A large model weight file meta information security protection method and system
By using asymmetric encryption and memory mapping techniques on the metadata of large language model weight files, the problems of high computational overhead and complex key management in existing technologies are solved, achieving efficient and secure model loading and deployment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGDONG MICROPATTERN SOFTWARE CO LTD
- Filing Date
- 2026-04-16
- Publication Date
- 2026-07-10
AI Technical Summary
Existing symmetric encryption methods for large language model weight files have high computational overhead, affecting deployment efficiency, and complex key management, making it difficult to meet the security requirements of large-scale, distributed scenarios.
Asymmetric encryption technology is used to encrypt metadata, while weight data is stored in plaintext. The model is loaded through memory mapping technology, and hash value verification is used to ensure data integrity and security.
It significantly improves model loading efficiency, reduces computational overhead, and enhances the security and flexibility of key management, making it suitable for large models with hundreds of billions of parameters.
Smart Images
Figure CN122372276A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence model security technology, and in particular to a method and system for protecting the security of metadata in large model weight files. Background Technology
[0002] The weight file of a large language model (LLM) typically consists of two parts: metadata and weight tensor data. The metadata describes the model structure, tensor names, shapes, data types, and other parsed parameters, while the weight tensors store the actual values of the model parameters. In existing technologies, to protect the security of the model weight file, symmetric encryption of the entire file is commonly used.
[0003] This method has the following drawbacks: the encryption and decryption process involves all data, resulting in high computational overhead and a significant increase in model loading time, impacting deployment efficiency; furthermore, symmetric encryption key management is complex, and the key distribution process carries the risk of leakage, making it difficult to meet the security requirements of large-scale, distributed scenarios. Therefore, there is an urgent need for a model weight file protection scheme that balances security and efficiency. Summary of the Invention
[0004] To address the aforementioned technical problems, this invention provides a method and system for protecting the metadata security of large model weight files. The technical solution adopted is as follows: A method for protecting the metadata security of large model weight files includes the following steps: Step 1: Parse the original model weight file and separate and extract the metadata and weight tensor data; Step 2: Use the recipient's public key to perform asymmetric encryption on the extracted metadata to generate an encrypted metadata file; Step 3: Store the weight tensor data in plaintext as an independent weight file; Step 4: When loading the model, the licensor uses its private key to decrypt the encrypted metadata file and obtain the metadata. Step 5: Based on the storage location information in the decrypted metadata, load the corresponding weight tensor data from the plaintext weight file to complete the loading and reconstruction of the model.
[0005] Optionally, the metadata mentioned in step 1 includes the following: The model structure description includes the number of layers, the number of attention heads, the name, shape, and data type of each weight tensor, and the offset and length of the weight data in the file.
[0006] Optionally, the metadata may also include the model version number and training hyperparameters.
[0007] Optionally, asymmetric encryption uses the RSA algorithm, whose encryption process includes: generating a public key and a private key, using the public key to encrypt the metadata in blocks, and generating a ciphertext metadata file.
[0008] Optionally, an integrity verification step may also be included: Calculate the hash value of the encrypted metadata and store the hash value in the header of the weight file or the metadata file. After decrypting the metadata, its hash value is recalculated and compared with the stored hash value to verify the matching and integrity of the metadata with the weight file.
[0009] Optionally, the weight file is loaded using a memory-mapped method, directly accessing the corresponding weight data block based on the offset and length in the metadata, thus avoiding loading the entire weight file.
[0010] Optionally, a key management step may also be included: the receiver generates an asymmetric key pair, distributes the public key to the encryptor, and the private key is securely stored by the receiver for decrypting metadata.
[0011] A system for protecting the metadata of a large model weight file is provided to implement a method for protecting the metadata of a large model weight file. The system includes: a metadata extraction module, an asymmetric encryption module, a weight file reassembly module, a metadata decryption module, and a model loading module. The metadata extraction module is used to parse large model weight files and extract metadata and weight tensor data. The asymmetric encryption module is used to encrypt metadata using the recipient's public key to generate an encrypted metadata file; The weight file reorganization module is used to store the weight tensor data in plaintext as an independent weight file; The metadata decryption module is used by the authorized party to decrypt the encrypted metadata file using a private key and restore the metadata. The model loading module is used to load the corresponding weight tensor data from the plaintext weight file according to the storage location information in the decrypted metadata, and complete the model reconstruction.
[0012] An electronic device includes a memory and a processor, wherein a computer program is stored in the memory, and the processor executes the computer program to implement a method for protecting the metadata security of a large model weight file.
[0013] A computer-readable storage medium stores a computer program that, when executed by a processor, implements a method for protecting the metadata security of a large model weight file.
