A neural network layer boundary obfuscation method and system based on adaptive tile division
By using adaptive tile partitioning and address reordering techniques, neural network layers are dynamically divided into virtual sub-layers. Combined with ping-pong pipelined computation, this solves the problem that NPU layer boundary information is vulnerable to reverse engineering attacks, thus improving security and performance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- YUANQIXIN (SHANDONG) SEMICONDUCTOR TECHNOLOGY CO LTD
- Filing Date
- 2026-02-11
- Publication Date
- 2026-06-02
Smart Images
Figure CN122133119A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and to a method and system for confusing neural network layer boundaries based on adaptive tile partitioning. Background Technology
[0002] Currently, with the rapid development of information technology, Neural Processing Units (NPUs), as core components for accelerating artificial intelligence (AI), have been widely applied in various fields such as edge computing, cloud computing, autonomous driving, and intelligent security. Through a highly parallel computing architecture, NPUs have specifically optimized the inference and training processes of neural network models, greatly improving the speed and efficiency of data processing. However, with the deepening and widespread application of NPUs, their security issues have become increasingly prominent, becoming one of the key factors restricting the further development of AI technology.
[0003] Neural network models involve a large amount of sensitive data and model parameters during training and inference. The leakage or malicious alteration of this data poses a serious threat to personal privacy, corporate secrets, and even national security. Especially in edge computing environments, NPUs are typically deployed on resource-constrained terminal devices, making them more vulnerable to physical and side-channel attacks. Attackers can monitor data access patterns between the NPU and off-chip memory, such as address sequences and read / write timings, and leverage the write-after-read dependencies between layers to reverse engineer the confidential structure of the neural network model, including the number of layers, parameters for each layer, and connection methods. This reverse engineering attack not only infringes on the intellectual property rights of model developers but may also provide attackers with an entry point for further system attacks.
[0004] To address the security threats facing NPUs, researchers have proposed various defense strategies. One effective method is Oblivious RAM (ORAM), which obfuscates memory access patterns to prevent attackers from inferring sensitive information by observing memory access sequences. However, ORAM incurs significant performance overhead in practical applications, including increased computational complexity and memory bandwidth requirements, which is often unacceptable in large-scale neural network applications. Another common defense strategy is layer mixing, which increases the difficulty for attackers to reverse engineer by altering the execution order of neural network layers or merging layers. However, this approach is difficult to implement effectively in the fixed computational patterns of NPUs, as NPUs are typically optimized for specific neural network layer structures and data flows. Simple layer mixing can lead to a significant decrease in computational efficiency or even prevent correct execution.
[0005] Given the limitations of existing defense solutions, there is an urgent need for a layer boundary obfuscation scheme that can be naturally embedded into the existing NPU computing architecture while possessing low overhead and high efficiency. This scheme should be able to effectively obfuscate the true layer boundary information that attackers rely on for analysis without introducing significant performance loss, thereby protecting the confidential structure of the neural network model from being leaked.
[0006] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention
[0007] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.
[0008] This disclosure provides a method and system for obfuscating neural network layer boundaries based on adaptive tile partitioning. Utilizing the inherent tile computation process of the NPU, a complete network layer is adaptively divided into multiple virtual sub-layers in time and space through hardware logic, thereby thoroughly obfuscating layer boundary information observable by attackers. This method not only naturally integrates into the NPU's computational architecture but also achieves efficient and low-overhead layer boundary obfuscation through dynamic partitioning and address reordering techniques, providing strong protection for secure NPU computation.
[0009] In some embodiments, the method includes: Receive the feature map parameters and weight parameters of the current neural network layer; The computational unit Tile based on NPU is used as the partitioning granularity. According to the feature map parameters and weight parameters, the current layer is dynamically divided into n virtual sub-layers. The computations of each virtual sublayer are scheduled and executed sequentially. When executing the i-th sub-layer, the data required by the (i+1)-th sub-layer is prefetched and cached in the sub-layer buffer to achieve pipelined computation. Non-contiguous physical storage addresses are dynamically generated for the output data of each virtual sublayer, and the output data is written to the corresponding addresses.
