Obfuscating input data for third party machine learning systems

Abstract

The disclosure relates to obfuscating input data for a third party machine learning system. A method includes accessing training data and training tags corresponding to the training data; training a machine learning model configured to generate additional data, where the training includes generating the additional data by the machine learning model, combining the training data with the additional data to provide obfuscated data, transmitting the obfuscated data and a training tag to a trained machine learning system, a gradient regarding the loss function and the training tag is received from the trained machine learning system, the gradient resulting from inputting the obfuscated data to the trained machine learning system, and the machine learning model is adjusted based on the gradient. Training the machine learning model is repeated until training conditions are satisfied.

Description

Technical Field

[0001] Various example embodiments generally relate to input data for machine learning systems, and more particularly to obfuscating data to be input into a third-party machine learning system without degrading or significantly degrading the performance of the machine learning system. Background Technology

[0002] Machine learning models have become increasingly prevalent, and more and more companies offer them with easy internet access. A concern arises when the host entity controlling the machine learning model differs from the client entity intending to use it: the data the client entity intends to input into the model may be unintentionally exposed by the host entity. While encryption can be applied to protect data during transmission from the client entity to the host entity, this encryption is removed once the data reaches the host entity. Accordingly, improvements are desired to protect an entity's data from unnecessary exposure to the third-party entity hosting the machine learning model. Summary of the Invention

[0003] In various aspects of this disclosure, a method includes: accessing raw data and supplementary data; combining the raw data and supplementary data to provide obfuscated data; transmitting the obfuscated data to a trained machine learning system, wherein the trained machine learning system provides a desired output based on the received raw data or obfuscated data as input; and receiving the result of inputting the obfuscated data into the trained machine learning system.

[0004] Among the various aspects of this method is the generation of additional data using a trained machine learning model.

[0005] In various aspects of this method, the trained machine learning model generates additional data based on inputting random vectors from a predetermined set of random vectors into the trained machine learning model.

[0006] In various aspects of this method, the method further includes: selecting additional data from a predetermined set of additional data.

[0007] In all aspects of this method, the supplementary data is randomly selected from a predetermined set of supplementary data.

[0008] In all aspects of this method, the original data and the supplementary data have the same cardinality.

[0009] In all aspects of this method, the original data and the random vector have the same cardinality.

[0010] In various aspects of this method, combining the original data with additional data to provide obfuscated data includes performing normalization.

[0011] In all aspects of this method, the trained machine learning system includes a large language model, and the raw data consists of input prompts for the large language model.

[0012] In various aspects of this method, the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0013] In all aspects of this method, the trained machine learning system provides essentially the same output based on the received raw or scrambled data as input.

[0014] In all aspects of this method, the trained machine learning system is a third-party system.

[0015] In all aspects of this method, the original data is human-understandable, while the obfuscated data is human-incomprehensible.

[0016] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least any of the methods described above.

[0017] Among the various aspects of the device, the device also includes a trained machine learning model configured to generate additional data.

[0018] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0019] The following outlines other aspects.

[0020] According to various aspects of this disclosure, a method includes: receiving obfuscated data, wherein the obfuscated data includes a combination of additional data and original data; inputting the obfuscated data into a trained machine learning system, wherein the trained machine learning system provides a desired output based on the received original data or obfuscated data as input; and transmitting the result of inputting the obfuscated data into the trained machine learning system.

[0021] In all aspects of this method, the original data and the supplementary data have the same cardinality.

[0022] In all aspects of this method, the obfuscated data is normalized.

[0023] In all aspects of this method, the trained machine learning system includes a large language model, and the raw data consists of input prompts for the large language model.

[0024] In various aspects of this method, the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0025] In all aspects of this method, the trained machine learning system provides essentially the same output based on the received raw or scrambled data as input.

[0026] In all aspects of this method, the obfuscated data is received from a third-party system.

[0027] In all aspects of this method, the original data is human-understandable, while the obfuscated data is human-incomprehensible.

[0028] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least one of the methods described above.

[0029] In various aspects of the device, the device also includes a trained machine learning system, which provides a desired output based on received raw or obfuscated data as input.

[0030] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0031] The following outlines other aspects.

[0032] According to various aspects of this disclosure, a method includes: accessing training data and training labels corresponding to the training data; training a machine learning model configured to generate supplementary data, the training including: generating supplementary data by the machine learning model; combining the training data and the supplementary data to provide obfuscated data; transmitting the obfuscated data and training labels to the trained machine learning system; receiving gradients from the trained machine learning system with respect to a loss function and training labels, the gradients being obtained by inputting the obfuscated data into the trained machine learning system; and adjusting the machine learning model based on the gradients. Training the machine learning model is repeated until training conditions are met.

[0033] In various aspects of this method, the machine learning model generates additional data by inputting random vectors from a predetermined set of random vectors into the machine learning model.

[0034] In all aspects of this method, the training data and the supplementary data have the same cardinality.

[0035] In all aspects of this method, the training data and the random vectors have the same cardinality.

[0036] In various aspects of this method, combining training data with additional data to provide obfuscated data includes performing normalization.

[0037] In all aspects of this method, the trained machine learning system includes a large language model, and the raw data consists of input prompts for the large language model.

[0038] In various aspects of this method, the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0039] In all aspects of this method, the trained machine learning system is a third-party system.

[0040] In all aspects of this method, the original data is human-understandable, while the obfuscated data is human-incomprehensible.

[0041] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least one of the methods described above.

[0042] Among the various aspects of the device, the device also includes a machine learning model configured to generate additional data.

[0043] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0044] The following outlines other aspects.

[0045] According to various aspects of this disclosure, a method includes: receiving obfuscated data and training labels, wherein the obfuscated data includes a combination of supplementary data and training data, wherein the training labels correspond to the training data; providing gradients with respect to a loss function and training labels by a trained machine learning system, wherein the gradients are obtained by inputting the obfuscated data into the trained machine learning system; and transmitting the gradients to a system configured to train a machine learning model for generating supplementary data.

[0046] In all aspects of this method, the training data and the supplementary data have the same cardinality.

[0047] In all aspects of this method, the obfuscated data is normalized.

[0048] In all aspects of this method, the trained machine learning system includes a large language model, and the training data consists of input prompts for the large language model.

[0049] In various aspects of this method, the trained machine learning system includes a convolutional neural network, and the training data are images used as input to the convolutional neural network.

[0050] In all aspects of this method, the obfuscated data is received from a third-party system.

[0051] In all aspects of this method, the training data is human-understandable, while the obfuscated data is human-incomprehensible.

[0052] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least the method as described in any of the preceding claims.

[0053] Among the various aspects of the device is a trained machine learning system.

[0054] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0055] The following outlines other aspects.

[0056] According to various aspects of this disclosure, a method includes: receiving kernels of a first layer of a trained neural network system, wherein the kernels of the first layer are non-empty; generating additional data based on the kernels of the first layer of the trained neural network system, wherein the additional data is configured such that the trained neural network system produces a desired output based on either: inputting original data into the trained neural network system, or inputting obfuscated data into the trained neural network system, wherein the obfuscated data includes a combination of additional data and original data; and storing the additional data for providing the obfuscated data.

[0057] In various aspects of the method, the method further includes: repeating the generation of additional data to generate multiple additional data; and storing the multiple additional data for providing obfuscated data.

[0058] In various aspects of the method, the method further includes: transmitting a request to the trained neural network system for the kernel of the first layer of the trained neural network system.

[0059] In all aspects of this method, the original data and the supplementary data have the same cardinality.

[0060] In all aspects of this method, the obfuscated data is normalized.

[0061] In all aspects of this method, the trained neural network system includes a large language model, and the raw data consists of input prompts for the large language model.

[0062] In various aspects of this method, the trained neural network system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0063] In all aspects of this method, the trained neural network system is a third-party system.

[0064] In all aspects of this method, the original data is human-understandable, while the obfuscated data is human-incomprehensible.

[0065] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least one of the methods described above.

[0066] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0067] The following outlines other aspects.

[0068] According to various aspects of this disclosure, a method includes: receiving a request for a kernel of a first layer of a trained neural network system, wherein the kernel of the first layer of the trained neural network system is non-empty; computing the kernel of the first layer of the trained neural network system; and transmitting the kernel of the first layer of the trained neural network system.

[0069] In all aspects of this method, the trained machine learning system includes a large language model, and the raw data consists of input prompts for the large language model.

[0070] In various aspects of this method, the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0071] In various aspects of this method, the request for the kernel of the first layer of the trained neural network system is received from a third-party system.