[0014] In summary, the present invention has at least one of the following beneficial technical effects: This invention provides a method and system for protecting the metadata of large model weight files. It performs asymmetric encryption only on the metadata, while storing the weight data in plaintext. This avoids the performance loss caused by full file encryption and decryption, and significantly improves model loading efficiency. It is especially suitable for large models with hundreds of billions of parameters.
[0015] It adopts an asymmetric encryption mechanism, where the public key is used to encrypt metadata, and the private key is kept by the authorized party. This solves the security risks of key distribution in symmetric encryption and ensures the confidentiality and trustworthiness of the metadata.
[0016] By utilizing the storage location information in the metadata, weight data blocks can be directly loaded using memory mapping technology, eliminating the need to load the entire file and further improving the real-time performance and resource utilization of model deployment.
[0017] It supports multiple mainstream large model weight file formats without changing the original weight data storage structure, making it easy to integrate with existing model training and inference frameworks.
[0018] The hash value comparison mechanism ensures the matching and integrity of metadata and weight files, preventing data tampering or incorrect loading. Attached Figure Description
[0019] Figure 1 This is a flowchart illustrating a method for protecting the metadata security of large model weight files according to the present invention. Figure 2 This is a schematic diagram of the model secure loading and decryption process of a method for protecting the metadata security of large model weight files according to the present invention. Detailed Implementation
[0020] The present invention will be further described in detail below with reference to the accompanying drawings.
[0021] This invention discloses a method and system for protecting the metadata security of large model weight files.
[0022] Reference Figure 1 and Figure 2 Example 1: A method for protecting the metadata security of large model weight files, comprising the following steps: Step 1: Parse the original model weight file and separate and extract the metadata and weight tensor data; Step 2: Use the recipient's public key to perform asymmetric encryption on the extracted metadata to generate an encrypted metadata file; Step 3: Store the weight tensor data in plaintext as an independent weight file; Step 4: When loading the model, the licensor uses its private key to decrypt the encrypted metadata file and obtain the metadata. Step 5: Based on the storage location information in the decrypted metadata, load the corresponding weight tensor data from the plaintext weight file to complete the loading and reconstruction of the model.
[0023] By employing the above technical solution, metadata and weight data are separated, with only the metadata subjected to asymmetric encryption while the weight data remains in plaintext. Since the metadata data volume is much smaller than the weight data, the encryption overhead is extremely low, and private key decryption ensures that only authorized parties can correctly parse the model structure, thereby preventing unauthorized use of the model. Simultaneously, although the weight data is in plaintext, it cannot be correctly loaded and parsed without the guidance of metadata, thus achieving effective protection of the model weights.
[0024] Example 2, the metadata mentioned in step 1 includes the following: The model structure description includes the number of layers, the number of attention heads, the name, shape, and data type of each weight tensor, and the offset and length of the weight data in the file.
[0025] By employing the above technical solution, the metadata contains parameters essential for the model loader to correctly reconstruct the model. By extracting and encrypting this crucial information, even if an unauthorized user obtains the weight file, they will be unable to ascertain the specific organization of the tensors and the model structure, thus preventing them from correctly loading the model.
[0026] Example 3: The meta-information also includes the model version number and training hyperparameters.
[0027] By adopting the above technical solution, the version number is used to distinguish different generations of models, avoiding version confusion; training hyperparameters such as learning rate and batch size can be used for subsequent model fine-tuning or analysis. Encrypting all this information ensures the integrity and confidentiality of model-related metadata.
[0028] Example 4: Asymmetric encryption uses the RSA algorithm. The encryption process includes: generating a public key and a private key, using the public key to encrypt the metadata in blocks, and generating a ciphertext metadata file.
[0029] Example 5 also includes an integrity verification step: Calculate the hash value of the encrypted metadata and store the hash value in the header of the weight file or the metadata file. After decrypting the metadata, its hash value is recalculated and compared with the stored hash value to verify the matching and integrity of the metadata with the weight file.
[0030] By adopting the above technical solution, the RSA algorithm is a public-key encryption algorithm. The principle is: according to number theory, it is relatively simple to find two large prime numbers, but it is extremely difficult to factor their product. Therefore, the product can be made public as the encryption key.
