A computing model optimization system based on a trusted execution environment

Abstract

The application relates to the technical field of computer system model optimization based on specific calculation models, and discloses a calculation model optimization system based on a trusted execution environment, which comprises the following: a resource perception unit acquires storage resource load state data; an operator topology decoupling module decomposes a calculation model into a core operator cluster residing in a protected execution area and an extended operator cluster deployed in a non-trusted execution area according to algebraic sensitivity; a state compression engine converts high-dimensional feature tensors in cross-domain transmission into low-dimensional representation data; a logic compensation module completes tensor dimension reduction based on second-order derivatives in the running process of the core operator cluster, generates residual correction factors to update global weight flow; a feature perturbation unit implants a logic feature pulse; and a path integrity decision module verifies algebraic constraint relations through response fingerprint verification. The application utilizes parameter algebraic correlation to realize dimension reduction, alleviates storage resource physical constraints, and guarantees the security of cross-domain execution logic.

Description

Technical Field

[0001] This invention belongs to the field of computer system model optimization technology based on specific computational models, and particularly relates to a computational model optimization system based on a trusted execution environment. Background Technology

[0002] Current computer systems based on specific computational models, such as deep learning neural networks or large-scale probabilistic graphical model systems, employ processor privilege level partitioning and hardware encryption engines to construct a trusted execution environment, providing isolation protection for the execution instructions and parameter matrices of model operators. However, due to the extremely complex logical relationships between operators within the computational model, the scale of computational model parameters and intermediate state quantities grow non-linearly, and the protected physical memory capacity has an inherent upper limit. When the logical addressing space of the computational model exceeds the physical segmentation boundary, encrypted paging swapping occurs, resulting in bus blocking when model state quantities cross security boundaries.

[0003] Existing technologies that optimize pagination replacement algorithms to improve prediction accuracy or employ encrypted compression to reduce data transfer volume do not account for the asymmetric contribution of model operator logic to the global objective, resulting in logical redundancy. Simply increasing physical storage capacity or bit density cannot solve the semantic misalignment problem between the computational model topology and physical isolation boundaries, leading to technical limitations on execution continuity. Addressing the resource bottleneck caused by physical isolation boundaries through hardware optimization alone is insufficient to balance the versatility of the computational model and system flexibility. Existing control methods and software logic solutions also have shortcomings in handling large-scale model inference. For example, [the following is an example from] authorization announcement number CN111049825. B's Chinese invention patent discloses a secure multi-party computation method and system based on a trusted execution environment. It focuses on loading the computation program and verifying bidirectional integrity. It prevents malicious attacks by verifying the legitimacy of the computation program within the trusted execution environment. This approach treats the computation task as a static black box and lacks in-depth perception of the contribution of the internal operator logic and algebraic sensitivity. When processing ultra-large-scale computation models, the coarse-grained full loading mode intensifies the conflict between the model state space and the limited isolation resources. This causes the system to fall into page-splitting jitter under load fluctuations because it cannot elastically adjust the computation density. The single authentication mechanism is difficult to identify semantic pollution attacks, resulting in an imbalance between execution efficiency and security.

[0004] Therefore, how to adapt the model state space to limited isolated resources while maintaining logical consistency is the technical problem that this invention aims to solve. Summary of the Invention

[0005] This invention provides a computational model optimization system based on a trusted execution environment, the system comprising: The resource awareness unit is used to acquire storage resource load status data within the protected execution area; The operator topology decoupling module is used to decompose the computation model to be executed into a core operator cluster residing in the protected execution region and an extended operator cluster deployed in the untrusted execution region, based on the algebraic sensitivity of each operator of the computation model to the model output. The state compression engine is used to receive high-dimensional feature tensors transmitted across domains from the core operator cluster to the extended operator cluster, and to use nonlinear projection operators to convert the high-dimensional feature tensors into initial low-dimensional representation data. The logic compensation module, deployed in the protected execution region, is used to extract the second derivative during the operation of the core operator cluster. Combined with the low-dimensional representation data fed back from the untrusted execution region, it performs tensor dimension reduction operation using the algebraic fitting rule based on the second derivative to generate residual correction factors and superimpose them into the global weight flow of the computational model to be executed. The feature perturbation unit is used to implant logical feature pulses that follow a preset algebraic distribution into the initial low-dimensional representation data, generate low-dimensional representation data with pulses, and transmit them to the extended operator cluster. The path integrity adjudication module is used to extract the response fingerprint carried in the operation results returned by the extended operator cluster and verify whether the response fingerprint satisfies the preset algebraic constraint relationship.