[0072] According to various aspects of this disclosure, an apparatus includes: at least one processor; and at least one memory storing instructions thereon. The instructions, when executed by the at least one processor, cause the apparatus to perform at least one of the methods described above.

[0073] Among the various aspects of the device is a trained machine learning system.

[0074] According to various aspects of this disclosure, a non-transitory processor-readable medium having instructions stored thereon, which, when executed by at least one processor of the device, cause the device to perform at least any of the methods described above.

[0075] The independent claims are provided with respect to several aspects. Additional aspects are defined in the dependent claims. Attached Figure Description

[0076] Some exemplary embodiments will now be described in conjunction with the accompanying drawings.

[0077] Figure 1 This is a diagram of an example embodiment of wireless networking between a network system and a user equipment (UE) according to one aspect of this disclosure; Figure 2 This is a diagram of an example component of a network system according to one aspect of this disclosure; Figure 3 This is a diagram illustrating an example of an operation for obfuscating input data to a machine learning system, according to aspects of this disclosure; Figure 4 This is a diagram illustrating an example of network operation for obfuscating input data from a user equipment (UE) to a third-party machine learning system, according to aspects of this disclosure; Figure 5 This is a diagram illustrating an example of combining raw data with supplementary data to generate obfuscated data according to aspects of this disclosure; Figure 6 This is a diagram illustrating an example of training a confusing data generator using a machine learning system based on shared gradient information according to aspects of this disclosure; Figure 7 This is a diagram illustrating examples of signals and operations for training a confusing data generator using a machine learning system based on shared gradient information, according to aspects of this disclosure; Figure 8 This is a diagram illustrating an example of an operation for generating obfuscated data based on the kernel of the first layer of a neural network, according to aspects of this disclosure; Figure 9 This is a diagram of an example block diagram of a device according to one aspect of the present disclosure. Detailed Implementation

[0078] This disclosure relates to obfuscating data to be input into a third-party machine learning system without degrading or substantially impairing the performance of the machine learning system. Aspects of this disclosure relate to obfuscating data in such a way that when the original data or obfuscated data is input into the machine learning system, the third-party machine learning system provides the desired output. As used herein, "obfuscated input data" or "obfuscated data" refers to data that has been altered in some way from its original form. In various embodiments, the obfuscated data may be incomprehensible to humans. By obfuscating data to be input into a third-party machine learning system without degrading the performance of the machine learning system, the data owner gains a degree of assurance that their data will not be freely exposed to the third-party system while still benefiting from using the third-party machine learning system.

[0079] In the following description, certain specific details are set forth in order to provide a thorough understanding of the disclosed aspects. However, those skilled in the art will recognize that the aspects may be implemented without one or more of these specific details, or using other methods, components, materials, etc. In other instances, well-known structures associated with transmitters, receivers, or transceivers have not been shown or described in detail to avoid causing unnecessary ambiguity in the description of these aspects.

[0080] Throughout this document, references to "one aspect" or "an aspect" imply that a particular feature, structure, or characteristic described with respect to that aspect is included in at least one aspect. Therefore, the phrases "in one aspect" or "in a certain aspect" appearing in various places in this specification do not necessarily all refer to the same aspect. Furthermore, a particular feature, structure, or characteristic may be combined in one or more aspects in any suitable manner.

[0081] The embodiments described in this disclosure can be implemented in wireless networking devices, such as, but not limited to, devices utilizing Global Microwave Access Interoperability (WiMAX), Global System for Mobile Communications (GSM, 2G), GSM EDGE Radio Access Network (GERAN), General Packet Radio Service (GPRS), Universal Mobile Telecommunications System based on Basic Wideband Code Division Multiple Access (W-CDMA) (UMTS, 3G), High-Speed ​​Packet Access (HSPA), Long Term Evolution (LTE), LTE Advanced, Enhanced LTE (eLTE), 5G New Radio (5G NR), 5G Advance, 6G (and later), and 802.11ax (Wi-Fi 6). The term "eLTE" here refers to LTE evolution connected to a 5G core. LTE is also referred to as Evolved UMTS Terrestrial Radio Access (EUTRA) or Evolved UMTS Terrestrial Radio Access Network (EUTRAN).

[0082] This disclosure may use the term "serving network device" to refer to a network node or network device (or part thereof) serving a UE. As used herein, the terms "transmit to," "transmit to," "receive from," and "cooperate with" (and variations thereof) include communication that may or may not involve communication via one or more intermediate devices or nodes. The term "acquire" (and variations thereof) includes initial acquisition or reacquisition after initial acquisition. The term "connection" may refer to a physical connection or a logical connection.

[0083] This disclosure uses 5G NR as an example of a wireless network, and may use smartphones and / or extended reality headsets as examples of UEs. It should be understood that these examples are for illustrative purposes only, and this disclosure applies to other wireless networks and user equipment.

[0084] Figure 1 This is a diagram illustrating an example of wireless networking between network system 100 and user equipment (UE) 150. Network system 100 may include one or more network nodes 120, one or more servers 110, and / or one or more network devices 130 (e.g., test equipment). Network node 120 will be described in more detail below. As used herein, the term "network apparatus" may refer to any component of network system 100, such as server 110, network node 120, network device 130, any of the foregoing components(s), and / or any other components(s) of network system 100. Examples of network apparatuses include, but are not limited to, apparatuses for implementing various aspects of 5G NR. This disclosure describes embodiments relating to 5G NR and embodiments relating to aspects defined by the 3rd Generation Partnership Project (3GPP). However, embodiments related to other wireless networking technologies are contemplated to be included within the scope of this disclosure.

[0085] The following description provides further details of examples of network nodes. In a 5G NR network, a gNodeB (also known as a gNB) may include, for example, a node that provides the UE with New Radio (NR) user plane and control plane protocol termination and is connected to the 5G core (5GC) via an NG interface, such as, according to Section 3.2 of 3GPP TS 38.300 V 16.6.0 (2021-06), which is incorporated herein by reference.

[0086] gNB supports various protocol layers, such as Layer 1 (L1) - the physical layer, Layer 2 (L2) and Layer 3 (L3).

[0087] NR's Layer 2 (L2) is divided into the following sublayers: Media Access Control (MAC), Radio Link Control (RLC), Packet Data Convergence Protocol (PDCP), and Service Data Adaptation Protocol (SDAP), among which, for example: The physical layer provides a transmission channel to the MAC sublayer. The oMAC sublayer provides logical channels to the RLC sublayer; The oRLC sublayer provides RLC channels to the PDCP sublayer; The oPDCP sublayer provides radio bearers to the SDAP sublayer; The oSDAP sublayer provides Quality of Service (QoS) flows to the 5GC; The control channels include the Broadcast Control Channel (BCCH) and the Physical Control Channel (PCCH).

[0088] Layer 3 (L3) includes, for example, Radio Resource Control (RRC), as per Section 6 of 3GPP TS 38.300 V 16.6.0 (2021-06), which is incorporated herein by reference.

[0089] A gNB Central Unit (gNB-CU) includes, for example, a logical node that hosts, for example, the Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), and Packet Data Convergence Protocol (PDCP) protocols of the gNB, or hosts the RRC and PDCP protocols of an enhanced en-gNB, and controls the operation of one or more gNB Distributed Units (gNB-DUs). The gNB-CU terminates the F1 interface connected to the gNB-DU. The gNB-CU may also be referred to herein as a CU, Central Unit, Centralized Unit, or Control Unit.

[0090] A gNB Distributed Unit (gNB-DU) comprises, for example, a logical node hosting a gNB or en-gNB at the Radio Link Control (RLC), Media Access Control (MAC), and Physical (PHY) layers, and its operation is partially controlled by the gNB-CU. A gNB-DU supports one or more cells. A cell is supported by only one gNB-DU. The gNB-DU terminates the F1 interface connected to the gNB-CU. The gNB-DU may also be referred to herein as a DU or Distributed Unit.

[0091] The gNB-CU control plane (gNB-CU-CP) includes, for example, logical nodes that host the RRC and control plane portion of the gNB-CU's PDCP protocol, such as for en-gNB or gNB. The gNB-CU-CP terminates the E1 interface connected to the gNB-CU-User plane (gNB-CU-UP) and the F1-C interface connected to the gNB-DU.

[0092] The gNB-CU-User Plane (gNB-CU-UP) includes, for example, the user plane portion of the gNB-CU hosting the PDCP protocol for the en-gNB and the logical node hosting the user plane portion of the PDCP protocol for the gNB and the SDAP protocol for the gNB-CU. The gNB-CU-UP terminates the E1 interface connected to the gNB-CU-CP and the F1-U interface connected to the gNB-DU, for example, according to Section 3.1 of 3GPPTS 38.401 V 16.6.0 (2021-07), which is incorporated herein by reference.

