Method, device and medium for protecting intellectual property of physical model in body intelligence scenario

Abstract

The application discloses a physical model intellectual property protection method and device in a physical intelligent scene, and relates to the field of artificial intelligence, and comprises the following steps: in response to a model loading trigger instruction, an encrypted model file is acquired from a nonvolatile storage medium of an edge device; the encrypted model file is decrypted based on a secure execution environment, model data is obtained, and the model data is loaded into protected storage in the memory; in response to original input data to be inferred, an input transformation operation is performed on the original input data, transformed input data is obtained, and transformation parameters are saved; the transformed input data is input into the model data to perform inference, and original inference output results are obtained; based on the transformation parameters, an inverse transformation operation is performed on the original inference output results, and final inference output results are generated. Through the cooperative cooperation of encrypted storage, secure memory protection and input / output data transformation, the effectiveness of model intellectual property protection in the edge inference scene can be enhanced.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, device, and medium for protecting the intellectual property rights of physical models in embodied intelligence scenarios. Background Technology

[0002] With the rapid development of embodied intelligence technology in fields such as robotics and autonomous driving, physical models and machine vision models, as the core modules of decision-making and perception, have become the most commercially valuable intellectual assets in this technology system.

[0003] In existing technologies, the aforementioned models are typically deployed on edge devices such as robots and smart terminals. These devices are exposed to an open environment with uncontrollable physical conditions for extended periods. Attackers can steal or reverse engineer the models by disassembling the device firmware, listening to debugging interfaces, or launching side-channel attacks.

[0004] Therefore, how to provide a solution that can comprehensively enhance the effectiveness of model intellectual property protection in edge reasoning scenarios has become an urgent technical problem to be solved. Summary of the Invention

[0005] This invention provides a method, device, and medium for protecting the intellectual property rights of physical models in embodied intelligence scenarios. The technical problem it aims to solve is: how to provide a solution that can comprehensively enhance the effectiveness of protecting the intellectual property rights of models in edge reasoning scenarios.

[0006] In a first aspect, the present invention provides a method for protecting intellectual property rights of physical models in embodied intelligent scenarios, comprising: In response to a received model loading trigger command, an encrypted model file is retrieved from the non-volatile storage medium of the edge device. The encrypted model file is obtained by encrypting the physical model. Based on the secure execution environment built into the edge device, the encrypted model file is decrypted to obtain model data, and the model data is loaded into the memory of the edge device. The model data is stored in the memory in a protected form, which is hardware-level memory isolation based on the secure execution environment. In response to receiving the original input data to be inferred, an input transformation operation is performed on the original input data to obtain the transformed input data, and the transformation parameters corresponding to the input transformation operation are saved. The transformed input data is input into the model data in the memory to perform inference calculations, and the original inference output result is obtained. Obtain the transformation parameters, and perform an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result.

[0007] Optionally, performing an input transformation operation on the original input data to obtain transformed input data and saving the transformation parameters corresponding to the input transformation operation includes: Obtain the current system clock value of the edge device when receiving the raw input data, and use the current system clock value as a random seed; Based on the random seed, a first random transformation parameter and a second random transformation parameter are generated by a pseudo-random algorithm. The first random transformation parameter is used to control the magnitude of the added random noise, and the second random transformation parameter is used to control the permutation and mapping rules for scrambling and rearranging data elements. Based on the first random transformation parameters, an additive random noise addition operation is performed on the original input data to obtain the noisy data; Obtain the dimensional information of the noisy data, and based on the second random transformation parameter and the dimensional information, perform a position scrambling operation on each data element in the noisy data to obtain the transformed input data; The first random transformation parameter and the second random transformation parameter are combined into a transformation parameter group, and the transformation parameter group is saved as the transformation parameter.

[0008] Optionally, loading the model data into the memory of the edge device, wherein the model data is stored in the memory in a protected form, includes: The edge device's built-in secure execution environment is invoked, and a secure memory allocation request is initiated to the secure execution environment to obtain an isolated memory region. Write the model data into the isolated memory area; Configure the access control policy for the isolated memory region to prohibit programs in non-secure execution environments from accessing the isolated memory region, and save the binding relationship between the access control policy and the model data; Based on the binding relationship, a memory access identifier for the model data is generated; Obtain the device hardware identifier of the edge device, and associate and store the memory access identifier with the device hardware identifier; In response to the detection of an access request for the isolated memory region, the system determines whether the access request is an illegal access request based on the consistency verification result of the memory access identifier and the device hardware identifier. If the access request is an illegal access request, then the party initiating the access request is denied access to the isolated memory region.

[0009] Optionally, the encrypted model file is obtained in advance in the following manner: Obtain the original physical model file, and perform obfuscation processing on the computation graph structure of the original physical model file to obtain an obfuscated model file; Generate a hidden digital watermark sequence for ownership tracing, and embed the hidden digital watermark sequence into the obfuscation model file to obtain an obfuscation model file carrying the watermark; An encryption operation is performed on the obfuscated model file carrying the watermark to generate an encrypted model file; The encrypted model file is stored in the non-volatile storage medium of the edge device.

[0010] Optionally, the obfuscation process performed on the computational graph structure of the original physical model file to obtain an obfuscated model file includes: Perform a parsing operation on the computation graph structure of the original physical model file to obtain the original computation graph; Traverse each computation node in the original computation graph and insert invalid computation nodes in the original computation graph. The invalid computation nodes contain random operation types and random tensor data. Randomize and rename all node names in the computation graph after inserting invalid computation nodes to obtain a confused computation graph. An obfuscation model file is generated based on the obfuscation computation graph.

[0011] Optionally, the step of generating a hidden digital watermark sequence for ownership tracing, and embedding the hidden digital watermark sequence into the obfuscation model file to obtain an obfuscation model file carrying the watermark, includes: A redundancy space scan operation is performed on the model parameters of the obfuscated model file to determine the available redundant bits in the model parameters; Generate a hidden digital watermark sequence for ownership tracing; The hidden digital watermark sequence is embedded into the available redundant bits to obtain an obfuscated model file carrying the watermark; Perform watermark embedding verification on the obfuscated model file carrying the watermark to confirm that the hidden digital watermark sequence has been correctly written; Obtain the device hardware identifier of the edge device, encrypt and bind the device hardware identifier with the hidden digital watermark sequence, generate a binding certificate, and store the binding certificate in the secure execution environment.

[0012] Optionally, obtaining the transformation parameters and performing an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result includes: Obtain the saved transformation parameter set; Perform a parsing operation on the transformation parameter set to obtain the first random transformation parameter and the second random transformation parameter; Based on the second random transformation parameters, a position recovery rule corresponding to the position scrambling operation is determined, and a position recovery operation is performed on each data element in the original inference output result according to the position recovery rule to obtain the position-recovered data; Based on the first random transformation parameters, a denoising rule corresponding to the additive random noise addition operation is determined, and a denoising operation is performed on the data after the position is recovered according to the denoising rule to obtain the data after inverse transformation; The data after the inverse transformation is used as the final inference output.

[0013] Optionally, the method further includes: During the operation of the inference service on the edge device, external call records to the inference interface are collected, and the call records include call timestamps and call input data; The call frequency is obtained by counting the number of calls per unit time based on the call records. Determine whether the call frequency exceeds a preset frequency threshold; If the call frequency exceeds the preset frequency threshold, an alarm signal is generated; If the call frequency does not exceed the preset frequency threshold, then the distribution features of the call input data are further extracted to obtain the distribution features of the call data, and it is determined whether the distribution features of the call data conform to the preset regularity sampling features; If the distribution characteristics of the called data conform to the regular sampling characteristics, an alarm signal is generated; If the distribution characteristics of the called data do not conform to the regular sampling characteristics, the current monitoring status shall be maintained.

[0014] Secondly, the present invention also provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0015] Thirdly, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the above-described method.