[0010] Preferably, n is a natural number greater than 1, and the number of partitions varies with the feature map parameters and the weight parameters; The number n of virtual sub-layers satisfies the following constraint: , in, This represents the number of tiles contained in the input feature map. The weight contains the number of tiles. This represents the number of tiles contained in the output feature map.
[0011] Preferably, the specific method for dynamically generating non-contiguous physical storage addresses is as follows: By randomly allocating memory addresses for each sub-layer output through the address reordering module, the continuous storage pattern of data in memory is broken.
[0012] Preferably, the NPU maintains an internal address mapping table that records the correspondence between logical addresses and randomized physical addresses, which is used for data addressing between the NPU and the CPU.
[0013] Preferably, the address mapping table is stored in the NPU's internal RAM and cannot be accessed via an external bus.
[0014] In some embodiments, the neural network layer boundary obfuscation system based on adaptive tile partitioning includes: The adaptive partitioning module receives feature map parameters and weight parameters, and dynamically partitions the current layer into multiple virtual sub-layers with Tile as the granularity. The control module is used to schedule the execution order of each virtual sublayer and control the data transport unit to read the corresponding sublayer data; The address reordering module is used to dynamically generate non-contiguous physical addresses for the output of each virtual sublayer. The sub-layer buffer module is used to prefetch and cache the data of the next sub-layer while executing the current sub-layer.
[0015] Preferably, the adaptive partitioning module partitions the input feature map, weights, and output features. Figure 3 The number of tiles contained within the layer dynamically determines the number of sublayers.
[0016] Preferably, it also includes an address mapping table storage unit, located in the internal RAM of the NPU, for storing the mapping relationship between logical addresses and randomized physical addresses.
[0017] Preferably, when the first virtual sublayer is executed, data from another virtual sublayer is read simultaneously and stored in the sublayer cache module to achieve ping-pong pipelined operation.
[0018] In some embodiments, the computer-readable storage medium stores a computer program that, when executed by a processor, implements the novel grid-based renewable energy transient reactive power support strategy and tuning method.
[0019] The present disclosure provides a neural network layer boundary obfuscation method and system based on adaptive tile partitioning, which can achieve the following technical effects: The adaptive tile partitioning technique of this invention dynamically divides a complete network layer into multiple virtual sublayers in time and space, and scrambles their execution order and storage addresses, thoroughly obfuscating the layer boundary information observable by attackers. This innovative obfuscation mechanism makes it difficult for attackers to obtain the sensitive structure of the model through traditional reverse engineering methods, thereby significantly enhancing the security of the NPU computation process.
[0020] The adaptive tile partitioning module of this invention possesses high dynamism and flexibility. It dynamically partitions virtual sub-layers based on the feature map parameters and weight parameters of the current layer, using the tile as the basic unit of NPU computation. This dynamic partitioning mechanism ensures that the number of virtual sub-layers is different each time, further increasing the difficulty for attackers to reverse engineer the model. Simultaneously, the address reordering module dynamically generates non-contiguous physical storage addresses for the output data of each virtual sub-layer, disrupting the continuity and predictability of data in memory. This combination of dual obfuscation mechanisms significantly enhances the obfuscation effect, making it virtually impossible for attackers to reverse engineer the neural network model's structure by observing memory addresses or execution order.
[0021] The sublayer buffer design of this invention implements ping-pong pipelined computation. When computing the i-th sublayer, the system prefetches and caches the data required for the (i+1)-th sublayer. This prefetching mechanism reduces data access waiting time and improves data transfer efficiency. Simultaneously, through ping-pong operations (i.e., while one sublayer is being computed, the data for another sublayer has been prefetched and is ready), the system can fully utilize the NPU's computing resources, achieving parallel processing of computation and data transfer, thereby further optimizing memory access efficiency and improving overall computational performance.