[0093] As used herein, the term "network node" may refer to any one or any combination thereof of gNB, gNB-CU, gNB-DU, gNB-CU-CP, or gNB-CU-UP.

[0094] RAN (Radio Access Network) nodes or network nodes (such as, for example, gNB, gNB-CU, or gNB-DU, or portions thereof) can be implemented using means, for example, having at least one processor and / or at least one memory, the at least one memory having processor-readable instructions (“programs”) configured to support and / or provide and / or process CU and / or DU related functions and / or features and / or at least one protocol (sub)layer (e.g., layer 2 and / or layer 3) of the RAN (Radio Access Network). Different functional splits between central and distributed units are possible. The following will combine... Figure 6 Examples describing such devices and components.

[0095] The gNB-CU and gNB-DU portions can, for example, be co-located or physically separated. The gNB-DU can even be further divided into two parts, for example, one including processing equipment and the other including an antenna. The Central Unit (CU) can also be referred to as a Baseband Unit / Radio Equipment Controller / Cloud-RAN / Virtual-RAN (BBU / REC / C-RAN / V-RAN), Open-RAN (O-RAN), or a portion thereof. The Distributed Unit (DU) can also be referred to as a Remote Radio Head / Remote Radio Unit / Radio Equipment / Radio Unit (RRH / RRU / RE / RU), or a portion thereof. In the various exemplary embodiments of this disclosure below, a network node supporting at least one of the Central Unit functions or Layer 3 protocols of a radio access network can be, for example, a gNB-CU. Similarly, a network node supporting at least one of the Distributed Unit functions or Layer 2 protocols of a radio access network can be, for example, a gNB-DU.

[0096] A gNB-CU can support one or more gNB-DUs. A gNB-DU can support one or more cells, and therefore can support serving cells for user equipment (UE) or candidate cells for handover, dual connectivity and / or carrier aggregation and other procedures.

[0097] User equipment (UE) 150 may be or include wireless or mobile devices, devices having a radio interface for interacting with a RAN (Radio Access Network), smartphones, in-vehicle devices, IoT devices, or M2M devices, and other types of user equipment. Such a UE 150 may include: at least one processor; and at least one memory including program code; wherein the at least one memory and the computer program code are configured to use the at least one processor to cause the device to perform at least certain operations, such as, for example, an RRC connection to the RAN. Figure 6 Examples of components describing the UE are provided. In an embodiment, UE 150 may be configured to generate messages (e.g., including a cell ID) to be transmitted via radio toward the RAN (e.g., to reach and communicate with the serving cell). In an embodiment, UE 150 may generate, transmit, and receive RRC messages containing one or more RRC PDUs (Packet Data Units). Those skilled in the art will understand the RRC protocol and other processes that the UE may perform.

[0098] Continue to refer to Figure 1 In an example of a 5G NR network, network system 100 provides one or more cells that define the coverage area of ​​network system 100. As described above, network system 100 may include a gNB of the 5G NR network, or may include any other means configured to control radio communications and manage radio resources within the cell. As used herein, the term "resource" may refer to radio resources such as resource blocks (RBs), physical resource blocks (PRBs), radio frames, subframes, time slots, subbands, frequency regions, subcarriers, beams, etc. In embodiments, network node 120 may be referred to as a base station.

[0099] Figure 1 Examples are provided, and are merely illustrative of network system 100 and UE 150. Those skilled in the art will understand that network system 100 includes... Figure 1 Components not shown in the diagram, and it will be understood that other user equipment can communicate with network system 100.

[0100] Figure 2 yes Figure 1 A block diagram of example components of network system 100. A 5G NR network can be described as an example of network system 100, and the aspects described below are intended to apply to other types of network systems as well. The network system can be configured according to... Figure 1The signals and connections shown operate to enable UE 150 to communicate with network system 100 via radio access network 225. Additionally, the network system may be divided into user plane components and functions and control plane components and functions, as shown and described herein. Unless otherwise stated, the terms “component,” “function,” and “service” are used interchangeably herein and may refer to instructions executed by and implemented by one or more processors.

[0101] The following describes example functionality of the components. This example functionality is merely illustrative, and it should be understood that additional operations and functions can be performed by the components described herein. Additionally, connections between components can be virtual connections over service interfaces, allowing any component to communicate with any other component. In this way, any component can act as a service "producer" for any other component acting as a service "consumer" to provide services for network functionality.

[0102] For example, a core network 210 is described in the control plane of the network system. The core network 210 may include an Authentication Server Function (AUSF) 211, an Access and Mobility Management Function (AMF) 212, and a Session Management Function (SMF) 213. The core network 210 may also include a Network Slice Selection Function (NSSF) 214, a Network Exposure Function (NEF) 215, a Network Repository Function (NRF) 216, and a Unified Data Management Function (UDM) 217, which may include a Unified Data Repository (UDR) 224.

[0103] Additional components and functions of the core network 210 may include application functions 218, policy control functions (PCF) 219, network data analysis functions (NWDAF) 220, analytical data repository functions (ADRF) 221, management data analysis functions (MDAF) 222, and operation and management functions (OAM) 223.

[0104] The user plane includes UE 150, Radio Access Network (RAN) 225, User Plane Function (UPF) 226, and Data Network (DN) 227. RAN 225 may include a combination of Figure 1 The RAN 225 describes one or more components, such as one or more network nodes. However, the RAN 225 may not be limited to such components. The UPF 226 provides connectivity for data transmitted through the RAN 225. For example, the DN 226 identifies services from service providers, internet access, and third-party services.

[0105] AMF 212 handles connectivity and mobility tasks. AUSF 211 receives authentication requests from AMF 212 and interacts with UDM 217 to authenticate and verify network responses to determine successful authentication. SMF 213 performs Packet Data Unit (PDU) session management and manages session context with UPF 226.

[0106] NSSF 214 can select a Network Slice Instance (NSI) and determine the allowed Network Slice Selection Auxiliary Information (NSSAI). This selection and determination are used to set up AMF 212 to provide services to UE 150. NEF 215 protects access to third-party network services to create private network services. NRF 216 acts as a repository for storing network functions to allow functions to register and discover each other.

[0107] UDM 217 generates authentication vectors for use by AUSF 211 and ADM 212 and provides user identity processing. UDM 217 can connect to UDR 224, which stores data associated with authentication, applications, etc. AF 218 provides application services (e.g., streaming services) to users. PCF 219 provides policy control functions. For example, PCF 219 can assist in network slicing and mobility management, as well as provide Quality of Service (QoS) and accounting functions.

[0108] NWDAF 220 collects data (e.g., from UE 150 and network systems) to perform network analytics and provide insights into the capabilities that utilize analytics when providing services. ADRF 221 allows consumers to store, retrieve, and remove data and analytics. MDAF 222 provides additional data analytics services for network functions. OAM 223 provides provisioning and management processing capabilities for managing components in or connected to the network (e.g., UE 150, network nodes, etc.).

[0109] Figure 2 These are merely examples of components of a network system, and variations are contemplated within the scope of this disclosure. In embodiments, the network system may include... Figure 2 Other components not shown. In embodiments, the network system may not include... Figure 2 Each component is shown. In an embodiment, components and connections can be used with... Figure 2 The connections shown are implemented using different connections. These and other embodiments are contemplated within the scope of this disclosure.

[0110] As described above, this disclosure addresses the obfuscation of data to be input into a third-party machine learning system without degrading the performance of the machine learning system. In this scenario, when the original data or obfuscated data is input into the machine learning system, the third-party machine learning system will provide the desired output. In various embodiments, when the original data or obfuscated data is input into the machine learning system, the third-party machine learning system can provide the same output or substantially the same output.

[0111] For example, in various embodiments, the third-party machine learning system may include a large language model, and the raw data to be input to the large language model may be input prompts for the large language model. The individual or entity that generates the input prompts may wish to prevent the input prompts from being freely exposed to the third-party system. As another example, in various embodiments, the third-party machine learning system may include a convolutional neural network, and the raw data to be input to the convolutional neural network may be an image. The owner of the image may wish to prevent the image from being freely exposed to the third-party system. These examples are for illustrative purposes only, and other embodiments are contemplated within the scope of this disclosure.