[0016] This invention provides a method, device, and medium for protecting the intellectual property rights of physical models in embodied intelligent scenarios. By integrating encrypted storage, decryption and memory protection in a secure execution environment, random transformation of inference input, and inverse transformation of output into a complete data processing chain, it achieves full lifecycle protection of the physical model from storage state to runtime state and then to inference input and output. The encrypted model file resides in ciphertext form on a non-volatile storage medium, preventing illegal copying during static storage. Furthermore, the decryption operation based on the secure execution environment directly loads the model data into a hardware-isolated memory region, ensuring that the model remains inaccessible from the ordinary execution environment throughout operation, eliminating the risk of memory dumping and debugging interface theft. Furthermore, the input transformation and output inverse transformation apply reversible randomization processing before and after inference computation, respectively, preventing attackers from obtaining valid input-output sample pairs through black-box calls to train alternative models. The aforementioned technical measures work together in a progressive manner, and breakthroughs in any single point of defense are insufficient to obtain a complete and usable model. Attackers must simultaneously overcome the triple barriers of storage decryption, memory access, and input / output obfuscation in order to successfully steal or reverse engineer the model, thereby comprehensively enhancing the effectiveness of physical model intellectual property protection in edge reasoning scenarios. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart illustrating a method for protecting intellectual property rights of physical models in an embodied intelligent scenario, provided as an embodiment of the present invention; Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0021] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0022] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0023] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0024] Please see Figure 1 This invention provides a method for protecting the intellectual property rights of physical models in embodied intelligence scenarios, executed by edge devices. In the field of embodied intelligence technology, physical models and machine vision models, as core modules for decision-making and perception, are typically deployed on edge devices such as robots and smart terminals. Because these devices are exposed to physically uncontrollable open environments for extended periods, attackers can steal or reverse engineer the models by disassembling device firmware, monitoring debugging interfaces, or launching side-channel attacks. This embodiment integrates model storage encryption, runtime secure memory protection, random transformation of input data, and inverse transformation of output data into a complete technical chain, constructing a three-dimensional defense system covering the entire process of model storage, runtime, and inference input / output. This fundamentally increases the cost and difficulty for attackers to steal the models. Specifically, the method includes the following steps: S1, in response to the received model loading trigger command, retrieves the encrypted model file from the non-volatile storage medium of the edge device, the encrypted model file being obtained by encrypting the physical model.

[0025] In specific implementation, in response to the received model loading trigger command, the edge device retrieves an encrypted model file from its non-volatile storage medium. This encrypted model file is obtained by encrypting the physical model. The model loading trigger command can be automatically generated by the bootloader during edge device system initialization, or it can be generated by the service management module when the application initiates an inference service startup request through the application programming interface; this invention does not specifically limit its generation. The non-volatile storage medium refers to a storage device whose data is not lost after power failure, including but not limited to embedded multimedia storage cards, solid-state drives, flash memory chips, or general-purpose flash memory devices. These storage devices are connected to the edge device's main processor through a standard storage interface.

[0026] Furthermore, the encrypted model file is ciphertext data stored in a non-volatile storage medium after the original physical model file has been processed by a symmetric or asymmetric encryption algorithm. Before decryption, the encrypted model file presents as an unordered random byte sequence. Even if an attacker reads the original binary data in the storage medium by physical means, they will not be able to extract the model's structural information or parameter weights from it.

[0027] In some preferred embodiments, the encrypted model file is obtained in advance by: acquiring the original physical model file; performing obfuscation processing on the computation graph structure of the original physical model file to obtain an obfuscated model file; generating a hidden digital watermark sequence for ownership tracing; embedding the hidden digital watermark sequence into the obfuscated model file to obtain a watermarked obfuscated model file; performing encryption operations on the watermarked obfuscated model file to generate an encrypted model file; and storing the encrypted model file in the non-volatile storage medium of the edge device.

[0028] In practice, the edge device acquires the original physical model file and performs obfuscation processing on the computation graph structure of the original physical model file to obtain an obfuscated model file. The original physical model file is a complete model data package output by the artificial intelligence training platform or model developer, and its file format depends on the artificial intelligence framework used during training. Common model file formats include, but are not limited to: TorchScript serialized files used by the PyTorch framework, which contain the procedural computation graph and parameter weights of the model; frozen graph definition files used by the TensorFlow framework, which contain the computation graph definition and parameter values ​​in a serialized protocol buffer format; and files used by the Open Neural Network Exchange Format, which provide a framework-independent intermediate representation format that enables model interoperability between different frameworks.

[0029] Furthermore, regardless of the format used, the model file contains two core components: first, the computation graph structure, which is a topological network defining the data dependencies between computation nodes; and second, the model parameter weights, which are the learnable parameter values ​​required by each computation node to perform forward propagation. Obfuscation is an irreversible and complex transformation of the computation graph structure.

[0030] Furthermore, the edge device generates a hidden digital watermark sequence for ownership tracing, and embeds this hidden digital watermark sequence into the obfuscated model file to obtain an obfuscated model file carrying the watermark. The hidden digital watermark sequence is a binary bit stream used to uniquely identify the intellectual property ownership information of the model. During generation, the watermark sequence embeds information such as the model owner's identity, model version number, and generation timestamp, and is encrypted using a watermark key, making it impossible for unauthorized parties to identify, extract, or tamper with the watermark sequence.

[0031] Furthermore, the edge device performs encryption operations on the watermarked obfuscated model file to generate an encrypted model file. Encryption operations refer to using a cryptographic algorithm to convert the watermarked obfuscated model file from plaintext to ciphertext. In this embodiment, the encryption algorithm used is a symmetric block cipher algorithm, which features high security, fast processing speed, and good hardware implementation efficiency, and is widely used in data storage encryption scenarios. The edge device uses a root key pre-installed in the secure execution environment to encrypt the watermarked obfuscated model file. This root key is securely injected and stored in the non-volatile storage area of ​​the secure execution environment during the device manufacturing stage or system initialization stage. The output of the encryption operation is the encrypted model file, in which all bytes exhibit random distribution characteristics.

[0032] Furthermore, the edge device stores the encrypted model file in its non-volatile storage medium. The storage operation refers to writing the binary data of the encrypted model file to a specified path within the file system of the non-volatile storage medium. The file system typically employs a journal-structured file system or a fourth-generation extended file system to ensure data integrity and power-off recovery capabilities. After writing is complete, the encrypted model file is in a pending loading state, waiting for the edge device to read and decrypt it from the storage medium under the trigger of a model loading command.

[0033] This embodiment integrates computation graph obfuscation, digital watermark embedding, and encryption operations into a complete pre-generation process, achieving multi-dimensional security hardening before model deployment. Computation graph obfuscation increases the difficulty for attackers to understand the model's computation graph structure through static analysis; digital watermarking provides a technical basis for ownership tracing and infringement identification after model leakage; and encryption operations ensure that the model file exists in ciphertext form on non-volatile storage media. Furthermore, by arranging obfuscation and watermark embedding to be performed before encryption, these structural-level operations can be performed directly on plaintext data, avoiding the additional complexity and algorithmic limitations introduced by processing in ciphertext. Furthermore, the sequential stacking of these three security steps ensures that attackers must successfully perform three reverse operations—decryption, watermark detection, and obfuscation restoration—before obtaining a usable original model, significantly increasing the total workload required for an attacker to successfully steal the model.

[0034] In some preferred embodiments, the obfuscation process performed on the computation graph structure of the original physical model file to obtain an obfuscated model file includes: performing a parsing operation on the computation graph structure of the original physical model file to obtain an original computation graph; traversing each computation node in the original computation graph and inserting invalid computation nodes into the original computation graph, wherein the invalid computation nodes contain random operation types and random tensor data; performing a randomization renaming operation on all node names in the computation graph after inserting invalid computation nodes to obtain an obfuscated computation graph; and generating an obfuscated model file based on the obfuscated computation graph.