[0006] Preferably, the specific process of operator deconstruction performed by the operator topology decoupling module includes: Step S1, obtaining the parameter gradient vector and weight modulus of each operator in the computational model to be executed; Step S2, calculating the algebraic sensitivity index of each operator based on the logical path depth of the computational model to be executed in the computational graph; Step S3, the resource awareness unit generates a dynamic resource threshold based on the storage resource load status data, maps and compares the algebraic sensitivity index with the resource threshold, divides the operators that meet the security distribution conditions into core operator clusters, and divides the remaining operators into extended operator clusters; Step S4, establishing the topological connection relationship between the core operator clusters and the extended operator clusters, and generating a cross-domain operator call sequence.

[0007] Preferably, the state compression engine includes a projection transformation unit. Before the core operator cluster performs cross-domain communication, the projection transformation unit uses a nonlinear projection operator to compress the original dimension of the high-dimensional feature tensor to below a preset compression threshold. This is used to adjust the occupancy rate of encrypted data on the system bus bandwidth and maintain the data throughput within the protected execution area.

[0008] Preferably, the logic compensation module utilizes the second derivative properties of the core operator cluster within the protected execution region to reconstruct the missing high-dimensional features in the low-dimensional representation data by performing latent variable recovery operations. The latent variable recovery operations include generating residual correction factors by algebraically fitting the projection loss and superimposing the residual correction factors into the global weight flow of the computational model to be executed, so as to offset the algebraic accuracy loss when the extended operator cluster performs transformations in the untrusted execution region.

[0009] Preferably, in step S2, the algebraic sensitivity index The calculation rules follow the following formula: ,in, The algebraic sensitivity index of the operator. For the first The gradient magnitude of each parameter, For the first The weight contribution coefficient of each parameter, Let be the logical path depth of the operator in the computation graph. The physical storage space occupied by the operator, and The unit of measurement is bytes. This represents the total number of parameters contained in the operator.

[0010] Preferably, the specific process by which the path integrity adjudication module verifies whether the response fingerprint satisfies the preset algebraic constraint relationship includes: identifying semantic pollution attacks suffered by operator weights in untrusted execution regions by comparing the linear offset between the response fingerprint and the preset logical feature pulse. The identification criterion is the degree of orthogonality deviation between the response fingerprint and the preset logical feature pulse in a specific algebraic space. When the linear offset exceeds the preset security threshold, a control command is output to drive the core operator cluster execution state to roll back or disconnect the logical connection with the extended operator cluster.

[0011] Preferably, the resource awareness unit monitors the memory access frequency of the protected execution area and drives the state compression engine to dynamically adjust the transformation dimension of the nonlinear projection operator. When the data transmission rate characteristics meet the preset bandwidth saturation trigger condition, the compression ratio of the high-dimensional feature tensor is increased.

[0012] Preferably, the protected execution region is constructed as a secure memory partition independent of the main operating system kernel based on a hardware isolation mechanism. The secure memory partition provides encrypted data processing logic and private data storage paths for the core operator cluster through a hardware instruction set.

[0013] Preferably, the logical feature pulses generated by the feature perturbation unit are linearly fused with the low-dimensional representation data in the orthogonal vector space. During the topological transformation process of transmitting the low-dimensional representation data to the extended operator cluster, the logical feature pulses maintain the deterministic mapping of their algebraic distribution characteristics.

[0014] Preferably, it also includes a model reconstruction unit, which, after the computation task is completed, performs a global loss function minimization operation based on the residual correction factor generated by the logic compensation module and the output data of the extended operator cluster, so as to update the operator weights in the protected execution region and the untrusted execution region.

[0015] Compared to existing technologies, the computational model optimization system based on a trusted execution environment of this invention has the following advantages: 1. In the computational model optimization system, the operator topology decoupling module performs analysis on the operator topology of the computational model to be processed, and divides the core operator cluster and extended operator cluster according to the logical contribution of the operator nodes. The operator topology decoupling module keeps the core computational logic residing in the protected execution region. With the help of the state compression engine, it reduces the dimensionality of tensor execution logic transmitted across domains. This asymmetric deployment mechanism based on model semantic awareness reduces the paging frequency between the protected physical memory and the logical address space at the principle level by reconstructing the mapping relationship between the algebraic topology of the computational model and the physical memory boundary. It also reduces the occupation of system bus bandwidth by the frequent transfer of encrypted data, maintains the execution continuity of large-scale model computation flow under physical resource-constrained conditions, and thus achieves elastic adaptation between computational density and isolation resources. This makes the logical capacity of the protected region no longer limited by the physical memory hardware limit.