[0112] In various embodiments, aspects of this disclosure can be implemented in a user equipment, such as in conjunction with Figure 1 and Figure 2 The user equipment described. In various embodiments, aspects of this disclosure are implemented in a network by one or more network functions, such as in combination with Figure 2 The network functions described. These aspects and embodiments will be combined with Figures 3 to 8 To describe. In summary, Figure 3 and Figure 4 The operation used to obfuscate the original data is shown; Figure 5 An example of obfuscated data is provided, which is formed by combining the original data with additional data; Figure 6 and Figure 7 A method for generating obfuscated data is shown, and Figure 8 Another method for generating obfuscated data is illustrated. In the following description, the terms "obfuscated data" and "additional data" are used interchangeably to refer to data combined with the original data to form obfuscated data. As mentioned above, in various embodiments, the obfuscated data may be incomprehensible to humans.

[0113] Figure 3 This is a diagram illustrating an example of an operation used to obfuscate data to be input into a machine learning system. Figure 3A client system 302 and a third-party system 304 are illustrated, wherein the client system 302 uses the services of the third-party system 304. In various embodiments, the client system 302 may be a UE (User Equipment), and the third-party system 304 may be a network, such as a core network. In various embodiments, the client system 302 may be a first network, and the third-party system 304 may be a second network or other service provider. Other embodiments are also contemplated within the scope of this disclosure.

[0114] Client system 302 includes a scrambled data generator 310 and storage 320 for scrambled data of a relevant input size. Third-party system 304 includes a machine learning system 360. For simplicity, other components of client system 302 and third-party system 304, such as processors and memory, are not shown. These components will be recognized by those skilled in the art.

[0115] Obfuscated data generator 310 generates obfuscated data with specific attributes. Specifically, as shown in operation 335, obfuscated data (denoted as z) is combined with original data (denoted as x) to provide obfuscated data (denoted as x+z). Although the combination operation 335 is shown as an addition, various ways of combining original data x and obfuscated data z are contemplated within the scope of this disclosure, such as XOR operations. Obfuscated data z is operated such that when either original data x or obfuscated data x+z is input to machine learning system 360, machine learning system 360 will produce the desired output. In various embodiments, when either original data x or obfuscated data x+z is input to machine learning system 360, machine learning system 360 may produce the same output or substantially the same output. According to aspects of this disclosure, obfuscated data x+z may be normalized such that it falls within a range of permissible values ​​for x. In various embodiments, the obfuscated data generator 310 may be a machine learning model that combines... Figure 6 and Figure 7The following description is provided. In such cases, a random vector (denoted as r) can be input to the obfuscation data generator 310 to generate multiple obfuscated data z. In various embodiments, the random vector r can have the same cardinality as the data to be obfuscated. For example, if the data to be obfuscated is a two-dimensional image with n pixels, the random vector r can have n values. As another example, the data to be obfuscated can be a text input prompt for a Large Language Model (LLM). If the text input prompt has n characters, the random vector r can have n values. In various embodiments, the cardinality of the random vector r can be different from the cardinality of the data to be obfuscated. For example, in the case of an input prompt for an LLM, the input prompt can have m characters, but the random vector r can have n characters, where n > m. Such and other embodiments are contemplated within the scope of this disclosure.

[0116] In various embodiments, the obfuscated data generator 310 can be a technique that uses the kernel of the first layer of a neural network to generate obfuscated data, which will combine... Figure 8 The following description is provided. In this case, the obfuscated data generator 310 may not need to receive a random vector as input. Multiple obfuscated data can be stored in the obfuscated data storage 320, which can be of any type.

[0117] like Figure 3 As shown, the obfuscated data x+z can be encrypted by the client system 302 (340), and the encrypted obfuscated data (denoted as E(x+z)) can be transmitted by the client system 302 to the third-party system 304. The third-party system 304 can decrypt the received encrypted data (350) to recover the obfuscated data x+z, and the obfuscated data x+z can be input into the machine learning system 360. The output of the machine learning system 360 (not shown) can be transmitted back to the client system 302 by the third-party system 304.

[0118] The following will describe the process from the perspective of the client system (which may be a user equipment (UE)). Figure 3 The operation, from the perspective of the client system, includes: accessing raw data and supplementary data; combining the raw data and supplementary data to provide obfuscated data; transmitting the obfuscated data to a trained machine learning system, wherein the trained machine learning system provides a desired output based on the received raw data or obfuscated data as input; and receiving the result of inputting the obfuscated data into the trained machine learning system.

[0119] The description will now be from the perspective of a third-party system (which could be a network device). Figure 3From the perspective of a third-party system, one method includes: receiving obfuscated data, which includes original data combined with additional data; inputting the obfuscated data into a trained machine learning system, wherein the trained machine learning system provides a desired output based on the received original data or obfuscated data as input; and transmitting the results of inputting the obfuscated data into the trained machine learning system.

[0120] Figure 3 The boxes and operations are for illustrative purposes only, and variations are contemplated within the scope of this disclosure. In embodiments, the boxes and operations may include... Figure 3 Other boxes and operations not shown in the diagram. In embodiments, boxes and operations may not be... Figure 3 Each box or operation shown includes [specific examples]. Those skilled in the art will understand that while various example components are described to perform various functions, other components can perform [other functions]. Figure 3 The functions described herein. Such embodiments and other embodiments are contemplated within the scope of this disclosure.

[0121] Figure 4 This is a diagram illustrating examples of network operations used to obfuscate input data from a user equipment (UE) to a third-party machine learning system. In various embodiments, Figure 4 The components shown can correspond to the combination Figure 1 and Figure 2 Similar components as described.

[0122] Figure 4 The operation involves the user interface (UE), network systems, and third-party machine learning (ML) systems. The network system is a trusted system that provides ML models, and it may require services from third-party ML systems. In summary, the network system can operate to obfuscate data to be transmitted to third-party systems.

[0123] At operation 410, the UE transmits encrypted data to be input into the machine learning model or system to the network system, and the network system receives the encrypted data from the UE.

[0124] At operation 420, the network system decrypts the encrypted data to produce the UE's data, which can be referred to as the raw data.

[0125] At operation 430, the network system determines whether a third-party ML system is needed. Figure 4 The process assumes that the network system determines that a third-party ML system is needed.

[0126] At operation 440, the network system combines the original data with additional / obfuscated data to generate obfuscated data. The obfuscated data can be combined by the network system with... Figure 3 They are generated and stored in the same manner. Network systems can combine raw data with additional data in various ways.

[0127] At operation 450, the network system encrypts the obfuscated data and transmits the encrypted obfuscated data to a third-party ML system, which then receives the encrypted obfuscated data from the network system.

[0128] At operation 460, a third-party ML system decrypts the encrypted and obfuscated data to recover the obfuscated data.

[0129] At operation 470, obfuscated data is fed into the ML model of a third-party ML system, and the ML model provides an output, which can be called inference.

[0130] At operation 480, the third-party ML system transmits the output / inference to the network system, and the network system receives the output / inference from the third-party ML system. Subsequently, the network system transmits the output / inference to the UE, and the UE receives the output / inference from the network system. During the transmission in operation 480, the output / inference can be encrypted.

[0131] Accordingly, in Figure 4 During operation, the network system can perform operations to obfuscate the data to be transmitted to a third-party ML system.

[0132] Figure 4 The operations described are for illustrative purposes only, and variations are contemplated within the scope of this disclosure. In embodiments, the operations may include... Figure 4 Other operations not shown. In the embodiment, the operation may not be... Figure 4 Each operation shown includes [the specific operations described]. In embodiments, the operations may be performed in a manner different from [other procedures]. Figure 4 The sequence shown is as follows. Those skilled in the art will understand that although various example components are described to perform various functions, other components may perform different functions. Figure 4 The functions described herein. Such embodiments and other embodiments are contemplated within the scope of this disclosure.

[0133] Figure 5 These are diagrams illustrating two examples of combining original data with additional data to generate obfuscated data. In the first example, original data 510 is an image displaying the digit "2". Original data 510 is combined with additional / obfuscated data 520, which is rendered as incomprehensible pixels. Although the combination is shown as an additive process, other combination techniques are contemplated within the scope of this disclosure. The result of the combination is obfuscated data 530, in which the digit "2" is no longer recognizable. Therefore, obfuscated data 530 is no longer incomprehensible to humans.

[0134] In the second example, the original data 540 is an image displaying the digit "4". The original data 540 is combined with additional / obfuscated data 550, which is rendered as incomprehensible pixels. The result of this combination is obfuscated data 560, in which the digit "4" is no longer recognizable. Therefore, obfuscated data 560 is no longer understandable to humans.