[0035] In specific implementation, this embodiment inserts invalid computation nodes containing random operation types and random tensor data into the computation graph, and randomly renames all node names. This makes it difficult for attackers to distinguish between valid and invalid computations when reverse engineering the model structure, and also makes it impossible for them to infer the model's functionality through the semantic information of the node names. The specific implementation method is as follows: The edge device performs a parsing operation on the computation graph structure of the original physical model file to obtain the original computation graph. The computation graph is a graphical representation of the mathematical operation structure of the physical model, consisting of two basic elements: computation nodes, representing specific operations performed on the data, such as convolution, pooling, matrix multiplication, activation function operations, and normalization operations; and edges, representing the flow direction of tensor data between computation nodes. These computation nodes and edges together form a directed acyclic graph, where data flows unidirectionally from input nodes to output nodes along the edge direction, without loops. Further, the edge device uses a model parsing library to load and parse the original physical model file. Different model file formats correspond to different parsers: for PyTorch's TorchScript format, the parsing interface provided by PyTorch's just-in-time compiler is used; for TensorFlow's protocol buffer format, the TensorFlow graph definition parsing interface is used; and for the Open Neural Network Exchange format, the model loading interface provided by the Open Neural Network Exchange runtime library is used. The parser described above restores the binary data in the model file into a computational graph data structure in memory, making each node and its connections programmatically accessible in the form of an object graph.

[0036] Furthermore, the edge device traverses each computation node in the original computation graph, inserting invalid computation nodes into the original computation graph. These invalid computation nodes contain random operation types and random tensor data. Specifically, the operation types of the invalid computation nodes are selected from identity mapping, zero-value addition, or one-multiplication. During insertion, the invalid computation node takes the output tensor of the previous node as input, performs invalid operations, and outputs a tensor of the same shape to the next node, ensuring that the control flow and data dependencies of the original computation graph are not altered. Traversal refers to visiting each computation node according to the topological order of the computation graph, ensuring that the connectivity and data dependencies of the computation graph are not disrupted when inserting invalid nodes. Further, invalid computation nodes refer to redundant nodes that do not substantially affect the overall computational function of the model. Their insertion aims to introduce noise information into the computation graph, presenting an attacker with a complex graph structure containing a large number of indistinguishable operations at both the visual and structural analysis levels. Furthermore, the operation type for each invalid computation node is randomly selected from a predefined set of invalid operations, which includes, but is not limited to: identity mapping operations, whose output equals the input; zero-value addition operations, whose output equals the input plus a tensor of all zeros; zero-value multiplication operations, whose output equals the input multiplied by a tensor of all zeros; and transpose operations, which swap the two dimensions of the tensor and then perform the inverse swap. The random tensor data contained in each invalid computation node includes the parameters required for the node's operation. For example, for an invalid convolution node, it contains randomly initialized convolution kernel weight tensors and bias vectors; for an invalid batch normalization node, it contains randomly initialized scaling factors and offsets. To ensure that the computation graph can still execute normally after an invalid node is inserted, the input tensor dimension of each invalid computation node is set to be consistent with the output tensor dimension of the previous valid computation node, and the output tensor dimension of each invalid computation node is set to be consistent with the input tensor dimension of the next valid computation node.

[0037] Furthermore, the edge device performs a randomized renaming operation on all node names in the computation graph after the insertion of invalid computation nodes, resulting in an obfuscated computation graph. In the original computation graph, the framework typically assigns readable names to each computation node when deriving the model. These names reflect the node's functional type and hierarchical order, allowing attackers to quickly locate key computation layers when analyzing the model. After inserting the invalid node, the edge device iterates through each computation node in the computation graph, replacing the node's name attribute with a randomly generated string containing no semantic information. This random string is generated by randomly selecting a preset number of characters from a hexadecimal character set. After the renaming is complete, all node names in the obfuscated computation graph appear as a sequence of random strings.

[0038] Furthermore, the edge device generates an obfuscated model file based on the obfuscated computation graph. The edge device reserializes the node structure in the obfuscated computation graph, the edge connections between nodes, and the unmodified model parameter weights from the original physical model file according to the original file format, generating an obfuscated model file compatible with the original physical model file format. This obfuscated model file retains all the computational functions of the original model, but contains a large number of invalid nodes, and all node names are randomized.

[0039] This embodiment traverses the original computation graph and inserts invalid computation nodes containing random operation types and random tensor data. This forces attackers, after obtaining the obfuscated model file, to face a graph structure with a significantly increased number of nodes and a large number of meaningless operations when performing reverse engineering. Attackers cannot distinguish which nodes are necessary valid operations and which are meaningless noise insertions using simple structural pattern recognition; they must analyze the computational semantics and data dependencies of each node individually. The workload of this analysis increases linearly or even superlinearly with the number of invalid nodes. Furthermore, by randomly renaming all node names, attackers cannot use the semantic information usually carried in node names to quickly locate key computational layers. They must rely on more complex computation graph structure analysis methods to infer model functionality, further increasing the difficulty of reverse engineering.

[0040] In some preferred embodiments, generating a hidden digital watermark sequence for ownership tracing and embedding the hidden digital watermark sequence into the obfuscated model file to obtain a watermarked obfuscated model file includes: performing a redundancy space scan operation on the model parameters of the obfuscated model file to determine the available redundant bits in the model parameters; generating a hidden digital watermark sequence for ownership tracing; embedding the hidden digital watermark sequence into the available redundant bits to obtain a watermarked obfuscated model file; performing watermark embedding verification on the watermarked obfuscated model file to confirm that the hidden digital watermark sequence has been correctly written; obtaining the device hardware identifier of the edge device; encrypting and binding the device hardware identifier with the hidden digital watermark sequence to generate a binding certificate; and storing the binding certificate in the secure execution environment.

[0041] In specific implementation, this embodiment embeds encrypted watermark information into the floating-point redundant bits of the model parameters, and performs verification and device hardware identifier binding after watermark embedding, thereby achieving permanent marking and traceability protection of model ownership. The specific implementation method is as follows: The edge device performs a redundancy space scan on the model parameters of the obfuscated model file to determine the available redundant bits in the model parameters. Redundancy space scanning is a technique that checks the binary representation of each model parameter one by one. In computer systems, floating-point numbers are widely encoded and stored using the IEEE 754 standard. According to this standard, a double-precision floating-point number consists of three parts: a sign bit, an exponent bit, and a mantissa bit. The actual value of the floating-point number is calculated from the sign bit, exponent bit, and mantissa bit, where each bit in the mantissa bit determines the precision of the fractional part of the value. Furthermore, in practical applications, the lowest few bits of the mantissa bit have a minimal impact on the overall precision of the value, and the model parameters already contain noise during training. Therefore, the least significant bit of the mantissa bit can be sacrificed to carry watermark information without having a perceptible impact on the model's inference accuracy. Further, the edge device traverses each parameter in the obfuscated model file, reads its binary representation, and marks the lowest preset number of bits in the mantissa bit as available redundant bits. If the parameter value is zero, infinity, or not a number, the parameter is skipped.

[0042] Furthermore, the edge device generates a hidden digital watermark sequence for ownership tracing. This hidden digital watermark sequence is a fixed-length binary bit stream carrying the model's ownership information. The specific process for generating this watermark sequence is as follows: The edge device first obtains the model owner's identity information, the current model version number, and the watermark generation timestamp. This information is then concatenated according to a predefined binary encoding format to form an original information bit sequence. Next, the edge device uses a watermark key to encrypt this original information bit sequence, converting it into a hidden digital watermark sequence of the same length but with a random distribution. Furthermore, after encryption, even if an attacker discovers abnormal bits in the model parameters through statistical analysis, they will be unable to decipher any meaningful ownership information from it.

[0043] Furthermore, the edge device embeds the hidden digital watermark sequence into the available redundant bits to obtain an obfuscated model file carrying the watermark. The specific embedding process is as follows: the edge device extracts each bit value from the hidden digital watermark sequence sequentially, then traverses the model parameters marked as available redundant bits in a predetermined order. For each parameter to be embedded, its binary representation is read, the least significant bit of its mantissa is replaced with the value of the current watermark bit, and then the modified value is written back to the original parameter position. Furthermore, if the length of the watermark sequence is less than the total number of available redundant bits, the same watermark sequence can be repeatedly embedded into the redundant bits of multiple parameters to enhance robustness.