[0031] The RSA algorithm is described in detail below: Calculate the product of any two distinct large prime numbers p and q. ; Choose any large integer e, satisfying The integer e is used as the encryption key, and the selection of e is easy (for example, all prime numbers greater than p and q can be used); Determine the solution key d such that it satisfies ;Right now It is an arbitrary integer; therefore, if we know e and Then d can be easily calculated; The integers n and e are public, and the key d is stored. Encrypt plaintext m (m < n is an integer) into ciphertext c using the following encryption algorithm: ; The ciphertext c is decrypted into plaintext m using the following algorithm: ; However, it is impossible to calculate d from only n and e. Therefore, anyone can encrypt plaintext, but only authorized users can decrypt ciphertext.
[0032] In Example 6, the weight file is loaded using a memory mapping method, directly accessing the corresponding weight data block based on the offset and length in the metadata, thus avoiding loading the entire weight file.
[0033] By employing the above technical solution, during model loading, based on the offset and length of each tensor recorded in the decrypted metadata, the corresponding region of the weight file is directly mapped to the process address space through the operating system's memory mapping mechanism, eliminating the need to read the entire file into memory. Subsequently, the mapped region can be directly used as a storage buffer for tensor data, available for use by deep learning frameworks. This approach significantly reduces memory usage and I / O overhead, making it particularly suitable for large models with hundreds of billions of parameters, achieving fast loading and low resource consumption.
[0034] Example 7 also includes a key management step: the receiver generates an asymmetric key pair, distributes the public key to the encryptor, and the private key is securely stored by the receiver for decrypting metadata.
[0035] By adopting the above technical solution, the private key is strictly stored by the recipient in a hardware security module or key management system, and can only be accessed by authorized services. When publishing the model, the encryptor uses the public key to encrypt the metadata, ensuring that only the recipient holding the corresponding private key can decrypt it. This mechanism avoids the key distribution difficulties of symmetric encryption and enhances the security and flexibility of key management.
[0036] Example 8: A system for protecting the metadata of a large model weight file, used to implement a method for protecting the metadata of a large model weight file. The system includes: a metadata extraction module, an asymmetric encryption module, a weight file reassembly module, a metadata decryption module, and a model loading module. The metadata extraction module is used to parse large model weight files and extract metadata and weight tensor data. The asymmetric encryption module is used to encrypt metadata using the recipient's public key to generate an encrypted metadata file; The weight file reorganization module is used to store the weight tensor data in plaintext as an independent weight file; The metadata decryption module is used by the authorized party to decrypt the encrypted metadata file using a private key and restore the metadata. The model loading module is used to load the corresponding weight tensor data from the plaintext weight file according to the storage location information in the decrypted metadata, and complete the model reconstruction.
[0037] Example 9: An electronic device includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement a method for protecting the metadata security of a large model weight file.
[0038] Example 10: A computer-readable storage medium storing a computer program that, when executed by a processor, implements a method for protecting the metadata security of a large model weight file.
[0039] The following describes the implementation principle of the present invention using specific embodiments: Taking the large model file format safetensor as an example, the format of safetensor is as follows: The first 8 bytes of the file are an unsigned little-endian 64-bit integer N, representing the size of the header; The next N bytes are a JSON string representing the header information; Header data must begin with the "{" character; Header data may end with a whitespace character; The header is a dictionary containing a mapping from tensor names to tensor information; Each tensor contains the dtype, shape, and data_offsets fields; data_offsets points to the position of the tensor data relative to the beginning of the byte buffer; The special key metadata allows for string-to-string mappings; The remainder of the file is a byte buffer, which contains the plaintext information of the weights; Encryption process: 1. Load the original model file original_model.safetensors; 2. Analyze the metadata of the model; 3. Use the public key and RSA encryption algorithm to encrypt metadata in blocks; 4. Generate the encrypted metadata file: model.meta.enc; 5. Reorganize the weights file: model.weights.bin; The core code is as follows: defprocess(self,public_key_path=None,output_dir='.'): """Handle the entire process""" # Ensure the output directory exists os.makedirs(output_dir,exist_ok=True) # Generate or load RSA keys ifpublic_key_path: #Load an existing public key public_key=self.load_rsa_public_key(public_key_path) else: # Generate a new key pair print("GeneratingRSAkeypair...") public_key,private_key=self.generate_rsa_keys() #Save the key pair self.save_rsa_keys(public_key,private_key,output_dir) print("RSAkeypairgeneratedandsaved.") #Encrypted Meta-information print("Encryptingmetadata...") encrypted_metadata,metadata_hash=self.encrypt_metadata(public_key) #Save the encrypted metadata encrypted_meta_path=os.path.join(output_dir,'model.meta.enc') self.save_encrypted_metadata(encrypted_metadata,encrypted_meta_path) print(f"Encryptedmetadatasavedto:{encrypted_meta_path}") #Reorganize weight file print("Reorganizingweightfile...") weights_output_path=os.path.join(output_dir,'model.weights.bin') self.reorganize_weight_file(metadata_hash,weights_output_path) print(f"Reorganizedweightfilesavedto:{weights_output_path}") return{ 'encrypted_meta_path':encrypted_meta_path, 'weights_output_path':weights_output_path, 'metadata_hash':metadata_hash} The decryption process is as follows: Load the private key; Decrypt the metadata in blocks using the private key; Parse the information of the weight file (such as name, shape, offset, data type); Load the recombined weights file; Calculate the hash value of the ciphertext containing the metadata.