[0016] 2. The logic compensation module utilizes the real-time running status of the core operator cluster within the protected execution area, combined with low-dimensional representation data to perform latent variable recovery operations. By leveraging the algebraic correlation between parameters within the computational model, it performs information restoration and precision hedging at the logic level to compensate for compression loss. This allows the computer system to achieve logical reorganization while maintaining the accuracy of the computational model output. This approach, which trades computing power within the protected area for cross-domain transmission space, frees the processing capacity of the computational model system from the physical memory capacity limit of the hardware isolation area. It decouples the model parameter scale from the physical constraints of the underlying hardware environment, providing a feasible path for deploying complex model systems on universally accessible computing hardware.

[0017] 3. The feature perturbation unit and the path integrity adjudication module work together to internalize the security verification mechanism into the topological transformation of the model operator by embedding orthogonally distributed logical feature pulses into the output data stream. The system directly extracts the response fingerprint carried in the returned representation data and verifies whether it meets the preset algebraic constraint relationship. Thus, without relying on expensive hardware encryption instructions, it can identify semantic pollution or logical deflection attacks suffered by operator weights in untrusted areas in real time. This asymmetric verification method uses the mathematical characteristics of the computational model in the tensor space to build a defense closed loop, which improves the logical defense depth of the system when performing specific computational tasks in an open environment. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the computational model optimization system of this invention; Figure 2 This is a feature map showing the correlation between response fingerprints and linear offsets under different weight offset levels in this invention; Figure 3This is a timing diagram of the interaction between the operator topology decoupling and cross-domain deployment of the algebraic sensitivity of this invention. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] It should be noted that all directional and positional terms used in this invention, such as: up, down, left, right, front, back, vertical, horizontal, inner, outer, top, low, lateral, longitudinal, center, etc., are only used to explain the relative positional relationship and connection between components in a specific state (as shown in the accompanying drawings). They are only for the convenience of describing this invention and do not require that this invention be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention. In addition, the descriptions of "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly indicating the number of technical features indicated.

[0021] In the description of this invention, unless otherwise explicitly specified and limited, the terms installation, connection, and linking should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal communication between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0022] In the description of this specification, references to the terms "an embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example, and the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0023] A computational model optimization system based on a trusted execution environment includes a resource-aware unit, an operator topology decoupling module, a state compression engine, a logic compensation module, a feature perturbation unit, and a path integrity adjudication module. The resource-aware unit acquires storage resource load status data within the protected execution region and provides it to the operator topology decoupling module. The operator topology decoupling module deconstructs the computational model to be executed into a core operator cluster residing within the protected execution region and an extended operator cluster deployed in the untrusted execution region, based on the algebraic sensitivity index of the operator output of the model. The state compression engine performs nonlinear projection on the high-dimensional feature tensor transmitted across domains, converting it into initial low-dimensional representation data. The logic compensation module, deployed in the protected execution region, extracts the second derivative during the operation of the core operator cluster and performs tensor dimension restoration operations in conjunction with the low-dimensional feedback representation data returned from the untrusted execution region. The feature perturbation unit implants logical feature pulses into the data, and the path integrity adjudication module verifies whether the execution logic of the extended operator cluster satisfies preset algebraic constraints through response fingerprint verification.

[0024] When the physical memory capacity of the protected execution region is constrained by hardware, the parameter matrices of large-scale neural network operators can lead to frequent page swapping overhead. The resource-aware unit reads the page table miss rate and memory access frequency of the protected execution region through the hardware instruction set. The operator topology decoupling module executes the operator deconstruction procedure to obtain the parameter gradient vectors and weight moduli of each operator in the computational model to be executed. Combined with the logical path depth of each operator in the computational graph of the computational model to be executed, the algebraic sensitivity index of each operator is calculated. Algebraic sensitivity index The calculation follows the formula below: ,in, This is an algebraic sensitivity index for operators; For the first Gradient magnitude of each parameter; For the first The weight contribution coefficient of each parameter; The logical path depth of the operator in the computation graph; This refers to the physical storage space occupied by the operator, measured in bytes. This refers to the total number of parameters included in the operator; the operator topology decoupling module determines the resource threshold based on the storage resource load status data, and then applies the algebraic sensitivity index. Operators exceeding the resource threshold are grouped into a core operator cluster and reside in the protected execution region, where they are input with stored resource load status data. With bus utilization The resource awareness unit reads the page table access latency of the protected execution region in real time through the hardware instruction set. Using the formula Dynamically calibrate resource thresholds, coefficients Based on offline gradient experiments, the operator topology decoupling module extracts the operator algebra sensitivity index of the computational model to be executed. Perform domain-specific judgment; if If the operator code segment and parameter matrix are mapped to the encrypted memory address of the protected execution region, the secure address space allocation is triggered. Otherwise, it is marked as an extended operator sinking to the untrusted region. The output is a cross-domain operator call sequence containing physical offsets after topological decoupling, thereby achieving semantic alignment between the logical address space of the computation model and the physical segmentation boundary of the protected execution region.