[0044] Furthermore, the edge device performs watermark embedding verification on the obfuscated model file carrying the watermark to confirm that the hidden digital watermark sequence has been correctly written. The specific process of watermark embedding verification is as follows: the edge device re-traverses the parameters marked as watermark carriers in the obfuscated model file carrying the watermark, extracts a bit sequence bit by bit from the least significant bits of the last few bits of these parameters, and compares the extracted bit sequence bit by bit with the original hidden digital watermark sequence. Furthermore, if all bits match, the watermark embedding is confirmed to be successful, and the edge device marks the verification result as successful; furthermore, if there are mismatched bits, the edge device re-executes the embedding operation, resets the redundant bits of the parameters corresponding to the mismatched positions to the correct watermark bit values, and performs verification again until all bits match.

[0045] Furthermore, the edge device obtains its own device hardware identifier, encrypts and binds the device hardware identifier with the hidden digital watermark sequence to generate a binding certificate, and stores the binding certificate in the secure execution environment. Further, the binding certificate is a digitally signed data structure, its format comprising three parts: a certificate header, a certificate body, and a certificate footer. The specific process for generating the binding certificate is as follows: the edge device concatenates the device hardware identifier and the watermark sequence into a byte sequence according to a predetermined format, performs a digital signature operation on this byte sequence using a private key within the secure execution environment, and generates a signature value; then, the device hardware identifier, the watermark sequence, and the signature value are encapsulated together into a certificate file. This binding certificate is stored in the non-volatile storage area of ​​the secure execution environment, and no unauthorized party can modify or forge the certificate.

[0046] This embodiment embeds a hidden digital watermark sequence into the redundant floating-point bits of the model parameters, achieving the addition of a persistent ownership marker to the model without affecting its inference accuracy. Since the watermark is embedded in the least significant bit of the floating-point number and is encrypted, it is difficult for an unauthorized party to detect and remove the embedded watermark information after stealing the model, thus providing a reliable technical basis for subsequent ownership verification and infringement prosecution. Furthermore, a verification step is performed immediately after watermark embedding, and re-embedding is only performed in cases of mismatch, ensuring that the watermark data is completely and correctly written into the model parameters. Furthermore, the device hardware identifier is encrypted and bound to the watermark sequence to generate a binding certificate, which is stored in a secure execution environment. This establishes an encrypted association between the model watermark and a specific edge device. If the model is leaked, the model owner can extract the watermark from the model and compare it with the binding certificate to prove the binding relationship between the model and the specific device, further enhancing the watermark's non-repudiation and traceability.

[0047] S2, based on the secure execution environment built into the edge device, perform decryption operation on the encrypted model file to obtain model data, and load the model data into the memory of the edge device. The model data is stored in the memory in a protected form, which is hardware-level memory isolation based on the secure execution environment.

[0048] In specific implementation, the edge device, based on its built-in secure execution environment, performs decryption operations on the encrypted model file to obtain model data, and loads the model data into the edge device's memory. The model data is stored in memory in a protected form, which is hardware-level memory isolation based on the secure execution environment. The secure execution environment is a secure area within the edge device's main processor that is isolated from the ordinary execution environment at the hardware level, ensuring the confidentiality and integrity of the loaded code and data. Taking TrustZone technology under the ARM architecture as an example, the secure execution environment corresponds to the secure world, and the ordinary execution environment corresponds to the insecure world. The two are switched through a hardware-level monitor; the code and data in the secure world are completely invisible to the insecure world. Taking Software Guard Extensions technology under the Intel architecture as an example, the secure execution environment corresponds to an enclave, a protected area located in the application's address space. Its contents are stored in memory in encrypted form, and even the operating system and virtual machine monitor cannot access the plaintext data within the enclave. Furthermore, the edge device utilizes the decryption engine built into the secure execution environment to perform decryption operations on the encrypted model file. This decryption operation uses the key and algorithm corresponding to the encryption process to restore the encrypted model file from ciphertext to plaintext model data. After decryption, the model data is loaded into the edge device's memory. For TrustZone technology, the model data is loaded into a physical memory region within the secure world. The memory page tables in this region are configured to be accessible only within the secure world; any program outside the secure world attempting to access this region will trigger a hardware-level access exception. For Software Guard Extensions technology, the model data is loaded within an enclave. The enclave memory is encrypted in real-time by the processor's internal memory encryption engine, ensuring that even if an attacker probes the memory bus with a physical probe, the data obtained remains encrypted.

[0049] In some preferred embodiments, loading the model data into the memory of the edge device, wherein the model data is stored in a protected form in the memory, includes: invoking the secure execution environment built into the edge device, initiating a secure memory allocation request to the secure execution environment to obtain an isolated memory region; writing the model data into the isolated memory region; configuring an access control policy for the isolated memory region to prohibit programs outside the secure execution environment from accessing the isolated memory region, and saving the binding relationship between the access control policy and the model data; generating a memory access identifier for the model data based on the binding relationship; obtaining the device hardware identifier of the edge device, and associating and storing the memory access identifier with the device hardware identifier; in response to detecting an access request for the isolated memory region, determining whether the access request is an illegal access request based on the consistency verification result of the memory access identifier and the device hardware identifier; if the access request is an illegal access request, denying the initiator of the access request access to the isolated memory region.

[0050] In specific implementation, this embodiment utilizes the secure memory allocation, hardware-level access control, and device identifier binding mechanism provided by the secure execution environment to implement multi-dimensional runtime protection after the model data is loaded into memory. This effectively prevents attackers from stealing model data through debugging interfaces, memory dumps, or device migrations. The specific implementation method is as follows: The edge device invokes its built-in Secure Execution Environment (SEA) to initiate a secure memory allocation request, obtaining an isolated memory region. The SEA provides a dedicated secure memory allocation application programming interface (API), implemented internally. For the ARM TrustZone architecture, this interface corresponds to a security monitoring call instruction, used to switch from the insecure world to the secure world and perform memory allocation operations within the secure world. For the Intel Software Guard Extensions (SGX) architecture, this interface corresponds to an enclave creation instruction, used to initialize a new protected memory region within the enclave. The edge device requests a secure memory block equal in size to the model data size from the SEA through the aforementioned interface. The SEA's memory management unit allocates a contiguous or non-contiguous physical memory region from the secure memory pool for this request. The location of this region in the physical address space is invisible to the insecure world. The SEA encapsulates the starting address and length of the allocated memory region into a memory handle and returns it to the edge device.

[0051] Furthermore, the edge device writes the model data into the isolated memory region. The edge device copies the decrypted model data from the temporary buffer to the isolated memory region. This write operation is performed internally within the secure execution environment; the data exists in plaintext within the isolated memory region, but no program in the normal execution environment can read or modify the contents of this region using normal memory access instructions. After the write is complete, the model data is ready in the isolated memory region and can be read for subsequent inference calculations.

[0052] Furthermore, the edge device configures the access control policy for the isolated memory region, prohibiting programs outside the secure execution environment from accessing the isolated memory region, and maintains the binding relationship between the access control policy and the model data. The hardware of the secure execution environment provides memory access control functionality, which achieves fine-grained control over access permissions by configuring the page table entries or memory attribute registers of the memory management unit corresponding to the isolated memory region. The edge device calls the memory management interface of the secure execution environment to set the access permission of the isolated memory region to be accessible only within the secure execution environment. This setting takes effect at the hardware level; even if an operating system kernel running in a normal execution environment attempts to access the isolated memory region, it will trigger a hardware-level access exception. Simultaneously, the edge device maintains a mapping record table within the secure execution environment, establishing a binding relationship between the unique identifier of the isolated memory region and the metadata of the model data stored therein.