[0135] Figure 5 The examples provided are for illustrative purposes only. In various embodiments, the original data may be text input prompts to be input into a large language model, and the additional / obfuscated data may also be text. Text input prompts and additional / obfuscated data may be combined in various ways, such as, but not limited to, concatenating characters from the input prompts with characters from the additional data. Other types of original data, additional data, and combination techniques are also contemplated within the scope of this disclosure.

[0136] Now will describe Figures 6 to 8 As mentioned above, Figure 6 and Figure 7 A method for generating obfuscated data is shown, and Figure 8 Another method for generating obfuscated data is shown.

[0137] Figure 6 This is a diagram illustrating an example of training a garbled data generator using a machine learning system based on shared gradient information. See also: Figure 3 This illustrates the obfuscated data generator 310 and the third-party ML system 360.

[0138] In summary, the obfuscated data generator 310 is a generative model that can learn from the ML model of a third-party system 360 to generate multiple obfuscated data z with the aforementioned properties. This operation requires training data x, corresponding training labels / ground information y, and a loss function L(y, y'), where y' is the result of inputting the training data x into the ML model of the third-party system 360.

[0139] In various embodiments, the obfuscated data generator 310 is a neural network, which may be referred to as a key generator (CKG). A random vector r drawn from a set U(S) of uniformly distributed random vectors can be input into the obfuscated data generator 310. The output of the obfuscated data generator 310—obfuscated data z—is combined with training data x to form obfuscated data x+z, which is transmitted (encrypted or unencrypted) to a third-party ML system 360. At the third-party system 360, the obfuscated data x+z is input into an ML model, which outputs y'. A loss function L(y, y') is then evaluated. In various embodiments, x and z have the same size, and r may have a different size than x and z. According to aspects of this disclosure, the obfuscated data x+z can be normalized such that it falls within a range of permissible values ​​for x.

[0140] The ML model of the third-party system 360 will not be trained further, and its weights are frozen and inaccessible. The third-party system can be considered as a loss function used to obfuscate the data generator 310. Training only requires the ML model of the third-party system 360 to compute gradients based on the loss function and training label / ground information. Those skilled in the art will understand how to compute such gradients.

[0141] Based on gradients from a third-party system 360, the obfuscated data generator 310 can be adjusted during training iterations to reduce the gradients until the training conditions are met. In various embodiments, training can be completed in several iterations for each modality and dataset size / shape.

[0142] Figure 7 This is a diagram illustrating examples of signals and operations used in machine learning systems based on shared gradient information to train a garbled data generator. In various embodiments, Figure 7 The components shown can correspond to the combination Figure 1 and Figure 2 Similar components as described above. Figure 7 The operation involves both the UE and the network system. The network system provides an ML model for generating gradients, such as combining... Figure 6 As stated above.

[0143] At operation 710, the UE transmits a training request to the network system, and the network system receives the training request from the UE.

[0144] At operation 720, the UE prepares training data x and corresponding training labels / ground information y. The training data x can be distributed in a manner similar to the model's area of ​​expertise, or it can be synthetic data from the UE.

[0145] At operation 730, the UE transmits training labels y to the network system, and the network system receives training labels y from the UE. The training labels may be transmitted to the network system in a certain way (e.g., in a certain order) so that they are associated with training data to be transmitted to the network system later.

[0146] At operation 740, the UE begins to combine Figure 6 The described method for training the obfuscated data generator includes generating obfuscated data z based on a random vector r as input, and combining training data x with the obfuscated data z to produce multiple obfuscated data x+z. In various embodiments, the training data x and the obfuscated data z may be combined via an XOR operation (and other possible methods). According to aspects of this disclosure, the obfuscated data x+z may be normalized such that it falls within a range of permissible values ​​for x.

[0147] At operation 750, the UE transmits multiple obfuscated data x+z to the network system to be input into the network system's ML model, and the network system receives multiple obfuscated data x+z from the UE.

[0148] At operation 760, multiple obfuscated data x+z are input into the ML model of the network system, and the ML model performs forward propagation computation and calculates gradients based on training labels / ground information y and loss function L(y, y').

[0149] At operation 770, the network system transmits gradient information to the UE, and the UE receives gradient information from the network system. The UE uses the gradient information to perform backpropagation and adjust the scrambled data generator.

[0150] At operation 780, the training process of operations 710-770 is repeated until the training conditions are met, such as the loss or gradient being below a threshold.

[0151] Accordingly, in Figure 7 During operation, the UE and the network system can collaborate to train the UE's obfuscated data generator.

[0152] Now we will describe it from the UE's perspective. Figure 7 The operation, from the UE's perspective, includes: generating supplementary data from a machine learning model; combining training data with the supplementary data to provide obfuscated data; transmitting the obfuscated data and training labels to a trained machine learning system; receiving gradients from the trained machine learning system regarding the loss function and training labels, which are obtained by inputting the obfuscated data into the trained machine learning system; and adjusting the machine learning model based on these gradients. Training of the machine learning model is repeated until training conditions are met.

[0153] Now we will describe it from the perspective of network systems. Figure 7 The operation, from the perspective of the network system, includes: receiving obfuscated data and training labels, the obfuscated data including training data combined with additional data, wherein the training labels correspond to the training data; providing gradients with respect to a loss function and training labels by a trained machine learning system, the gradients being obtained by feeding the obfuscated data into the trained machine learning system; and transmitting the gradients to a system configured to train a machine learning model for generating additional data.

[0154] Figure 7 The operations described are for illustrative purposes only, and variations are contemplated within the scope of this disclosure. In embodiments, the operations may include... Figure 7 Other operations not shown. In the embodiment, the operation may not be... Figure 7 Each operation shown includes [the specific operations described]. In embodiments, the operations may be performed in a manner different from [other procedures]. Figure 7 The sequence shown is as follows. Those skilled in the art will understand that although various example components are described to perform various functions, other components may perform different functions. Figure 7 The functions described herein. Such embodiments and other embodiments are contemplated within the scope of this disclosure.

[0155] As mentioned above, Figure 8 Another method for generating obfuscated data is shown. This method operates to find obfuscated data by accessing the kernels of the first layer of the neural network. Accordingly, Figure 8 This is a diagram illustrating an example of an operation used to generate obfuscated data based on the kernel of the first layer of a neural network.

[0156] The description of this method involves various notations. The original data is denoted as x, the confused data as z, the ML model as F(), and the truth information as y. The goal is to find z ≠ 0 such that F(x+z) = F(x) = y.

[0157] A neural network can be represented as:

[0158] in, It is a nonlinear function at layer n (e.g., ReLU). It is a linear function at layer n.

[0159] Lemma 1: Observe the first layer L1. If the above decomposition for F holds, and if there exists Make ,but Established.

[0160] Lemma 2: Assume the above decomposition holds for F. If Give and Make ,but .

[0161] Based on Lemmas 1 and 2, if the weight matrix of the first layer of a third-party ML model can be accessed, then the set By finding the matrix The null space is used to determine this. This holds especially true for the first layer of a fully connected, dense structure.

[0162]

[0163]

[0164] =

[0165]

[0166] The following is possible: When implementing this method, a third-party ML system may not share details of its neural network or the first layer of the neural network for confidentiality reasons. According to aspects of this disclosure, the third-party system may alternatively share the kernel Ker(L1) of the first layer.

[0167] Continue to refer to Figure 8 , Figure 8 The components shown can correspond to the combination Figure 1 and Figure 2 Similar components as described. Figure 8 The operation involves the UE and the network system. The network system provides the neural network and the kernel of the first layer of the neural network.

[0168] At operation 810, the UE transmits a request for the kernel of the first layer of the neural network (NN) to the network system, and the network system receives the request from the UE.

[0169] At operation 820, the network system computes the kernel of the first layer of the NN.

[0170] At operation 830, the network system transmits the first-layer kernel of the NN to the UE, and the UE receives the first-layer kernel of the NN from the network system.

[0171] At operation 840, the UE uses the kernel of the first layer of the NN to generate multiple obfuscated data z.

[0172] At operation 850, the UE randomly selects obfuscated data z from a plurality of obfuscated data for each original data x to be transmitted. In various embodiments, the random selection of obfuscated data is independent of and does not depend on the original data x.

[0173] At operation 860, the UE combines the original data x with the selected obfuscated data z to form obfuscated data x+z.

[0174] At operation 870, the UE transmits obfuscated data x+z (encrypted or unencrypted) to the network system, and the network system receives obfuscated data x+z from the UE.