[0025] Because non-obvious components in cross-domain data streams generate bus bandwidth redundancy, the state compression engine receives high-dimensional feature tensors sent from the core operator cluster to the extended operator cluster and uses a nonlinear projection operator to convert them into initial low-dimensional representation data. Before communication is triggered, the projection transformation unit compresses the original dimension of the high-dimensional feature tensor to below a preset compression threshold. The logic compensation module uses the second derivative properties of the core operator cluster to perform latent variable recovery operations to reconstruct the missing high-dimensional features in the low-dimensional representation data. The latent variable recovery operation generates a residual correction factor by algebraically fitting the projection loss and superimposes this residual correction factor into the global weight stream of the computation model to be executed, which is then input into the core operator cluster to run the gradient. and return low-dimensional representation data The logic compensation module extracts the first-order gradient moment. With second moment ,according to Approximating the diagonal elements of the Hessian matrix, smoothing factor Values ​​based on numerical stability determination Through the feature mapping matrix Perform inverse projection to reconstruct residual benchmark Calculate high-dimensional feature tensors and Inter-projection loss vector The logic compensation module performs matrix multiplication to generate residual correction factors. ,Will Real-time superposition onto the global weight flow offsets the algebraic accuracy loss caused by the nonlinear projection process, ensuring that the output of the extended operator cluster executed in the untrusted region can still maintain globally consistent algebraic convergence accuracy after returning to the protected region.

[0026] When executing extended operator clusters in untrusted regions, there is a risk of operator weights being subjected to semantic pollution attacks. Feature perturbation units implant logical feature pulses following a preset algebraic distribution into low-dimensional representation data. These logical feature pulses and low-dimensional representation data undergo linear fusion in an orthogonal vector space, maintaining a deterministic mapping of the algebraic distribution characteristics during the topology transformation process as the data stream is transmitted to the extended operator cluster. The path integrity adjudication module extracts the response fingerprint from the computation results returned by the extended operator cluster. Weight pollution is identified by comparing the linear offset between the response fingerprint and the preset logical feature pulses. When the linear offset exceeds a preset safety threshold, the path integrity adjudication module outputs control commands to drive the core operator cluster execution state to roll back or disconnect the logical connection with the extended operator cluster; resource awareness. The unit continuously monitors the memory access frequency of the protected execution region. By calculating the rate change slope within adjacent sampling periods, it determines whether the real-time transmission rate has entered the bandwidth saturation range. When the real-time data transmission rate is detected to be in the saturation warning range of 80Mbps to 100Mbps and the rate change slope is greater than the preset growth threshold, the state compression engine is driven to increase the compression ratio of the high-dimensional feature tensor. After the calculation task is completed, the model reconstruction unit performs a global loss function minimization operation based on the residual correction factor and the output data of the extended operator cluster, and updates the operator weights in the protected execution region and the untrusted execution region. The protected execution region is built based on a hardware isolation mechanism, and provides encrypted data processing logic and private data storage paths for the core operator cluster through the hardware instruction set.

[0027] Example 1: In an edge computing node deployed with a large-scale power stability analysis model, the parameter scale of the computational model to be executed is... The maximum physical memory capacity of the protected execution region is... When the system performs real-time inference tasks during transient processes of drastic power load fluctuations, conventional memory page swapping mechanisms generate more than [amount missing]. The computational delay causes real-time control commands to be unable to meet the requirements. The power dispatch time limit is determined by extracting the storage resource load status data of the protected execution area through the resource sensing unit, and then... The capacity limit is determined as the resource threshold for operator distribution. The operator topology decoupling module calculates the algebraic sensitivity index between each convolution operator and the fully connected operator. By combining page table access latency dynamically calibrated using real-time readings from the hardware instruction set, the algebraic sensitivity index of feature extraction operator clusters located in the shallow layer of the computation graph is identified. If the residency conditions are met, it is classified as a core operator cluster and resides within the protected execution region, while the algebraic sensitivity index... Classifier operators that are below or equal to the residency condition are grouped into extended operator clusters and deployed to untrusted execution regions.