[0053] Furthermore, based on the binding relationship, the edge device generates a memory access identifier for the model data. The memory access identifier is a fixed-length binary string used to uniquely identify the binding relationship between the current model data and the isolated memory region during subsequent access verification. The edge device performs a secure hash operation on each piece of information in the binding relationship to obtain the memory access identifier. The secure hash operation can use a secure hash algorithm (such as the SHA-256 algorithm), which maps input data of arbitrary length to a fixed-length hash value that is collision-resistant.

[0054] Further, the edge device obtains its device hardware identifier and associates the memory access identifier with it for storage. The device hardware identifier is a globally unique identifier written into a one-time programmable memory or secure element during the edge device's manufacturing process, including but not limited to a processor unique identifier, a secure element's unique serial number, or the edge device's media access control address. The edge device reads this device hardware identifier through the secure execution environment's internal interface at factory launch or during initial initialization and stores it, along with the memory access identifier, as an association record in the secure execution environment's internal persistent storage area. This association record remains unchanged throughout the device's lifecycle unless the model data is unloaded and reloaded.

[0055] Furthermore, in response to detecting an access request for the isolated memory region, the edge device determines whether the access request is an illegal access request based on the consistency verification result of the memory access identifier and the device hardware identifier. The hardware-level memory monitoring mechanism of the secure execution environment can intercept all access requests for the isolated memory region in real time and report the caller information carried in the access request to the security monitoring module of the edge device. The caller information includes the type of the execution environment in which the caller resides, the process identifier of the caller, and the access credentials claimed by the caller. The security monitoring module of the edge device extracts the memory access identifier claimed by the caller from the access request and compares it with the memory access identifier in the associated storage; at the same time, it extracts the hardware identifier of the device in which the caller resides and compares it with the device hardware identifier in the associated storage. If both identifiers match, the access request is determined to be a legitimate access; if the memory access identifier or the device hardware identifier does not match, the access request is determined to be an illegal access request. If the access request is an illegal access request, the edge device denies the initiator of the access request access to the isolated memory region. The denial method involves the security monitoring module returning an access denial control signal to the memory management unit of the secure execution environment. Upon receiving this signal, the memory management unit terminates the current access operation, returns a permission error status code to the initiator, and records detailed information about this illegal access event in the log of the secure execution environment.

[0056] This embodiment utilizes secure memory allocation and hardware-level access control mechanisms within a secure execution environment to provide a protected storage area for model data loaded into memory, completely isolated from the normal execution environment. This prevents attackers from reading model data from the isolated memory area through normal memory access instructions, even if they gain the highest administrative privileges of the operating system via software vulnerabilities. Furthermore, by associating memory access identifiers with device hardware identifiers and performing bidirectional consistency verification on each access request, a strong binding between model data and specific edge device hardware is achieved. Even if an attacker migrates the entire physical memory containing the isolated memory area to another device or replicates the entire execution environment using virtual machine migration technology, all access requests to the isolated memory area will be rejected because the device hardware identifier of the target device is inconsistent with the associated stored identifier. This effectively prevents the theft of model data through cross-device migration.

[0057] S3, in response to receiving the original input data to be inferred, perform an input transformation operation on the original input data to obtain the transformed input data, and save the transformation parameters corresponding to the input transformation operation.

[0058] In specific implementation, upon receiving the raw input data to be inferred, the edge device performs an input transformation operation on the raw input data to obtain the transformed input data and saves the transformation parameters corresponding to the input transformation operation. In the embodied intelligence scenario, the raw input data refers to the data to be processed obtained by the edge device from external sensors or data sources, including but not limited to image data collected by cameras, 3D point cloud data collected by LiDAR, acceleration and angular velocity data collected by inertial measurement units, and audio data collected by microphones. The above-mentioned raw input data is usually represented in tensor form. A tensor is a multidimensional array data structure, and the number of dimensions and the size of each dimension are determined by the specific sensor and data format. For example, a color image with a resolution of 640×480 is represented as a three-dimensional tensor with a shape of (3, 480, 640), where the first dimension corresponds to the three color channels (red, green, and blue), and the second and third dimensions correspond to the height and width of the image. Furthermore, before sending the raw input data into the physical model for inference calculation, the edge device first performs an input transformation operation on the raw input data. The input transformation operation is a reversible mathematical transformation applied to the original input tensor. Its purpose is to disrupt the true correspondence between the original input data and the model output, so that even if an attacker intercepts the inference request and response, they cannot obtain valid input-output sample pairs. Furthermore, the specific implementation of the input transformation operation will be described in detail in subsequent embodiments. After executing the input transformation operation, the edge device stores the random parameters on which the transformation operation depends as transformation parameters in a designated location in memory. These transformation parameters will be read and used in the subsequent inverse transformation step.

[0059] In some preferred embodiments, the step of performing an input transformation operation on the original input data to obtain transformed input data and saving the transformation parameters corresponding to the input transformation operation includes: obtaining the current system clock value of the edge device when receiving the original input data, and using the current system clock value as a random seed; generating a first random transformation parameter and a second random transformation parameter based on the random seed using a pseudo-random algorithm, wherein the first random transformation parameter is used to control the magnitude of adding random noise, and the second random transformation parameter is used to control the permutation mapping rule for scrambling and rearranging data elements; performing an additive random noise addition operation on the original input data based on the first random transformation parameter to obtain noisy data; obtaining the dimension information of the noisy data, and performing a position scrambling operation on each data element in the noisy data based on the second random transformation parameter and the dimension information to obtain transformed input data; combining the first random transformation parameter and the second random transformation parameter into a transformation parameter group, and saving the transformation parameter group as the transformation parameters.

[0060] In specific implementation, this embodiment generates pseudo-random transformation parameters by utilizing the unpredictability of the system clock value. During the transformation process, additive random noise is first added, followed by a two-layer transformation with position scrambling. Finally, the parameters of the two transformations are combined into a parameter set and saved. This effectively disrupts the input-output correspondence while ensuring accurate restoration of the inverse transformation. The specific implementation method is as follows: The edge device acquires the current system clock value when receiving the raw input data and uses this current system clock value as a random seed. The system clock value is a timer count maintained by the edge device's operating system kernel, typically driven by a hardware timer, providing microsecond or even nanosecond-level time resolution. When the edge device receives the raw input data, it reads the current high-precision timestamp using the system time acquisition function provided by the operating system. This timestamp is a monotonically increasing integer value with sufficiently large differences at different times on the same device, making it impossible for an attacker to predict the value of the random seed by inferring the time. The edge device uses this timestamp value as a random seed to drive the subsequent pseudo-random number generation process.

[0061] Furthermore, based on the random seed, the edge device generates a first random transformation parameter and a second random transformation parameter using a pseudo-random algorithm. The first random transformation parameter controls the magnitude of the added random noise, and the second random transformation parameter controls the permutation mapping rule for scrambling and rearranging data elements. The pseudo-random algorithm is a deterministic mathematical algorithm that can generate identical random number sequences given the same seed, allowing the same device to reproduce the transformation parameters based on the same seed in subsequent inverse transformation steps. In this embodiment, the pseudo-random algorithm can be a linear congruential generator, which generates random number sequences using a recursive formula; or it can be a Mason swirl algorithm, which has the advantages of long period and uniform distribution. Further, after inputting the random seed into the pseudo-random algorithm, the edge device obtains a random number sequence, and then extracts two independent random numbers from this sequence, converting them into the first random transformation parameter and the second random transformation parameter, respectively. The first random transformation parameter is a numerical value used to determine the magnitude of the additive random noise added to the original input data, i.e., the standard deviation of the values ​​of each element in the noise tensor. For example, when the original input data is image pixel values ​​normalized to a specific range, the value of the first random transformation parameter can be set within a preset range, corresponding to a certain percentage of noise intensity. Further, the second random transformation parameter is a vector or permutation table used to define the bijective mapping relationship between the positions of each element in the original input data and the positions of each element in the transformed data.