[0022] To ensure that the CPU and NPU can correctly locate the obfuscated data, this invention maintains an internal address mapping table. This table is stored in internal RAM and is not connected to the external bus, thus avoiding security risks such as bus snooping. Each entry details the correspondence between the original address and the randomized address, ensuring the correctness of the data during obfuscation and restoration. This internal mapping mechanism not only improves data security but also simplifies the design complexity of external systems, making this invention easier to integrate into existing NPU systems.
[0023] In summary, the neural network layer boundary obfuscation method based on adaptive tile partitioning proposed in this invention has shown significant advantages and positive effects in enhancing NPU computational security, reducing performance overhead, improving obfuscation effect and flexibility, optimizing memory access efficiency, and ensuring data correctness and security.
[0024] The above general description and the description below are exemplary and illustrative only and are not intended to limit this application. Attached Figure Description
[0025] One or more embodiments are illustrated by way of example with reference to the accompanying drawings. These illustrations and drawings do not constitute a limitation on the embodiments. Elements having the same reference numerals in the drawings are shown as similar elements. The drawings are not to be scaled. And wherein: Figure 1 This is a schematic diagram of the method flow of the present invention; Figure 2 This is a schematic diagram of the NPU architecture provided in an embodiment of this disclosure; Figure 3 This is a schematic diagram of the adaptive partitioning module unit provided in an embodiment of this disclosure; Figure 4 This is a schematic diagram of the system structure according to an embodiment of the present disclosure. Detailed Implementation
[0026] To provide a more detailed understanding of the features and technical content of the embodiments of this disclosure, the implementation of the embodiments of this disclosure will be described in detail below with reference to the accompanying drawings. The accompanying drawings are for illustrative purposes only and are not intended to limit the embodiments of this disclosure. In the following technical description, for ease of explanation, several details are used to provide a full understanding of the disclosed embodiments. However, one or more embodiments may still be implemented without these details. In other cases, well-known structures and devices may be simplified in their depiction to simplify the drawings.
[0027] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.
[0028] Unless otherwise stated, the term "multiple" means two or more.
[0029] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.
[0030] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.
[0031] The term "correspondence" can refer to an association or binding relationship. The correspondence between A and B means that there is an association or binding relationship between A and B.
[0032] Example 1 A neural network layer boundary obfuscation method based on adaptive tile partitioning utilizes the inherent tile calculation process of the NPU to adaptively divide a complete network layer into multiple virtual sub-layers in time and space through hardware logic, thereby completely obfuscating the real layer boundary information that attackers rely on for analysis. Figure 2 The NPU architecture diagram shows that the CPU, as the host, issues the parameters and number of computation layers required for the current operation. First, it enters the adaptive Tile partitioning module, which adaptively divides the total number of computation layers into multiple virtual sub-layers. Each layer has a different virtual sub-layer. Then, the control data transport module transports the computation feature map to the PE array for computation according to the Tile granularity. While the PE is computing the current virtual layer, it simultaneously transports the data of the next virtual layer in, realizing a ping-pong operation to save memory access space. After the computation is completed, the data is written to a non-contiguous memory address.
[0033] Specifically, such as Figure 1 As shown, the method includes: S1: Receives the feature map parameters and weight parameters of the current neural network layer; S2: The NPU-based computing unit Tile is used as the partitioning granularity. Based on the feature map parameters and weight parameters, the current layer is dynamically divided into n virtual sub-layers. S3: Schedule the computation of each virtual sublayer in sequence; S4: When executing the i-th sub-layer, prefetch and cache the data required by the (i+1)-th sub-layer into the sub-layer buffer to achieve pipelined computation; S5: Dynamically generate non-contiguous physical storage addresses for the output data of each virtual sublayer, and write the output data to the corresponding addresses.