[0175] At operation 880, the network system inputs the obfuscated data x+z into the ML model, and the ML model produces output / inference.

[0176] At operation 890, the network system transmits output / inference (encrypted or unencrypted) to the UE, and the UE receives the output / inference from the network system.

[0177] Now we will describe it from the UE's perspective. Figure 8 The operation, from the UE's perspective, includes: receiving the kernel of a first layer of a trained neural network system, wherein the first layer kernel is non-empty; generating additional data based on the kernel of the first layer of the trained neural network system, the additional data being configured such that the trained neural network system produces a desired output based on either: inputting raw data into the trained neural network system, or inputting obfuscated data into the trained neural network system, the obfuscated data including the raw data combined with the additional data; and storing the additional data for providing the obfuscated data.

[0178] Now we will describe it from the perspective of network systems. Figure 8 The operation, from the perspective of the network system, includes: receiving a request for the kernel of the first layer of a trained neural network system, wherein the kernel of the first layer of the trained neural network system is non-empty; computing the kernel of the first layer of the trained neural network system; and transmitting the kernel of the first layer of the trained neural network system.

[0179] Figure 8 The operations described are for illustrative purposes only, and variations are contemplated within the scope of this disclosure. In embodiments, the operations may include... Figure 8 Other operations not shown. In the embodiment, the operation may not be... Figure 8 Each operation shown includes [the specific operations described]. In embodiments, the operations may be performed in a manner different from [other procedures]. Figure 8 The sequence shown is as follows. Those skilled in the art will understand that although various example components are described to perform various functions, other components may perform different functions. Figure 8 The functions described herein. Such embodiments and other embodiments are contemplated within the scope of this disclosure.

[0180] Figure 9 This is a diagram of an example block diagram of components of an apparatus according to one aspect of this disclosure.

[0181] Now for reference Figure 9 This diagram illustrates a block diagram of example components of a user equipment, network system, client system, or third-party ML system, or any system disclosed herein. The system includes electronic storage 910, a processor 920, a network interface 930, and memory 940. The various components can be communicatively coupled to each other. Processor 920 can be and may include any type of processor, such as a single-core central processing unit (CPU), a multi-core CPU, a microprocessor, a digital signal processor (DSP), a system-on-a-chip (SoC), or any other type of processor. Memory 940 can be a volatile type of memory (e.g., RAM) or a non-volatile type of memory (e.g., NAND flash memory). Memory 940 includes machine-readable instructions executable by processor 920 to cause the device to perform various operations, including those described above.

[0182] Electronic storage 910 can be and includes any type of electronic storage for storing data, such as hard disk drives, solid-state drives, and / or optical discs, as well as other types of electronic storage. Electronic storage 910 stores software instructions for enabling the device to perform its operations and storing data associated with such operations (such as storing data related to the 5G NR standard). Network interface 930 can implement wireless networking technologies such as LTE, 5G NR, Wi-Fi 6, and / or other wireless networking technologies.

[0183] Figure 9 The components shown are merely examples, and those skilled in the art will understand that the apparatus includes other components not shown, and may include any multiple of the components shown. These and other embodiments are contemplated within the scope of this disclosure.

[0184] Other embodiments of this disclosure include the following examples. Unless the context otherwise indicates, any component disclosed herein can be implemented by instructions executed by at least one processor. The symbol example nx refers to any value of n and any value of x specified in this application.

[0185] Example 1.1. A method comprising: Access raw and additional data; Combine the original data with additional data to provide obfuscated data; Obfuscated data is transmitted to a trained machine learning system, which, based on the received raw or obfuscated data as input, provides the desired output; and Receives the results of inputting obfuscated data into a trained machine learning system.

[0186] Example 1.2. The method described in Example 1.1 further includes: generating additional data using a trained machine learning model.

[0187] Example 1.3. The method according to Example 1.2, wherein the trained machine learning model generates additional data based on inputting random vectors from a predetermined set of random vectors into the trained machine learning model.

[0188] Example 1.4. The method according to any one of the preceding embodiments 1.x further includes: selecting additional data from a predetermined set of additional data.

[0189] Example 1.5. The method described in Example 1.4, wherein the additional data is randomly selected from a predetermined set of additional data.

[0190] Example 1.6. The method according to any one of the preceding Examples 1.x, wherein the original data and the supplementary data have the same cardinality.

[0191] Example 1.7. The method according to any one of the preceding Examples 1.x, wherein the original data and the random vector have the same cardinality.

[0192] Example 1.8. The method according to any one of the preceding Examples 1.x, wherein combining the original data with additional data to provide obfuscated data includes performing normalization.

[0193] Example 1.9. The method according to any one of the preceding Examples 1.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0194] Example 1.10. The method according to any one of the preceding Examples 1.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0195] Example 1.11. The method according to any one of the preceding Examples 1.x, wherein the trained machine learning system provides substantially the same output based on the received raw data or obfuscated data as input.

[0196] Example 1.12. The method according to any one of the preceding Examples 1.x, wherein the trained machine learning system is a third-party system.

[0197] Example 1.13. The method according to any one of the preceding Examples 1.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0198] Example 1.14. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by the at least one processor, cause the device to perform at least one of the methods described in any of the preceding Examples 1.x.

[0199] Example 1.15. The apparatus according to Example 1.14 further includes a trained machine learning model configured to generate additional data.

[0200] Example 1.16. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of a device, cause the device to perform at least the methods of any one of Examples 1.1 to 1.13.

[0201] Example 2.1. An apparatus comprising: Components used to access raw and additional data; A component used to combine raw data with additional data to provide obfuscated data; Components for transmitting obfuscated data to a trained machine learning system, wherein the trained machine learning system provides a desired output based on received raw or obfuscated data as input; and A component used to receive the results of inputting obfuscated data into a trained machine learning system.

[0202] Example 2.2. The apparatus according to Example 1.1 further includes: a component for generating additional data using a trained machine learning model.

[0203] Example 2.3. The apparatus according to Example 1.2, wherein the trained machine learning model generates additional data based on inputting random vectors from a predetermined set of random vectors into the trained machine learning model.

[0204] Example 2.4. The apparatus according to any one of the preceding Examples 2.x further includes: a component for selecting additional data from a predetermined set of additional data.

[0205] Example 2.5. The apparatus according to Example 1.4, wherein the additional data is randomly selected from a predetermined set of additional data.

[0206] Example 2.6. The apparatus according to any one of the preceding Examples 2.x, wherein the original data and the supplementary data have the same cardinality.

[0207] Example 2.7. The apparatus according to any one of the preceding Examples 2.x, wherein the original data and the random vector have the same cardinality.

[0208] Example 2.8. The apparatus according to any one of the preceding Examples 2.x, wherein combining the original data with additional data to provide obfuscated data includes performing normalization.

[0209] Example 2.9. The apparatus according to any one of the preceding Examples 2.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0210] Example 2.10. The apparatus according to any one of the preceding Examples 2.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0211] Example 2.11. The apparatus according to any one of the preceding Examples 2.x, wherein the trained machine learning system provides substantially the same output based on receiving raw data or obfuscated data as input.

[0212] Example 2.12. The apparatus according to any one of the preceding Examples 2.x, wherein the trained machine learning system is a third-party system.

[0213] Example 2.13. The apparatus according to any one of the preceding Examples 2.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0214] Example 3.1. A method comprising: Receive obfuscated data, which includes a combination of additional data and the original data; Obfuscated data is fed into a trained machine learning system, which, based on received raw or obfuscated data as input, provides the desired output; and The transmission takes the obfuscated data as input to the results of the trained machine learning system.

[0215] Example 3.2. The method described in Example 3.1, wherein the original data and the additional data have the same cardinality.

[0216] Example 3.3. The method according to any one of the preceding Examples 3.x, wherein the obfuscated data is normalized.

[0217] Example 3.4. The method according to any one of the preceding Examples 3.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0218] Example 3.5. The method according to any one of the preceding Examples 3.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0219] Example 3.6. The method according to any one of the preceding Examples 3.x, wherein the trained machine learning system provides substantially the same output based on the received raw data or obfuscated data as input.

[0220] Example 3.7. The method according to any one of the preceding Examples 3.x, wherein the obfuscated data is received from a third-party system.

[0221] Example 3.8. The method according to any one of the preceding Examples 3.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0222] Example 3.9. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the device to perform at least one of the methods described in any of the foregoing examples.

[0223] Example 3.10. The apparatus according to Example 3.9 further includes a trained machine learning system, wherein the trained machine learning system provides a desired output based on received raw data or obfuscated data as input.