[0062] Furthermore, the edge device performs an additive random noise addition operation on the original input data based on the first random transformation parameters to obtain noisy data. Additive random noise refers to a random perturbation signal superimposed on each element of the original data in an additive manner, and its values ​​are independent of the values ​​of each element in the original data. Specifically, the edge device generates a noise tensor with the exact same shape as the original input data according to the noise amplitude specified by the first random transformation parameters. Each element in this noise tensor is independently sampled from a distribution with a mean of zero and a standard deviation equal to the noise amplitude. Further, the noise distribution type can be Gaussian or uniform. The edge device adds the noise tensor to the original input tensor element by element to obtain the noisy data. Since the value of each element in the noise tensor can be positive or negative, the noisy data undergoes a slight random shift compared to the original data.

[0063] Further, the edge device acquires the dimensional information of the noisy data, and based on the second random transformation parameter and the dimensional information, performs a position scrambling operation on each data element in the noisy data to obtain the transformed input data. Dimensional information refers to the shape of the noisy tensor, i.e., the size of each dimension. The edge device logically expands the noisy tensor into a one-dimensional sequence according to the dimensional information; the expansion order can be row-major or column-major. Further, the edge device rearranges the elements in the one-dimensional sequence according to the permutation mapping rule specified by the second random transformation parameter. The permutation mapping rule is a permutation function defined on the index set, which satisfies the bijective property, i.e., for any two different indices, the mapped indices are also different, and the mapped value range covers the entire index set. Further, the edge device traverses each position in the original sequence, moving the element at that position in the original sequence to the mapped position in the new sequence. After scrambling, the edge device reshapes the new sequence according to the dimensional information of the original tensor into a tensor with the same shape as the noisy data; this tensor is the transformed input data.

[0064] Furthermore, the edge device combines the first random transformation parameter and the second random transformation parameter into a transformation parameter group, and saves the transformation parameter group as the transformation parameters. The transformation parameter group is a data structure used to uniformly store multiple transformation-related parameters; it can be in the form of a structure or a key-value pair mapping table. Further, the transformation parameter group at least includes the value of the first random transformation parameter, the permutation vector or mapping table of the second random transformation parameter, and may also include a transformation type identifier and a timestamp when the transformation was executed. Further, the edge device saves the transformation parameter group in a session context object in memory. This session context object is bound to the current inference request, remains valid throughout the processing of the current inference request, and can be released after the inverse transformation step is completed.

[0065] This embodiment uses the system clock value as a random seed and generates random transformation parameters based on a pseudo-random algorithm. This ensures that the transformation parameters used in each inference are unpredictable and independent of each other. Attackers cannot predict the parameter values ​​of subsequent transformations through historical call records, thus preventing the construction of an effective training dataset for model extraction attacks. Furthermore, by combining additive random noise addition and position scrambling, the original input data is obfuscated simultaneously from two dimensions: data amplitude and data arrangement order. Even if attackers estimate the statistical characteristics of the noise using statistical methods, they still face interference from the scrambled data element arrangement order. Furthermore, by combining and storing the first and second random transformation parameters into a transformation parameter group, the inverse transformation step can completely and accurately reproduce the full parameter information of the input transformation, avoiding restoration errors caused by parameter loss and ensuring that the inference output is completely consistent with the output without transformation in terms of numerical precision.

[0066] S4, input the transformed input data into the model data in the memory to perform inference calculations and obtain the original inference output result.

[0067] In practice, the edge device inputs the transformed input data into the model data in memory to perform inference calculations and obtain the original inference output result. The specific process of inference calculation is as follows: the edge device uses the transformed input tensor as the input to the physical model and performs operations layer by layer according to the forward propagation path defined by the model computation graph. For convolutional neural networks, forward propagation includes convolutional layer operations, pooling layer operations, activation function operations, and fully connected layer operations. The output tensor of each layer serves as the input tensor of the next layer, passed step by step, and finally, the original inference output result is obtained at the model's output layer. Furthermore, for Transformer architecture models, forward propagation includes multi-head self-attention operations and feedforward network operations. Since the input data has been transformed, this original inference output result corresponds to the output value of the transformed input data, rather than the inference result corresponding to the actual original input data.

[0068] S5, obtain the transformation parameters, and perform an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result.

[0069] In specific implementation, the edge device acquires the transformation parameters and performs an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result. The inverse transformation operation is the exact mathematical inverse operation of the input transformation operation. If the input transformation operation is to add random noise, the inverse transformation operation is to subtract a noise tensor with the same parameters from the original inference output result; if the input transformation operation is to scramble and rearrange the data elements, the inverse transformation operation is to restore the original arrangement order of each element according to the inverse mapping of the same arrangement mapping rules. Further, the edge device reads the transformation parameters from the location where the transformation parameters were previously saved, performs an inverse transformation operation on the original inference output result based on the transformation parameters, and restores the result to the final inference output corresponding to the real original input data. This final inference output result is mathematically completely equivalent to the output obtained by directly inputting the original input data into the untransformed physical model, so the upper-layer application can obtain the correct inference result without being aware of the transformation process.

[0070] This embodiment integrates secure storage of encrypted model files, decryption and loading based on a secure execution environment with memory protection, random transformation of input data, and inverse transformation of output data into a complete technical chain, achieving comprehensive protection of the physical model from storage state to runtime state and then to inference input and output. Furthermore, at the storage level, encrypted storage prevents attackers from extracting valid model data from non-volatile storage media; further, at the runtime level, hardware-level memory isolation of the secure execution environment ensures that model data always exists in a protected form in memory, preventing attackers from obtaining model parameters through memory dumps, debugging interfaces, or cold start attacks; further, at the data level, input transformation and inverse output transformation ensure that even if an attacker can call the inference interface in a black box, the obtained input-output correspondence is obfuscated and invalid data, unusable for training alternative models. These multiple protection links work synergistically and complement each other, eliminating security blind spots between individual points of protection and significantly reducing the time and computational costs required for attackers to steal models or reverse engineer them.

[0071] In some preferred embodiments, the step of obtaining the transformation parameters and performing an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result includes: obtaining the saved transformation parameter group; performing a parsing operation on the transformation parameter group to obtain the first random transformation parameter and the second random transformation parameter; determining the position recovery rule corresponding to the position scrambling operation based on the second random transformation parameter, and performing a position recovery operation on each data element in the original inference output result according to the position recovery rule to obtain the position-recovered data; determining the denoising rule corresponding to the additive random noise addition operation based on the first random transformation parameter, and performing a denoising operation on the position-recovered data according to the denoising rule to obtain the inversely transformed data; and using the inversely transformed data as the final inference output result.

[0072] In specific implementation, this embodiment parses the first and second random transformation parameters from the transformation parameter set, and strictly follows the order of position recovery followed by denoising to perform the inverse transformation, ensuring accurate restoration of the inference output result. The specific implementation method is as follows: The edge device acquires the saved transformation parameter set. The transformation parameter set is a data structure that is saved to the session context object during the input transformation step in Embodiment 2. The edge device reads the complete contents of the transformation parameter set from the session context object associated with the current inference request.

[0073] Further, the edge device performs a parsing operation on the transformation parameter group to obtain the first random transformation parameter and the second random transformation parameter. The specific process of the parsing operation is as follows: the edge device extracts the corresponding field values ​​from the predefined data structure format of the transformation parameter group. If the transformation parameter group adopts a structure format, the parsing operation directly reads each field through structure member access; if the transformation parameter group adopts a key-value pair mapping table format, the parsing operation reads its value by looking up the key corresponding to each field. After parsing, the edge device obtains the values ​​of the first random transformation parameter and the second random transformation parameter.

[0074] Further, the edge device determines the position recovery rule corresponding to the position scrambling operation based on the second random transformation parameter, and performs the position recovery operation on each data element in the original inference output result according to the position recovery rule to obtain the position-recovered data. The position recovery rule is the exact inverse mapping of the position scrambling operation. In the input transformation step of the above embodiment, the second random transformation parameter defines a permutation function, which maps each element in the sequence after the input tensor is expanded from its original position to a new position. The position recovery rule is the inverse mapping of this permutation function, which maps each element from its scrambled position back to its original position. The edge device obtains the original inference output result, treats it as a tensor with the same shape as the transformed input data, and expands the tensor into a one-dimensional sequence. Further, the edge device traverses each position in the one-dimensional sequence, finds the position of the element at that position in the original arrangement according to the inverse mapping, and moves the element to that original position in the new sequence. Further, after the traversal is completed, the edge device obtains a new sequence in which each element has been restored to its original arrangement order. The edge device reshapes the new sequence into a tensor form according to the dimensional information of the original tensor, thus obtaining the data after position recovery.