[0034] As a refinement of the above embodiment, step S2 divides the input feature map based on the magnitude of the weight parameters. The basic unit of division is the Tile, the basic data block for NPU scheduling and computation. This is to ensure that the divided sub-layers can be properly scheduled and executed by the NPU hardware without introducing additional computational errors or complex boundary conditions. Where n is a natural number greater than 1, and the number of partitions varies with the feature map parameters and weight parameters; The number n of virtual sub-layers satisfies the following constraint: , in, This represents the number of tiles contained in the input feature map. The weight contains the number of tiles. This represents the number of tiles contained in the output feature map.
[0035] Specifically, the upper limit of the number of virtual sub-layers is determined by the minimum number of tiles contained in the input feature map (IFM), weights (Filter), and output feature map (OFM): the number of sub-layers needs to be greater than 1 and less than the minimum number of tiles contained in the input feature map, weights, and output feature map. This constraint ensures the feasibility of the partitioning and avoids the inability to compute because the dimension of a single sub-layer is smaller than the convolution kernel size due to excessive partitioning.
[0036] After the adaptive module is divided, the sub-layers are executed one by one in sequence. When the PE array executes the first sub-layer, it will simultaneously control the reading of data from another sub-layer and store it in the sub-layer cache module to realize the ping-pong pipeline operation.
[0037] As a refinement of the above embodiments, the specific method for dynamically generating non-contiguous physical storage addresses is as follows: By randomly allocating memory addresses for each sub-layer output through the address reordering module, the continuous storage pattern of data in memory is broken.
[0038] As a refinement of the above embodiments, the NPU internally maintains an address mapping table to record the correspondence between logical addresses and randomized physical addresses, which is used for data addressing between the NPU and the CPU.
[0039] Specifically, after the PE array completes its operations, before writing the data back to DRAM, the addresses of the data being written back are randomized. This randomization breaks the continuity and predictability of data storage in memory, preventing attackers from deducing the tensor dimension size from observed memory addresses. To ensure the CPU and NPU can correctly locate the data, an internal address mapping table is maintained. This table uses internal RAM and is not connected to the external bus, making it relatively secure and preventing bus snooping. Each entry records the original address and the randomized address, with a one-to-one correspondence between the two addresses.
[0040] As a refinement of the above embodiments, the address mapping table is stored in the NPU's internal RAM and cannot be accessed through the external bus.
[0041] It should be noted that the adaptive tile partitioning technique of this invention dynamically divides the complete network layer into multiple virtual sublayers in time and space, and scrambles their execution order and storage addresses, completely obfuscating the layer boundary information that attackers can observe. This innovative obfuscation mechanism makes it difficult for attackers to obtain the sensitive structure of the model through traditional reverse engineering methods, thereby significantly enhancing the security of the NPU computation process.
[0042] The adaptive tile partitioning method of this invention directly utilizes the inherent tile calculation process of the NPU without requiring additional hardware or software modifications, achieving layer boundary obfuscation solely through hardware logic. This embedded design results in minimal performance impact, almost completely unaffected by the NPU's original computational efficiency, thus maintaining the NPU's high-efficiency computing capabilities while ensuring security.
[0043] The adaptive tile partitioning module of this invention possesses high dynamism and flexibility. It dynamically partitions virtual sub-layers based on the feature map parameters and weight parameters of the current layer, using the tile as the basic unit of NPU computation. This dynamic partitioning mechanism ensures that the number of virtual sub-layers is different each time, further increasing the difficulty for attackers to reverse engineer the model. Simultaneously, the address reordering module dynamically generates non-contiguous physical storage addresses for the output data of each virtual sub-layer, disrupting the continuity and predictability of data in memory. This combination of dual obfuscation mechanisms significantly enhances the obfuscation effect, making it virtually impossible for attackers to reverse engineer the neural network model's structure by observing memory addresses or execution order.