[0040] Verify whether the hash value of the encrypted metadata matches the hash value in the weight file.
[0041] Restore the original format file: restored_model.safetensors defprocess(self,private_key_path,output_path): """Handles the entire decryption and recovery process""" #Load private key print("Loading privatekey...") private_key=self.load_rsa_private_key(private_key_path) #Decoding Metainformation print("Decryptingmetadata...") decrypted_metadata=self.decrypt_metadata(private_key) print("Metadatadecryptedandverifiedsuccessfully.") #Restore original files print("Restoringoriginalweightfile...") self.restore_original_file(decrypted_metadata,output_path) print(f"Originalweightfilerestoredto:{output_path}") #Verify the recovered files print("Verifyingrestoredfile...") # You can add verification logic here, such as using SafeTensorReader to load the recovered file. return{ 'decrypted_metadata':decrypted_metadata, 'restored_file_path':output_path}.
[0042] The above are all preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape and principle of the present invention should be covered within the scope of protection of the present invention.
Claims
1. A method for protecting the metadata security of large model weight files, characterized in that, Includes the following steps: Step 1: Parse the original model weight file and separate and extract the metadata and weight tensor data; Step 2: Use the recipient's public key to perform asymmetric encryption on the extracted metadata to generate an encrypted metadata file; Step 3: Store the weight tensor data in plaintext as an independent weight file; Step 4: When loading the model, the licensor uses its private key to decrypt the encrypted metadata file and obtain the metadata. Step 5: Based on the storage location information in the decrypted metadata, load the corresponding weight tensor data from the plaintext weight file to complete the loading and reconstruction of the model.
2. The method for protecting the metadata security of large model weight files according to claim 1, characterized in that, The metadata mentioned in step 1 includes the following: Model structure description, including the number of layers and attention heads; the name, shape, and data type of each weight tensor; The offset and length of the weighted data in the file.
3. The method for protecting the metadata security of large model weight files according to claim 2, characterized in that, The metadata also includes the model version number and training hyperparameters.
4. The method for protecting the metadata security of large model weight files according to claim 3, characterized in that, Asymmetric encryption uses the RSA algorithm, and its encryption process includes: generating a public key and a private key, using the public key to encrypt the metadata in blocks, and generating a ciphertext metadata file.
5. The method for protecting the metadata security of large model weight files according to claim 4, characterized in that, It also includes an integrity verification step: Calculate the hash value of the encrypted metadata and store the hash value in the header of the weight file or the metadata file. After decrypting the metadata, its hash value is recalculated and compared with the stored hash value to verify the matching and integrity of the metadata with the weight file.
6. The method for protecting the metadata security of large model weight files according to claim 5, characterized in that, The weight file is loaded using a memory-mapped method, directly accessing the corresponding weight data block based on the offset and length in the metadata, thus avoiding loading the entire weight file.
7. A method for protecting the metadata security of large model weight files according to claim 6, characterized in that, It also includes a key management step: the receiver generates an asymmetric key pair, distributes the public key to the encryptor, and the private key is securely stored by the receiver for decrypting metadata.
8. A system for protecting the metadata security of large model weight files, characterized in that, To implement the method for protecting the metadata of a large model weight file as described in claim 7, the system includes: a metadata extraction module, an asymmetric encryption module, a weight file reassembly module, a metadata decryption module, and a model loading module; The metadata extraction module is used to parse large model weight files and extract metadata and weight tensor data. The asymmetric encryption module is used to encrypt metadata using the recipient's public key to generate an encrypted metadata file; The weight file reorganization module is used to store the weight tensor data in plaintext as an independent weight file; The metadata decryption module is used by the authorized party to decrypt the encrypted metadata file using a private key and restore the metadata. The model loading module is used to load the corresponding weight tensor data from the plaintext weight file according to the storage location information in the decrypted metadata, and complete the model reconstruction.
9. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and when the processor executes the computer program, it implements a method for protecting the metadata security of large model weight files as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, A computer program is stored, which, when executed by a processor, implements a method for protecting the metadata of a large model weight file as described in any one of claims 1 to 8.