[0075] Further, the edge device determines a denoising rule corresponding to the additive random noise addition operation based on the first random transformation parameters, and performs a denoising operation on the position-recovered data according to the denoising rule to obtain the inverse-transformed data. The denoising rule is the exact inverse operation of the additive random noise addition operation. In the input transformation step of the above embodiment, the edge device generates a noise tensor according to the noise amplitude specified by the first random transformation parameters and superimposes it onto the original input data. The denoising operation is to subtract the noise tensor from the position-recovered data. The edge device regenerates a noise tensor with the same shape as the position-recovered data according to the first random transformation parameters. The regeneration process uses the same pseudo-random algorithm and the same random seed as in the input transformation step to ensure that the generated noise tensor is completely consistent with the noise tensor in the input transformation step. The edge device subtracts the noise tensor element by element from the position-recovered data to obtain the inverse-transformed data. The inverse-transformed data is the inference result corresponding to the real original input data.

[0076] Furthermore, the edge device uses the inversely transformed data as the final inference output. The edge device then outputs the inversely transformed data to the upper-layer application for subsequent business logic. Because this data has undergone complete inverse transformation, its value is mathematically equivalent to the inference output obtained by directly inputting the original input data into the untransformed physical model. The upper-layer application can use this result normally without any additional adaptation.

[0077] This embodiment extracts the first and second random transformation parameters by performing analytical operations on the transformation parameter set, ensuring that the inverse transformation step can completely acquire all parameter information used in the input transformation step. By performing the position recovery operation first and then the denoising operation, the transformation effect is gradually revoked in the reverse order of the input transformation step, ensuring the mathematical reversibility of the inverse transformation process. Furthermore, the precise correspondence between the position recovery rule and the position scrambling operation, as well as the precise correspondence between the denoising rule and the additive random noise addition operation, ensures that the inference output is completely consistent with the original inference output after complete input transformation and output inverse transformation processing. This effectively defends against model extraction attacks without negatively impacting the model's normal inference function.

[0078] In some preferred embodiments, the method further includes: during the operation of the inference service on the edge device, collecting external call records to the inference interface, the call records including call timestamps and call input data; calculating the number of calls per unit time based on the call records to obtain the call frequency; determining whether the call frequency exceeds a preset frequency threshold; if the call frequency exceeds the preset frequency threshold, generating an alarm signal; if the call frequency does not exceed the preset frequency threshold, further extracting distribution features from the call input data to obtain the distribution features of the call data, and determining whether the distribution features of the call data conform to preset regularity sampling features; if the distribution features of the call data conform to the regularity sampling features, generating an alarm signal; if the distribution features of the call data do not conform to the regularity sampling features, maintaining the current monitoring state.

[0079] In specific implementation, this embodiment continuously collects call records, counts call frequencies, and analyzes the distribution characteristics of call input data during the inference service's operation. This identifies model extraction attacks carried out by attackers through high-frequency queries or regular sampling, and triggers alarms when anomalies are detected. This adds a proactive runtime detection capability to the entire defense system. The specific implementation method is as follows: During the operation of the edge device's inference service, the edge device collects external call records to the inference interface. These call records include call timestamps and input data. The inference service is a network service interface providing model inference functionality to the edge device. It is typically implemented based on the Hypertext Transfer Protocol (HTTP) or a Remote Procedure Call (RPC) framework, listening for connection and inference requests from external applications on a designated network port of the edge device. The edge device generates a structured call record for each received inference call, which is stored as a log in a memory buffer or persistent storage. Each call record contains at least two core fields: a call timestamp field, which records the precise time the call occurred, generated by the edge device's system clock upon receiving the request; and a call input data field, which records the complete value of the input tensor carried in the call or a representative feature value after downsampling.

[0080] Furthermore, the edge device calculates the call frequency by counting the number of calls per unit time based on the call records. The edge device performs the statistics in units of a preset time window, the value of which can be configured according to the expected load characteristics of the inference service. At the beginning of each time window, the edge device resets the counter to zero, and then increments the counter for each new call record arriving within that time window. When the time window ends, the final value of the counter is divided by the length of the time window to obtain the average call frequency within that time window.

[0081] Furthermore, the edge device determines whether the call frequency exceeds a preset frequency threshold. The preset frequency threshold is a pre-configured value, determined based on the typical call load of the edge device under normal business scenarios. If the call frequency exceeds the preset frequency threshold, the edge device generates an alarm signal, which can be a system log entry, an email sent to security administrators, an alarm message pushed to the security management platform, or a combination of these. If the call frequency does not exceed the preset frequency threshold, the edge device further extracts the distribution features of the call input data to obtain the distribution features of the call data, and determines whether the distribution features of the call data conform to preset regularity sampling features.

[0082] Furthermore, the specific process for extracting distribution features is as follows: The edge device collects input data from all call records within the current time window. For each input tensor, it divides it into intervals in the numerical domain. For example, if the input data is a floating-point tensor normalized to a specific interval, the edge device divides this interval into multiple equal-width sub-intervals. Then, it counts the number of elements in all input data within the current time window that fall into each sub-interval, and normalizes the counts of each sub-interval into a probability distribution vector. This probability distribution vector is the distribution feature of the call data. Regular sampling features are a typical behavioral pattern exhibited by attackers when carrying out model extraction attacks. Furthermore, in model extraction attacks, in order to obtain full coverage of the model's decision boundary, attackers often systematically traverse the entire input space. Their sampling strategy usually manifests as selecting sampling points at equal intervals in the numerical domain or distributing them evenly across all dimensions.

[0083] Based on this, the regularity sampling characteristics include the following detectable modes: the input data covers a preset number of equally spaced sampling points in the numerical domain, or the edge distribution of the input data in each dimension exhibits a nearly uniform distribution, or there is an arithmetic sequence relationship between the input data of different calls. If the distribution characteristics of the call data conform to the regularity sampling characteristics, the edge device generates an alarm signal. If the distribution characteristics of the call data do not conform to the regularity sampling characteristics, the edge device maintains the current monitoring state, that is, continues to collect subsequent call records and executes the above judgment process again in the next time window.

[0084] This embodiment continuously collects call records and calculates call frequency in real time during inference service operation, enabling rapid identification of abnormal behavior in the early stages of attackers launching model extraction attacks through high-frequency calls to the inference interface. Furthermore, frequency threshold judgment, as the first line of rapid detection, can trigger alarms promptly when there is a sudden surge in attacker call volume. Moreover, by extracting and analyzing the distribution characteristics of the call input data, it is possible to identify the regular sampling strategies adopted by attackers to comprehensively cover the input space. Even if the attacker's call frequency remains within a normal range to circumvent frequency threshold detection, distribution feature analysis can still detect attack behavior by identifying regular patterns in the input. These dual judgment mechanisms complement each other: high-frequency detection provides rapid, coarse-grained anomaly identification, while distribution feature analysis provides more accurate, fine-grained behavior identification. The combined use of both can effectively detect various model extraction attack attempts while maintaining a low false positive rate, providing proactive runtime defense capabilities for the entire model protection system.

[0085] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0086] Please see Figure 2 , Figure 2 This is a schematic block diagram of a computer device provided in an embodiment of this application. The computer device 500 can be a terminal or a server, wherein the server can be a standalone server or a server cluster composed of multiple servers.

[0087] The computer device 500 includes a processor 502, a memory, and a network interface 505 connected via a system bus 501. The memory may include a non-volatile storage medium 503 and internal memory 504.

[0088] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. When the computer program 5032 is executed, it causes the processor 502 to execute a method for protecting intellectual property rights of a physical model in an embodied intelligent scenario.