[0028] The state compression engine receives high-dimensional feature tensors sent from the core operator cluster to the extended operator cluster, and uses nonlinear projection operators to compress the original... Dimension tensor conversion Low-dimensional representation data reduces the bandwidth consumption of cross-domain communication to its original size. The extended operator cluster processes the low-dimensional representation data in the untrusted execution region and outputs preliminary transformation results. The logic compensation module deployed in the protected execution region simultaneously extracts the second-order derivative information during the core operator cluster's operation. It generates a residual correction factor through algebraic fitting of the projection loss to perform latent variable recovery operations, compensating for the algebraic accuracy loss caused by dimensionality reduction. Simultaneously, a feature perturbation unit implants a set of orthogonally distributed logical feature pulses into the low-dimensional representation data transmitted across domains. The path integrity adjudication module identifies weight tampering by comparing the linear offset between the response fingerprint in the returned results and the logical feature pulses. This process maintains... With the hardware isolation space unchanged, the end-to-end delay of the power analysis task is stabilized at [value missing]. Furthermore, the output voltage stability evaluation index, compared with the results of the complete model running on a high-performance server, shows that the algebraic deviation is controlled within [a certain range]. Within this range, through operator-sensitivity-driven topological decoupling and second-derivative-based algebraic compensation, a large-scale computing model is achieved with high efficiency and security on edge nodes with limited physical storage resources.

[0029] Example 2: In an embedded computing node with a hardware-secure extended architecture, the technical solution is used to process samples with a sampling frequency of The sampling frequency for transient power signals depends on a technical trade-off between the spectral bandwidth of the signal to be monitored and the processing power consumption of the protected execution area. When the bandwidth of the high-frequency components of the signal increases, to avoid signal aliasing under the Nyquist sampling theorem, the sampling frequency tends towards the upper limit of its range. This ensures that the resource sensing unit acquires storage resource load status data with sufficient time resolution. Determine transient surge conditions under power frequency environment. The sampling frequency is set, and the data stream generated by simulated power grid fluctuations is used as the raw input data. A signal-to-noise ratio of [value missing] is actively superimposed onto the raw tensor stream. Gaussian white noise; to verify the synergistic effect of each module, the experiment set up the sample group of the present invention, control group 1 and control group 2. In control group 1, the operator topology decoupling module was removed, and a hardware encrypted paging exchange mechanism was used to process all operators. In control group 2, the logic compensation module was removed, and only the state compression engine performed the dimensionality reduction transmission. It was observed that when the protected physical memory capacity was Under the constraints, sample group A and sample group B of the present invention, with projection dimension ratios of 8.0 and 16.0 respectively, can operate stably. Control group 1, however, suffers from a page table missing rate of [missing value]. While the process is executing to When the system was suspended, although control group 2 continued to run, the final output results were significantly deviated due to the lack of a precision repair mechanism.

[0030] Table 1: Comparison of process parameters and performance of different groups in power stability analysis tasks Referring to Table 1, in this invention, sample group A and sample group B are decoupled using an operator topology decoupling module to convert the algebraic sensitivity index... Core operator clusters with a value higher than 0.85 reside in the protected execution region, and the state compression engine will... The original tensor of dimension 1 is transformed into low-dimensional representation data through a nonlinear projection operator. The logic compensation module extracts the second derivatives during the operation of the core operator cluster and generates residual correction factors, which are then superimposed on the global weight flow of the computational model. When the projection dimension ratio increases from 8.0 to 16.0, the change in inference latency is less than [a certain value]. Furthermore, the final algebraic deviation of the sample group of this invention always remains at The following further verifies the system's defense capability under different weight contamination levels through a problem intensity gradient comparison system. The core problem variable is set as the operator weight offset in the untrusted execution region. The feature perturbation unit implants logical feature pulses that follow an orthogonal distribution into the low-dimensional representation data of cross-domain transmission. The path integrity adjudication module extracts the response fingerprint carried in the return result of the extended operator cluster in real time and calculates the linear offset between it and the preset logical feature pulse. See Table 2 for specific data.

[0031] Table 2: Path integrity verification data under different weight offset levels Referring to Table 2, as the operator weight offset increases within the untrusted region, the linear offset between the response fingerprint and the preset logic feature pulse shows a synchronous growth trend. When the linear offset reaches 0.065, exceeding the preset safety threshold of 0.05, the system triggers a control command to drive the core operator cluster to roll back its execution state. The final output voltage stability evaluation index avoids logic deflection, confirming that the closed-loop verification mechanism based on algebraic constraint verification can identify illegal tampering behavior within the untrusted region. This system uses the second derivative characteristic to recover latent variables, enabling... The model inference accuracy under storage constraints reaches the performance of the full model execution. above.