[0224] Example 3.11. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of the device, cause the device to perform at least the methods of any one of Examples 3.1 to 3.8.

[0225] Example 4.1. A method comprising: Receive obfuscated data, which includes a combination of additional data and the original data; Obfuscated data is fed into a trained machine learning system, which, based on received raw or obfuscated data as input, provides the desired output; and The transmission takes the obfuscated data as input to the results of the trained machine learning system.

[0226] Example 4.2. The method described in Example 4.1, wherein the original data and the additional data have the same cardinality.

[0227] Example 4.3. The method according to any one of the preceding Examples 4.x, wherein the obfuscated data is normalized.

[0228] Example 4.4. The method according to any one of the preceding Examples 4.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0229] Example 4.5. The method according to any one of the preceding Examples 3.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0230] Example 4.6. The method according to any one of the preceding Examples 4.x, wherein the trained machine learning system provides substantially the same output based on the received raw data or obfuscated data as input.

[0231] Example 4.7. The method according to any one of the preceding Examples 4.x, wherein the obfuscated data is received from a third-party system.

[0232] Example 4.8. The method according to any one of the preceding Examples 4.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0233] Example 5.1. A method comprising: Access the training data and the corresponding training labels; Training is configured to generate a machine learning model with additional data. Training includes: Additional data is generated by machine learning models. Combine training data with additional data to provide obfuscated data. The obfuscated data and training labels are then transmitted to the trained machine learning system. The system receives gradients with respect to the loss function and training labels from a trained machine learning system. These gradients are obtained by feeding distorted data into the trained machine learning system. Adjusting machine learning models based on gradients The training of the machine learning model is repeated until the training conditions are met.

[0234] Example 5.2. The method described in Example 5.1, wherein the machine learning model generates additional data based on inputting random vectors from a predetermined set of random vectors into the machine learning model.

[0235] Example 5.3. The method described in Example 5.2, wherein the training data and the supplementary data have the same cardinality.

[0236] Example 5.4. The method according to any one of the preceding Examples 5.x, wherein the training data and the random vector have the same cardinality.

[0237] Example 5.5. The method according to any one of the preceding Examples 5.x, wherein combining training data with additional data to provide obfuscated data includes performing normalization.

[0238] Example 5.6. The method according to any one of the preceding Examples 5.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0239] Example 5.7. The method according to any one of the preceding Examples 5.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0240] Example 5.8. The method according to any one of the preceding Examples 5.x, wherein the trained machine learning system is a third-party system.

[0241] Example 5.9. The method according to any one of the preceding Examples 5.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0242] Example 5.10. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the device to perform at least one of the methods described in any of the foregoing examples.

[0243] Example 5.11. The apparatus according to Example 5.10 further includes a machine learning model configured to generate additional data.

[0244] Example 5.12. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of the device, cause the device to perform at least the methods of any one of Examples 5.1 to 5.9.

[0245] Example 6.1. An apparatus comprising: A component for accessing training data and the training labels corresponding to the training data; The components used for training a machine learning model configured to generate additional data include: Components used to generate additional data by machine learning models. A component used to combine training data with additional data to provide obfuscated data. Components used to transfer obfuscated data and training labels to a trained machine learning system. The component used to receive gradients from a trained machine learning system with respect to the loss function and training labels. These gradients are obtained by feeding scrambled data into the trained machine learning system. Components used to adjust machine learning models based on gradients. The training of the machine learning model is repeated until the training conditions are met.

[0246] Example 6.2. The apparatus according to Example 6.1, wherein the machine learning model generates additional data based on inputting random vectors from a predetermined set of random vectors into the machine learning model.

[0247] Example 6.3. The apparatus according to Example 6.2, wherein the training data and the supplementary data have the same cardinality.

[0248] Example 6.4. The apparatus according to any one of the preceding Examples 6.x, wherein the training data and the random vector have the same cardinality.

[0249] Example 6.5. The apparatus according to any one of the preceding Examples 6.x, wherein combining training data with additional data to provide obfuscated data includes performing normalization.

[0250] Example 6.6. The apparatus according to any one of the preceding Examples 6.x, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0251] Example 6.7. An apparatus according to any one of the preceding Examples 6.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0252] Example 6.8. The apparatus according to any one of the preceding Examples 6.x, wherein the trained machine learning system is a third-party system.

[0253] Example 6.9. The apparatus according to any one of the preceding Examples 6.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0254] Example 7.1. A method comprising: Receive obfuscated data and training labels. The obfuscated data includes a combination of additional data and training data, wherein the training labels correspond to the training data. The gradients with respect to the loss function and training labels are provided by a trained machine learning system; these gradients are obtained by feeding distorted data into the trained machine learning system. The gradients are transmitted to a system configured to train a machine learning model, which is then used to generate additional data.

[0255] Example 7.2. The method described in Example 7.1, wherein the training data and the supplementary data have the same cardinality.

[0256] Example 7.3. The method according to any one of the preceding Examples 7.x, wherein the obfuscated data is normalized.

[0257] Example 7.4. The method according to any one of the preceding Examples 7.x, wherein the trained machine learning system includes a large language model, and the training data are input prompts for the large language model.

[0258] Example 7.5. The method according to any one of the preceding Examples 7.x, wherein the trained machine learning system includes a convolutional neural network, and the training data is an image used as input to the convolutional neural network.

[0259] Example 7.6. The method according to any one of the preceding Examples 7.x, wherein the obfuscated data is received from a third-party system.

[0260] Example 7.7. The method according to any one of the preceding Examples 7.x, wherein the training data is human-understandable and the obfuscated data is human-incomprehensible.

[0261] Example 7.8. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the device to perform at least one of the methods described in any of the foregoing examples.

[0262] Example 7.9. The apparatus according to Example 7.8 further includes a trained machine learning system.

[0263] Example 7.10. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of the device, cause the device to perform at least the methods of any one of Examples 7.1 to 7.9.

[0264] Example 8.1. An apparatus comprising: A component for receiving obfuscated data and training labels, wherein the obfuscated data includes a combination of additional data and training data, and the training labels correspond to the training data; The component used by a trained machine learning system to provide gradients with respect to a loss function and training labels, the gradients being obtained by feeding scrambled data into the trained machine learning system; and This is used to transfer gradients to components of a system configured to train a machine learning model, which then generates additional data.

[0265] Example 8.2. The apparatus according to Example 8.1, wherein the training data and the supplementary data have the same cardinality.

[0266] Example 8.3. The apparatus according to any one of the preceding Examples 8.x, wherein the obfuscated data is normalized.

[0267] Example 8.4. The apparatus according to any one of the preceding Examples 8.x, wherein the trained machine learning system includes a large language model, and the training data are input prompts for the large language model.

[0268] Example 8.5. The apparatus according to any one of the preceding Examples 8.x, wherein the trained machine learning system includes a convolutional neural network, and the training data is an image used as input to the convolutional neural network.

[0269] Example 8.6. The apparatus according to any one of the preceding Examples 8.x, wherein the obfuscated data is received from a third-party system.

[0270] Example 8.7. The apparatus according to any one of the preceding Examples 8.x, wherein the training data is human-understandable and the obfuscated data is human-incomprehensible.

[0271] Example 9.1. A method comprising: Receive the kernel of the first layer of the trained neural network system, where the kernel of the first layer is non-empty; Additional data is generated based on the kernel of the first layer of the trained neural network system. This additional data is configured to cause the trained neural network system to produce the desired output based on any of the following: Input the raw data into a trained neural network system, or Obfuscated data is fed into a trained neural network system; the obfuscated data includes a combination of additional and original data. Store additional data to be used to provide obfuscated data.

[0272] Example 9.2. The method according to embodiment 9.1 further includes: Repeat the process of generating additional data to generate multiple sets of additional data; and Store multiple additional data items to provide obfuscated data.

[0273] Example 9.3. The method according to any one of the preceding Examples 9.x further includes: transmitting a request for the kernel of the first layer of the trained neural network system to the trained neural network system.

[0274] Example 9.4. The method according to any one of the preceding Examples 9.x, wherein the original data and the supplementary data have the same cardinality.

[0275] Example 9.5. The method according to any one of the preceding Examples 9.x, wherein the obfuscated data is normalized.

[0276] Example 9.6. The method according to any one of the preceding Examples 9.x, wherein the trained neural network system includes a large language model, and the raw data are input prompts for the large language model.

[0277] Example 9.7. The method according to any one of the preceding Examples 9.x, wherein the trained neural network system includes a convolutional neural network, and the original data is an image used as input to the convolutional neural network.