[0089] The processor 502 provides computing and control capabilities to support the operation of the entire computer device 500.

[0090] The internal memory 504 provides an environment for the execution of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a method for protecting the intellectual property rights of a physical model in an embodied intelligent scenario.

[0091] The network interface 505 is used for network communication with other devices. Those skilled in the art will understand that the above structure is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device 500 to which the present application is applied. A specific computer device 500 may include more or fewer components than shown in the figures, or combine certain components, or have different component arrangements.

[0092] The processor 502 is used to run a computer program 5032 stored in a memory to implement the steps of the method for protecting the intellectual property rights of a physical model in an embodied intelligent scenario provided in any of the above method embodiments.

[0093] It should be understood that in the embodiments of this application, the processor 502 may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0094] It will be understood by those skilled in the art that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program may be stored in a storage medium, which is a computer-readable storage medium. The computer program is executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0095] Therefore, the present invention also provides a storage medium. This storage medium can be a computer-readable storage medium. The storage medium stores a computer program. When executed by a processor, the computer program causes the processor to perform the steps of the method for protecting intellectual property rights of a physical model in an embodied intelligent scenario provided in any of the above-described method embodiments.

[0096] The storage medium is a physical, non-transient storage medium, such as a USB flash drive, external hard drive, read-only memory (ROM), magnetic disk, or optical disk, or any other physical storage medium capable of storing program code. The computer-readable storage medium can be non-volatile or volatile.

[0097] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0098] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is merely a logical functional division, and there may be other division methods in actual implementation. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.

[0099] The steps in the method of this invention can be adjusted, merged, or reduced in order according to actual needs. The units in the device of this invention can be merged, divided, or reduced according to actual needs. Furthermore, the functional units in the various embodiments of this invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0101] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0102] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, this invention is also intended to include these modifications and variations as long as they fall within the scope of the claims of this invention and their equivalents.

[0103] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for protecting intellectual property rights of physical models in embodied intelligent scenarios, characterized in that, include: In response to a received model loading trigger command, an encrypted model file is retrieved from the non-volatile storage medium of the edge device. The encrypted model file is obtained by encrypting the physical model. Based on the secure execution environment built into the edge device, the encrypted model file is decrypted to obtain model data, and the model data is loaded into the memory of the edge device. The model data is stored in the memory in a protected form, which is hardware-level memory isolation based on the secure execution environment. In response to receiving the original input data to be inferred, an input transformation operation is performed on the original input data to obtain the transformed input data, and the transformation parameters corresponding to the input transformation operation are saved. The transformed input data is input into the model data in the memory to perform inference calculations, and the original inference output result is obtained. Obtain the transformation parameters, and perform an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result.

2. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 1, characterized in that, The step of performing an input transformation operation on the original input data to obtain transformed input data and saving the transformation parameters corresponding to the input transformation operation includes: Obtain the current system clock value of the edge device when receiving the raw input data, and use the current system clock value as a random seed; Based on the random seed, a first random transformation parameter and a second random transformation parameter are generated by a pseudo-random algorithm. The first random transformation parameter is used to control the magnitude of the added random noise, and the second random transformation parameter is used to control the permutation and mapping rules for scrambling and rearranging data elements. Based on the first random transformation parameters, an additive random noise addition operation is performed on the original input data to obtain the noisy data; Obtain the dimensional information of the noisy data, and based on the second random transformation parameter and the dimensional information, perform a position scrambling operation on each data element in the noisy data to obtain the transformed input data; The first random transformation parameter and the second random transformation parameter are combined into a transformation parameter group, and the transformation parameter group is saved as the transformation parameter.

3. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 1, characterized in that, The step of loading the model data into the memory of the edge device, wherein the model data is stored in the memory in a protected form, includes: The edge device's built-in secure execution environment is invoked, and a secure memory allocation request is sent to the secure execution environment to obtain an isolated memory region. Write the model data into the isolated memory area; Configure the access control policy for the isolated memory region to prohibit programs in non-secure execution environments from accessing the isolated memory region, and save the binding relationship between the access control policy and the model data; Based on the binding relationship, a memory access identifier for the model data is generated; Obtain the device hardware identifier of the edge device, and associate and store the memory access identifier with the device hardware identifier; In response to the detection of an access request for the isolated memory region, the system determines whether the access request is an illegal access request based on the consistency verification result of the memory access identifier and the device hardware identifier. If the access request is an illegal access request, then the party initiating the access request is denied access to the isolated memory region.

4. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 1, characterized in that, The encrypted model file is obtained in advance through the following method: Obtain the original physical model file, and perform obfuscation processing on the computation graph structure of the original physical model file to obtain an obfuscated model file; Generate a hidden digital watermark sequence for ownership tracing, and embed the hidden digital watermark sequence into the obfuscation model file to obtain an obfuscation model file carrying the watermark; An encryption operation is performed on the obfuscated model file carrying the watermark to generate an encrypted model file; The encrypted model file is stored in the non-volatile storage medium of the edge device.

5. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 4, characterized in that, The computational graph structure of the original physical model file is obfuscated to obtain an obfuscated model file, including: Perform a parsing operation on the computation graph structure of the original physical model file to obtain the original computation graph; Traverse each computation node in the original computation graph and insert invalid computation nodes in the original computation graph. The invalid computation nodes contain random operation types and random tensor data. Randomize and rename all node names in the computation graph after inserting invalid computation nodes to obtain an obfuscated computation graph; An obfuscation model file is generated based on the obfuscation computation graph.

6. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 4, characterized in that, The process of generating a hidden digital watermark sequence for ownership tracing, embedding the hidden digital watermark sequence into the obfuscation model file to obtain an obfuscation model file carrying the watermark, includes: A redundancy space scan operation is performed on the model parameters of the obfuscated model file to determine the available redundant bits in the model parameters; Generate a hidden digital watermark sequence for ownership tracing; The hidden digital watermark sequence is embedded into the available redundant bits to obtain an obfuscated model file carrying the watermark; Perform watermark embedding verification on the obfuscated model file carrying the watermark to confirm that the hidden digital watermark sequence has been correctly written; Obtain the device hardware identifier of the edge device, encrypt and bind the device hardware identifier with the hidden digital watermark sequence, generate a binding certificate, and store the binding certificate in the secure execution environment.

7. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 2, characterized in that, The step of obtaining the transformation parameters and performing an inverse transformation operation corresponding to the input transformation operation on the original inference output result based on the transformation parameters to generate the final inference output result includes: Obtain the saved transformation parameter set; Perform a parsing operation on the transformation parameter set to obtain the first random transformation parameter and the second random transformation parameter; Based on the second random transformation parameters, a position recovery rule corresponding to the position scrambling operation is determined, and a position recovery operation is performed on each data element in the original inference output result according to the position recovery rule to obtain the position-recovered data; Based on the first random transformation parameters, a denoising rule corresponding to the additive random noise addition operation is determined, and a denoising operation is performed on the data after the position is recovered according to the denoising rule to obtain the data after inverse transformation; The data after the inverse transformation is used as the final inference output.

8. The method for protecting intellectual property rights of physical models in embodied intelligent scenarios according to claim 1, characterized in that, The method further includes: During the operation of the inference service on the edge device, external call records to the inference interface are collected, and the call records include call timestamps and call input data; The call frequency is obtained by counting the number of calls per unit time based on the call records. Determine whether the call frequency exceeds a preset frequency threshold; If the call frequency exceeds the preset frequency threshold, an alarm signal is generated; If the call frequency does not exceed the preset frequency threshold, then the distribution features of the call input data are further extracted to obtain the distribution features of the call data, and it is determined whether the distribution features of the call data conform to the preset regularity sampling features; If the distribution characteristics of the called data conform to the regular sampling characteristics, an alarm signal is generated; If the distribution characteristics of the called data do not conform to the regular sampling characteristics, the current monitoring status shall be maintained.

9. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, can implement the method as described in any one of claims 1-8.

Images