[0044] The sublayer buffer design of this invention implements ping-pong pipelined computation. When computing the i-th sublayer, the system prefetches and caches the data required for the (i+1)-th sublayer. This prefetching mechanism reduces data access waiting time and improves data transfer efficiency. Simultaneously, through ping-pong operations (i.e., while one sublayer is being computed, the data for another sublayer has been prefetched and is ready), the system can fully utilize the NPU's computing resources, achieving parallel processing of computation and data transfer, thereby further optimizing memory access efficiency and improving overall computational performance.
[0045] To ensure that the CPU and NPU can correctly locate the obfuscated data, this invention maintains an internal address mapping table. This table is stored in internal RAM and is not connected to the external bus, thus avoiding security risks such as bus snooping. Each entry details the correspondence between the original address and the randomized address, ensuring the correctness of the data during obfuscation and restoration. This internal mapping mechanism not only improves data security but also simplifies the design complexity of external systems, making this invention easier to integrate into existing NPU systems.
[0046] In summary, the neural network layer boundary obfuscation method based on adaptive tile partitioning proposed in this invention has shown significant advantages and positive effects in enhancing NPU computational security, reducing performance overhead, improving obfuscation effect and flexibility, optimizing memory access efficiency, and ensuring data correctness and security.
[0047] Example 2 like Figure 4As shown, a neural network layer boundary obfuscation system based on adaptive tile partitioning includes: The adaptive partitioning module receives feature map parameters and weight parameters, and dynamically partitions the current layer into multiple virtual sub-layers with Tile as the granularity. The control module is used to schedule the execution order of each virtual sublayer and control the data transport unit to read the corresponding sublayer data; The address reordering module is used to dynamically generate non-contiguous physical addresses for the output of each virtual sublayer. The sub-layer buffer module is used to prefetch and cache the data of the next sub-layer while executing the current sub-layer.
[0048] As a refinement of the above embodiments, the adaptive partitioning module is based on the input feature map, weights, and output features. Figure 3 The number of tiles contained within the layer dynamically determines the number of sublayers.
[0049] As a refinement of the above embodiments, an address mapping table storage unit is also included, which is located in the internal RAM of the NPU and is used to store the mapping relationship between logical addresses and randomized physical addresses.
[0050] As a refinement of the above embodiment, when the first virtual sublayer is executed, data from another virtual sublayer is read simultaneously and stored in the sublayer cache module to realize the ping-pong pipeline operation.
[0051] Specifically, such as Figure 3The diagram shows the adaptive partitioning module, which partitions the data based on the input feature map and weight parameters. The basic unit of partitioning is the Tile, the basic data block used for NPU scheduling and computation. This ensures that the partitioned sublayers can be properly scheduled and executed by the NPU hardware without introducing additional computational errors or complex boundary conditions. The upper limit of the number of virtual sublayers is determined by the minimum number of Tiles contained in the input feature map (IFM), weights (Filter), and output feature map (OFM): the number of sublayers must be greater than 1 and less than the minimum number of Tiles contained in the input feature map, weights, and output feature map. This constraint ensures the feasibility of partitioning and avoids the inability to compute individual sublayers due to excessive partitioning where the dimension of a single sublayer is smaller than the convolutional kernel size. After the adaptive module completes the partitioning, the partitioned sublayers are executed sequentially. When the PE array executes the first sublayer, it simultaneously reads data from another sublayer and stores it in the sublayer cache module to achieve a ping-pong pipelined operation. Subsequently, after the PE array operation is completed, before writing the data back to DRAM, the address of the data to be written back is randomized. This is to break the continuity and predictability of data storage in memory, making it impossible for attackers to deduce the size of the tensor dimension from the observed memory address. To ensure that the CPU and NPU can correctly find the data, an address mapping table needs to be maintained internally. This mapping table uses internal RAM and is not connected to the external bus, making it relatively secure and avoiding bus snooping. Each entry records the original address and the randomized address, with a one-to-one correspondence between the two addresses.