[0032] Example 3: This example combines Figures 1 to 3This describes an optimization system for a computational model based on a trusted execution environment, such as... Figure 1 As shown, the resource awareness unit obtains storage resource load status data and transmits the load status to the operator topology decoupling module, taking the computation model to be executed as input. The computation model to be executed is deconstructed into a core operator cluster residing in the protected execution region and containing high-dimensional features, and an extended operator cluster deployed in the untrusted execution region. The core operator cluster outputs a high-dimensional tensor to the state compression engine. After the state compression engine performs high-dimensional feature to low-dimensional representation data processing, low-dimensional data is generated. After the feature perturbation unit implants logical feature pulses, it forms a pulsed low-dimensional representation and is transmitted to the extended operator cluster. Low-dimensional feedback and response fingerprints are generated in the untrusted environment. The path integrity adjudication module receives the response fingerprint and verifies the algebraic constraints of the response fingerprint. Based on the verification result, it sends a state rollback instruction to the core operator cluster. At the same time, the logic compensation module receives the low-dimensional feedback and extracts the second derivative of the core operator cluster. It performs dimension restoration and generates residual correction factor operations, and finally outputs the residual correction factor to update the global weight flow.

[0033] like Figure 2 As shown in the chart, the relationship between the fingerprint and pulse values ​​represented by the left vertical axis and the linear offset represented by the right vertical axis is illustrated under the conditions of low, medium, and high offset on the horizontal axis. The scale range of the left vertical axis is 0 to 0.8, and the scale range of the right vertical axis is 0 to 0.25. The preset value of the logical feature pulse is displayed as a solid line and remains constant at 0.5. The response fingerprint value is displayed as a dashed line and increases from 0.51 to 0.72 as the offset level increases. The linear offset is displayed as a dotted line and increases from close to 0 to 0.23 as the offset level increases. This shows that the response fingerprint value and the linear offset increase synchronously with the increase of the weight offset level.

[0034] like Figure 3 As shown, the operator topology decoupling process involves the interaction between the computational model to be executed, the operator topology decoupling module, the resource-aware unit, the protected execution region, and the untrusted execution region. The process begins with submitting the computational model to be deconstructed and the resource-aware unit providing storage resource load status data. Step S1 is then executed to obtain parameter information, including reading and returning the gradient vectors of each operator parameter and reading and returning the weight modulus of each operator. Next, step S2 is executed to calculate sensitivity. The algebraic sensitivity index S of each operator is calculated by obtaining the logical path depth of the operator in the computation graph. Then, step S3 is executed to partition the operator, determine the resource threshold, and compare the sensitivity with the threshold. High-sensitivity operators are divided into core operator clusters and low-sensitivity operators are divided into extended operator clusters. Finally, step S4 is executed to establish connections, establish topological connections between the core and extended operator clusters, and generate cross-domain operator call sequences.

[0035] Example 4: In a multi-task concurrent cloud-based collaborative inference scenario, the feature loss problem during cross-domain transmission is solved through the logic compensation module's procedures. After the operator topology decoupling module deconstructs the computational model to be executed, the core operator cluster within the protected execution region generates intermediate layer feature tensors during forward propagation. The logic compensation module obtains the loss function of the core operator cluster. The diagonal approximation of the second derivative matrix of the weight parameters, i.e., the Hessian matrix. The latent variable recovery operation includes the logic compensation module reading the core operator cluster, the first-order moment estimate and the second-order moment estimate of the gradient within the current iteration period, and calculating the approximate diagonal elements of the Hessian matrix using the following formula. : ,in, This is the diagonal approximation of the Hessian matrix. This is an estimate of the second moment of the gradient, with units of . , As a smoothing factor; the logic compensation module will return the low-dimensional representation data. A linear mapping is performed with the high-dimensional feature space, and the projection loss vector is calculated using the following formula. : ,in, Let be the projection loss vector. For the intermediate layer feature tensor, For low-dimensional representation data, This is the inverse transformation of the projection operator; the logic compensation module utilizes the Hessian matrix approximation. Perform weighted compensation on the projection loss vector to generate residual correction factors. ,in, As a residual correction factor, it is superimposed on the next layer of input operators of the computational model to be executed, thereby achieving algebraic restoration of the model's accuracy.

[0036] The resource-aware unit executes a projection dimension adaptive adjustment procedure based on bandwidth slope, and obtains the real-time transmission rate by monitoring the encrypted data channel between the protected execution region and the untrusted execution region. The slope of the rate change within adjacent sampling periods is calculated using the following formula. : ,in, Real-time transmission rate, unit: , The slope of the rate of change This represents the change in transmission rate. This is a time-varying quantity; the adjustment logic for the projection dimension is: when the real-time transmission rate... In to interval and slope of rate change Greater than the growth threshold At that time, the system-driven state compression engine increased the compression ratio of high-dimensional feature tensors from 8x to 16x, and the paging latency of the protected execution region was reduced from... Descending to The logic compensation module uses the extracted second-derivative features to maintain the global inference loss value at this point. the following.

