a bus interface 404.

[0140] The processor 401 is used to read the program in the memory 402 and execute the model training method based on the computational decoupling architecture described in the above embodiment.

[0141] exist Figure 4 In this context, the bus architecture can include any number of interconnected buses and bridges, specifically linking various circuits of one or more processors represented by processor 401 and memory represented by memory 402 together. The bus architecture can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 404 provides an interface. For different user devices, user interface 403 can also be an interface capable of connecting external or internal devices, including but not limited to keypads, displays, speakers, microphones, joysticks, etc.

[0142] The processor 401 is responsible for managing the bus architecture and general processing, while the memory 402 can store the data used by the processor 401 when performing operations.

[0143] Preferably, the present invention also provides an electronic device 400, including a processor 401, a memory 402, and a computer program stored in the memory 402 and executable on the processor 401. When the computer program is executed by the processor 401, it implements the various processes of the above-described model training method embodiment based on computational decoupling architecture and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0144] This invention also provides a readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described model training method embodiments based on a computationally decoupled architecture, achieving the same technical effects. To avoid repetition, these details will not be elaborated upon here. The readable storage medium may be, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0145] This application also provides a computer program product, including computer instructions. When executed by a processor, these computer instructions implement the various processes of the above-described model training method embodiment based on a computationally decoupled architecture, and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0146] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0147] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0148] In the embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0149] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of the present invention, depending on actual needs.

[0150] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0151] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0152] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A model training method based on a computationally decoupled architecture, characterized in that, Applied to an electronic device, the electronic device includes a graphics processing unit (GPU) module deployed in an untrusted environment and a central processing unit (CPU) module deployed in a trusted execution environment (TEE), wherein a secure communication channel is established between the CPU module and the GPU module for data transmission, the method comprising: The CPU module acquires the model's embedding vector data and weight parameter data; The GPU module determines the first calculation result of the model based on the embedded vector data and the weight parameter data, and samples the first sampling result from the first calculation result; The CPU module determines the second calculation result of the model based on the embedded vector data and the target weight parameter data, and determines the error between the second calculation result and the first sampling result. The target weight parameter data is the data in the weight parameter data that is associated with the first sampling result. When the error is less than or equal to a preset threshold, the CPU module updates the weight parameter data based on the first calculation result.

2. The method according to claim 1, characterized in that, The model includes at least two levels for inference computation. The GPU module determines a first computation result of the model based on the embedding vector data and the weight parameter data, including: The GPU module requests the weight parameter data of the current calculation level t of the model from the CPU module, where t is a positive integer; The CPU module obtains the weight parameter data of the model's level t based on a pre-stored first mapping relationship, where the first mapping relationship is the mapping relationship between the weight parameter data of different levels of the model and the storage location. The GPU module determines the first calculation result of the model at level t based on the weight parameter data of the model at level t and the first calculation result of the model at level t-1. The first calculation result of the model includes the first calculation result of each level of the model. The first calculation result of the model at level t-1 is calculated based on the weight parameter data of the model at level t-1 and the embedding vector data, or it is the embedding vector data.

3. The method according to claim 2, characterized in that, The CPU module determines the second calculation result of the model based on the embedded vector data and the target weight parameter data, including: The CPU module determines the second calculation result of the model at level t-1 based on the first calculation result of the model at level t-1 and the weight parameter data of the model at level t. The target weight parameter data is the weight parameter data of the model at level t. Determining the error between the second calculation result and the first sampling result includes: Determine the error between the first sampling result in the first calculation result of the model at level t and the second sampling result in the second calculation result of the model at level t, wherein the sampling position of the second sampling result corresponds to that of the first sampling result.

4. The method according to claim 3, characterized in that, The method for determining the error between the first sampling result in the first calculation result of the model's level t and the second sampling result in the second calculation result of the model's level t further includes: When the error exceeds the preset threshold, the CPU module adjusts the sampling rate based on the error. The sampling rate is used to sample the first calculation result of level t+1 of the model.

5. The method according to claim 2, characterized in that, Before the GPU module determines the first calculation result of the model's level t based on the weight parameter data of the model's level t and the first calculation result of the model's level t-1, the method further includes: When the GPU module obtains the first data, it performs a mask reset on the storage area in the GPU module's video memory region that does not store the first data, thereby obtaining a second mapping relationship and the second data stored in the video memory region. The first data is the weight parameter data of the model's level or the first calculation result of the model's level, and the second mapping relationship is the mapping relationship between the first data and the storage area in the video memory region. Based on the second data and the second mapping relationship, the GPU module determines the weight parameter data of the model's level t and the first calculation result of the model's level t-1.

6. The method according to claim 1, characterized in that, The CPU module acquires the model's embedding vector data, including: The CPU module acquires the encrypted training data of the model; The CPU module decrypts the encrypted training data to obtain plaintext training data; The CPU module performs word segmentation on the plaintext training data to obtain the embedding vector data of the model.

7. The method according to claim 1, characterized in that, The CPU module acquires the model's weight parameter data, including: The CPU module obtains the encrypted parameter file of the model; The CPU module decrypts the parameter file to obtain the plaintext parameter file of the model; The CPU module parses the structure of the plaintext parameter file to obtain the weight parameter data of each level of the model. The weight parameter data of the model includes the weight parameter data of each level of the model.

8. A model training device based on a computationally decoupled architecture, characterized in that, The device includes: a graphics processing unit (GPU) module deployed in an untrusted environment and a central processing unit (CPU) module deployed in a trusted execution environment (TEE). A secure communication channel is established between the CPU module and the GPU module for data transmission. The CPU module is used to acquire the model's embedding vector data and weight parameter data; The GPU module is used to determine the first calculation result of the model based on the embedded vector data and the weight parameter data, and to sample the first sampling result from the first calculation result. The CPU module is used to determine a second calculation result of the model based on the embedded vector data and the target weight parameter data, and to determine the error between the second calculation result and the first sampling result, wherein the target weight parameter data is the data in the weight parameter data associated with the first sampling result; and to update the weight parameter data based on the first calculation result if the error is less than or equal to a preset threshold.

9. An electronic device, characterized in that, include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the steps of the model training method based on a computationally decoupled architecture as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the model training method based on a computationally decoupled architecture as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the model training method based on a computationally decoupled architecture as described in any one of claims 1 to 7.

Images