[0278] Example 9.8. The method according to any one of the preceding Examples 9.x, wherein the trained neural network system is a third-party system.

[0279] Example 9.9. The method according to any one of the preceding Examples 9.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0280] Example 9.10. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the device to perform at least one of the methods described in any of the foregoing examples.

[0281] Example 9.11. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of a device, cause the device to perform at least the methods of any one of Examples 9.1 to 9.9.

[0282] Example 10.1. An apparatus comprising: The component used to receive the kernel of the first layer of a trained neural network system, wherein the kernel of the first layer is non-empty; The component for generating additional data based on the kernel of the first layer of the trained neural network system, wherein the additional data is configured such that the trained neural network system produces the desired output based on any of the following: Input the raw data into a trained neural network system, or Obfuscated data is fed into a trained neural network system; the obfuscated data includes a combination of additional and original data. A component used to store additional data for providing obfuscated data.

[0283] Example 10.2. The apparatus according to Example 10.1 further includes: A component for repeating the generation of additional data to generate multiple additional data sets; and A component used to store multiple additional data to provide obfuscated data.

[0284] Example 10.3. The apparatus according to any one of the preceding embodiments 10.x further includes: a component for transmitting a request for a kernel of a first layer of the trained neural network system to the trained neural network system.

[0285] Example 10.4. The apparatus according to any one of the preceding Examples 10.x, wherein the original data and the supplementary data have the same cardinality.

[0286] Example 10.5. The apparatus according to any one of the preceding Examples 10.x, wherein the obfuscated data is normalized.

[0287] Example 10.6. The apparatus according to any one of the preceding Examples 10.x, wherein the trained neural network system includes a large language model, and the raw data is input prompt words for the large language model.

[0288] Example 10.7. The apparatus according to any one of the preceding embodiments 10.x, wherein the trained neural network system includes a convolutional neural network, and the raw data is an image for input into the convolutional neural network.

[0289] Example 10.8. The apparatus according to any one of the preceding Examples 10.x, wherein the trained neural network system is a third-party system.

[0290] Example 10.10. The apparatus according to any one of the preceding Examples 10.x, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

[0291] Example 11.1. A method comprising: Receive a request for the kernel of the first layer of a trained neural network system, wherein the kernel of the first layer of the trained neural network system is non-empty; Calculate the kernel of the first layer of the trained neural network system; and Transmit the kernel of the first layer of the trained neural network system.

[0292] Example 11.2. The method described in Example 11.1, wherein the trained machine learning system includes a large language model, and the raw data are input prompts for the large language model.

[0293] Example 11.3. The method according to any one of the preceding Examples 11.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0294] Example 11.4. The method according to any one of the preceding Examples 11.x, wherein the request for the kernel of the first layer of the trained neural network system is received from a third-party system.

[0295] Example 11.5. An apparatus comprising: At least one processor; and At least one memory storing instructions that, when executed by at least one processor, cause the device to perform at least one of the methods described in any of the foregoing examples.

[0296] Example 11.6. The apparatus according to Example 11.5 further includes a trained machine learning system.

[0297] Example 11.7. A non-transitory processor-readable medium having instructions stored thereon that, when executed by at least one processor of the device, cause the device to perform at least the method of any one of Examples 11.1 to 11.5.

[0298] Example 12.1. An apparatus comprising: A component for receiving requests for the kernel of the first layer of a trained neural network system, wherein the kernel of the first layer of the trained neural network system is non-empty; The component used to compute the kernel of the first layer of a trained neural network system; and A component used to transmit the kernel of the first layer of a trained neural network system.

[0299] Example 12.2. The apparatus according to Example 12.1, wherein the trained machine learning system includes a large language model, and the raw data is input prompts for the large language model.

[0300] Example 12.3. An apparatus according to any one of the preceding Examples 12.x, wherein the trained machine learning system includes a convolutional neural network, and the raw data is an image used as input to the convolutional neural network.

[0301] Example 12.4. The apparatus according to any one of the preceding Examples 12.x, wherein the request for the kernel of the first layer of the trained neural network system is received from a third-party system.

[0302] The examples and aspects disclosed herein are examples of this disclosure and may be embodied in various forms. For example, although some embodiments herein are described as separate embodiments, each of the embodiments herein may be combined with one or more of the other embodiments herein. The specific structural and functional details disclosed herein should not be construed as limiting, but rather serve as the basis for the claims and as a representative basis for teaching those skilled in the art to adopt this disclosure differently with virtually any suitable detailed structure. Throughout the description of the accompanying drawings, the same reference numerals may refer to similar or identical elements.

[0303] Although protocols such as 5G protocols may be described in various embodiments, those skilled in the art will understand that other protocols (e.g., 6G protocols) may be used for any of the operations and / or signaling described above, as well as their associated data, IE, messaging, etc.

[0304] The phrases “in one respect,” “in all respects,” “in various respects,” “in some respects,” or “in other respects” may each refer to one or more of the same or different respects under this disclosure. The phrase “multiple” may refer to two or more.

[0305] In various embodiments, the terms "first message" and "second message," as well as any subsequent messages, may refer to any message transmitted or received in sequence, and are not necessarily limited to any particular message.

[0306] The phrases “in an embodiment,” “in an embodiment,” “in various embodiments,” “in some embodiments,” or “in other embodiments” may each refer to one or more of the same or different embodiments according to this disclosure. A phrase of the form “A or B” means “(A), (B), or (A and B).” A phrase of the form “at least one of A, B, or C” means “(A); (B); (C); (A and B); (A and C); (B and C); or (A, B, and C).”

[0307] Any method, program, algorithm, or code described herein can be translated into or expressed in a programming language or computer program. As used herein, the terms "programming language" and "computer program" each include any language used to specify instructions to a computer, and include (but are not limited to) the following languages ​​and their derivatives: assembler, Basic, batch file, BCPL, C, C++, Delphi, Fortran, Java, JavaScript, machine code, operating system command languages, Pascal, Perl, PL1, Python, scripting languages, Visual Basic, meta-languages ​​that specify their own programs, and all first, second, third, fourth, fifth, or further generative computer languages. Databases and other data schemas, as well as any other meta-languages, are also included. There is no distinction between languages ​​that are interpreted, compiled, or use both compilation and interpretation methods. There is no distinction between a compiled version and a source version of a program. Therefore, a reference to a program in which a programming language may exist in more than one state (such as source, compilation, object, or linking) is a reference to any and all such states. A reference to a program may encompass the actual instructions and / or the intent of those instructions.

[0308] While various aspects of this disclosure have been shown in the accompanying drawings, they are not intended to be limited thereto, as the disclosure is intended to be as broad as will be permitted in the art, and the specification is read in the same manner. Therefore, the above description should not be construed as restrictive, but merely as an example of particular aspects. Other modifications within the scope and spirit of the appended claims will be contemplated by those skilled in the art.

Claims

1. A method for model training, comprising: Access the training data and the training labels corresponding to the training data; Training is a machine learning model configured to generate additional data, the training comprising: Additional data is generated by the machine learning model. The training data is combined with the additional data to provide obfuscated data. The obfuscated data and the training labels are then transmitted to the trained machine learning system. The trained machine learning system receives gradients with respect to the loss function and the training labels, the gradients being obtained by feeding the obfuscated data into the trained machine learning system. The machine learning model is adjusted based on the gradient. The training of the machine learning model is repeated until the training conditions are met.

2. The method according to claim 1, The additional data is generated by inputting random vectors from a predetermined set of random vectors into the machine learning model.

3. The method of claim 2, wherein the training data and the supplementary data have the same cardinality.

4. The method according to any one of claims 1 to 3, wherein the training data and the random vector have the same cardinality.

5. The method according to any one of claims 1 to 3, wherein combining the training data with the additional data to provide the obfuscated data includes performing normalization.

6. The method according to any one of claims 1 to 3, wherein the trained machine learning system includes a large language model, and the raw data is input prompt words for the large language model.

7. The method according to any one of claims 1 to 3, wherein the trained machine learning system comprises a convolutional neural network, and the raw data is an image for input into the convolutional neural network.

8. The method according to any one of claims 1 to 3, wherein the trained machine learning system is a third-party system.

9. The method according to any one of claims 1 to 3, wherein the original data is human-understandable and the obfuscated data is human-incomprehensible.

10. An apparatus for model training, comprising: At least one processor; as well as At least one memory storing instructions that, when executed by the at least one processor, cause the apparatus to perform at least the method according to any one of the preceding claims.

Images