[0037] The feature perturbation unit and the path integrity adjudication module work together to identify the offset of operator weights. Before the low-dimensional representation data is transmitted to the extended operator cluster, the feature perturbation unit generates a set of values ​​with a mean of 0 and a variance of 0. Gaussian distribution pulse signal And inject it into the non-obvious component orbitals of the low-dimensional representation data, where It is a Gaussian distributed pulse signal. The variance is used; the path integrity adjudication module extracts residual fingerprints from the output data of the extended operator cluster. Calculate residual fingerprints The statistical distribution characteristics, when its variance deviates from the original preset value The magnitude exceeded When the system determines that semantic pollution has occurred in the operator weights within the untrusted execution region, it terminates the current operator call sequence and triggers the redundant backup reload of the core operator cluster.

[0038] Example 5: When the physical memory capacity is On the protected execution area hardware platform, the system initiates a physical baseline calibration procedure before scheduling the computation model. The resource awareness unit loads a baseline image under no-load conditions within the protected execution area and continuously collects page table access latency data for 50 clock cycles by repeatedly calling the hardware monitoring instruction set. A hardware response benchmark is established using the arithmetic mean of the collected samples, and a dynamic deviation is mapped by combining it with the page table miss rate of the current protected physical memory. Initial resource awareness threshold The calculation formula is as follows: ,in, The initial resource awareness threshold; This is the linear correction factor, and its value is in the range of 0.85 to 1.15; The average reference delay is expressed in units of 1. ; As a hardware noise bias, the system performs zero-bit alignment on the storage resource load status data of the protected execution area based on this calibration value, eliminating measurement drift caused by differences in bus bandwidth between different hardware batches.

[0039] When the system requires cross-domain feature tensor dimensionality reduction, the state compression engine loads the feature mapping matrix generated via the offline environment using its nonlinear projection operator. The system utilizes historical power load datasets as excitation sources. Principal component analysis (PCA) is used to extract principal direction vectors from the tensor space. These extracted vectors are then transformed algebraically into fixed-size tensor kernels, which are filled into a private storage path within the protected execution region. The model reconstruction unit synchronously retrieves this feature mapping matrix when loading the computational model to be executed. The system verifies whether its orthogonality index conforms to the preset algebraic constraints. During deployment, the system performs dynamic loading tests based on residual fingerprint features. When the inverse transform loss function value of the projection operator exceeds the preset boundary point of 0.01, the adaptive weight update program is triggered on the feature mapping matrix. Perform local weight fine-tuning.

[0040] Example 6: In a large-scale deployment scenario of a distributed edge computing cluster, the system executes a feature mapping matrix. The offline generation and orthogonalization verification procedure utilizes the singular value decomposition algorithm to extract high-dimensional feature tensors. The principal component space is determined, and transformed basis vectors are constructed iteratively through Gram-Schmidt orthogonalization under controlled conditions. During this process, the operator topology decoupling module minimizes the projection reconstruction error. Determine the projection dimension Projection reconstruction error The calculation formula is as follows: ,in, For projection reconstruction error, This is the inverse transform of the projection operator. For the intermediate layer feature tensor, For low-dimensional representation data, The projection dimension and the unit inner product deviation of the transformed basis vectors. The following algebraic constraints must be satisfied: ,in, The deviation is the unit inner product. and The feature mapping matrix The orthogonal vector components in the matrix are encapsulated as static resource blocks and filled into the protected execution region of each compute node.

[0041] When the path integrity adjudication module identifies semantic pollution and drives the core operator cluster execution state rollback, the system initiates a logical recalibration procedure based on the residual correction factor to restore the global consistency of the execution sequence. This procedure suspends operator call requests in untrusted execution regions and retrieves a security weight snapshot stored in the protected execution region. The logic compensation module recalculates the approximate diagonal elements of the Hessian matrix based on the page table miss rate of the currently protected physical memory. The operator state drift is corrected by performing incremental Taylor term compensation operations, and the updated operator weights are obtained. Follow the formula below: ,in, For the updated operator weights, For safety weight snapshot, This is the adaptive step size factor, which is a dimensionless pure number. This is the residual correction factor. As an algebraic sensitivity correction quantity, after the system completes local weight fine-tuning, it uses the feature perturbation unit to generate a logical feature pulse to reactivate the cross-domain communication link.

[0042] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit of this application and the scope of protection of this invention, and all of these forms are within the protection scope of this application.