[0052] This disclosure provides a computer-readable storage medium storing computer-executable instructions configured to execute the aforementioned neural network layer boundary obfuscation method based on adaptive tile partitioning.
[0053] The aforementioned computer-readable storage medium may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.
[0054] The technical solutions of this disclosure can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes one or more instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in this disclosure. The aforementioned storage medium can be a non-transitory storage medium, including: a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and other media capable of storing program code; it can also be a transient storage medium.
[0055] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used in this application means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprises a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.
[0056] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0057] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed between each other may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to implement this embodiment according to actual needs. In addition, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0058] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
Claims
1. A neural network layer boundary obfuscation method based on adaptive tile partitioning, characterized in that, Includes the following steps: Receive the feature map parameters and weight parameters of the current neural network layer; The computational unit Tile based on NPU is used as the partitioning granularity. According to the feature map parameters and weight parameters, the current layer is dynamically divided into n virtual sub-layers. The computations of each virtual sublayer are scheduled and executed sequentially. When executing the i-th sub-layer, the data required by the (i+1)-th sub-layer is prefetched and cached in the sub-layer buffer to achieve pipelined computation. Non-contiguous physical storage addresses are dynamically generated for the output data of each virtual sublayer, and the output data is written to the corresponding addresses.
2. The neural network layer boundary obfuscation method based on adaptive tile partitioning according to claim 1, characterized in that, Where n is a natural number greater than 1, and the number of partitions varies with the feature map parameters and weight parameters; The number n of virtual sub-layers satisfies the following constraint: ， in, This represents the number of tiles contained in the input feature map. The weight contains the number of tiles. This represents the number of tiles contained in the output feature map.
3. The neural network layer boundary obfuscation method based on adaptive tile partitioning according to claim 1, characterized in that, The specific method for dynamically generating non-contiguous physical memory addresses is as follows: By randomly allocating memory addresses for each sub-layer output through the address reordering module, the continuous storage pattern of data in memory is broken.
4. The neural network layer boundary obfuscation method based on adaptive tile partitioning according to claim 1, characterized in that, The NPU maintains an internal address mapping table that records the correspondence between logical addresses and randomized physical addresses, which is used for data addressing between the NPU and the CPU.
5. The neural network layer boundary obfuscation method based on adaptive tile partitioning according to claim 1, characterized in that, The address mapping table is stored in the NPU's internal RAM and cannot be accessed via the external bus.
6. A neural network layer boundary obfuscation system based on adaptive tile partitioning for implementing the method as described in any one of claims 1 to 5, characterized in that, include: The adaptive partitioning module receives feature map parameters and weight parameters, and dynamically partitions the current layer into multiple virtual sub-layers with Tile as the granularity. The control module is used to schedule the execution order of each virtual sublayer and control the data transport unit to read the corresponding sublayer data; The address reordering module is used to dynamically generate non-contiguous physical addresses for the output of each virtual sublayer. The sub-layer buffer module is used to prefetch and cache the data of the next sub-layer while executing the current sub-layer.
7. The neural network layer boundary obfuscation system based on adaptive tile partitioning according to claim 6, characterized in that, The adaptive partitioning module dynamically determines the number of sub-layers based on the number of tiles contained in the input feature map, weights, and output feature map.
8. The neural network layer boundary obfuscation system based on adaptive tile partitioning according to claim 6, characterized in that, It also includes an address mapping table storage unit, located in the NPU's internal RAM, used to store the mapping relationship between logical addresses and randomized physical addresses.
9. The neural network layer boundary obfuscation system based on adaptive tile partitioning according to claim 6, characterized in that, When the first virtual sublayer is executed, data from the other virtual sublayer is read simultaneously and stored in the sublayer cache module to achieve ping-pong pipelined operation.
10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a processor, implements the novel grid-type new energy transient reactive power support strategy and setting method as described in any one of claims 1-5 above.