Claims

1. A computational model optimization system based on a trusted execution environment, characterized in that, The system includes: The resource awareness unit is used to acquire storage resource load status data within the protected execution area; The operator topology decoupling module is used to decompose the computation model to be executed into a core operator cluster residing in the protected execution region and an extended operator cluster deployed in the untrusted execution region, based on the algebraic sensitivity of each operator of the computation model to the model output. The state compression engine is used to receive high-dimensional feature tensors transmitted across domains from the core operator cluster to the extended operator cluster, and to use nonlinear projection operators to convert the high-dimensional feature tensors into initial low-dimensional representation data. The logic compensation module, deployed in the protected execution region, is used to extract the second derivative during the operation of the core operator cluster. Combined with the low-dimensional representation data fed back from the untrusted execution region, it performs tensor dimension reduction operation using the algebraic fitting rule based on the second derivative to generate residual correction factors and superimpose them into the global weight flow of the computational model to be executed. The feature perturbation unit is used to implant logical feature pulses that follow a preset algebraic distribution into the initial low-dimensional representation data, generate low-dimensional representation data with pulses, and transmit them to the extended operator cluster. The path integrity adjudication module is used to extract the response fingerprint carried in the operation results returned by the extended operator cluster and verify whether the response fingerprint satisfies the preset algebraic constraint relationship.

2. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The specific process of operator deconstruction performed by the operator topology decoupling module includes: Step S1, obtaining the parameter gradient vector and weight modulus of each operator in the computational model to be executed; Step S2, calculating the algebraic sensitivity index of each operator by combining the logical path depth of the computational model to be executed in the computational graph; Step S3, the resource awareness unit generates a dynamic resource threshold based on the storage resource load status data, maps and compares the algebraic sensitivity index with the resource threshold, divides the operators that meet the security distribution conditions into core operator clusters, and divides the remaining operators into extended operator clusters; Step S4, establishing the topological connection relationship between the core operator clusters and the extended operator clusters, and generating a cross-domain operator call sequence.

3. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The state compression engine includes a projection transformation unit. Before the core operator cluster performs cross-domain communication, the projection transformation unit uses a nonlinear projection operator to compress the original dimension of the high-dimensional feature tensor to below a preset compression threshold. This is used to adjust the occupancy rate of encrypted data on the system bus bandwidth and maintain the data throughput within the protected execution area.

4. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The logic compensation module utilizes the second derivative properties of the core operator cluster within the protected execution region to reconstruct the missing high-dimensional features in the low-dimensional representation data by performing latent variable recovery operations. The latent variable recovery operations include generating residual correction factors by algebraically fitting the projection loss and superimposing the residual correction factors into the global weight flow of the computational model to be executed, so as to offset the algebraic accuracy loss when the extended operator cluster performs transformations in the untrusted execution region.

5. The computational model optimization system based on a trusted execution environment according to claim 2, characterized in that, In step S2, the algebraic sensitivity index The calculation rules follow the following formula: ,in, The algebraic sensitivity index of the operator. For the first The gradient magnitude of each parameter, For the first The weight contribution coefficient of each parameter, Let be the logical path depth of the operator in the computation graph. The physical storage space occupied by the operator, and The unit of measurement is bytes. This represents the total number of parameters contained in the operator.

6. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The specific process of the path integrity adjudication module to verify whether the response fingerprint satisfies the preset algebraic constraint relationship includes: identifying semantic pollution attacks suffered by operator weights in untrusted execution regions by comparing the linear offset between the response fingerprint and the preset logical feature pulse. The identification criterion is the degree of orthogonality deviation between the response fingerprint and the preset logical feature pulse in a specific algebraic space. When the linear offset exceeds the preset security threshold, the module outputs control instructions to drive the core operator cluster execution state to roll back or disconnect the logical connection with the extended operator cluster.

7. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The resource awareness unit monitors the memory access frequency of the protected execution area and drives the state compression engine to dynamically adjust the transformation dimension of the nonlinear projection operator. When the data transmission rate characteristics meet the preset bandwidth saturation trigger condition, the compression ratio of the high-dimensional feature tensor is increased.

8. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The protected execution region is a secure memory partition built independently of the main operating system kernel based on a hardware isolation mechanism. The secure memory partition provides encrypted data processing logic and private data storage paths for the core operator cluster through a hardware instruction set.

9. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, The logical feature pulses generated by the feature perturbation unit are linearly fused with the low-dimensional representation data in the orthogonal vector space. During the topological transformation process of transmitting the low-dimensional representation data to the extended operator cluster, the logical feature pulses maintain the deterministic mapping of their algebraic distribution characteristics.

10. The computational model optimization system based on a trusted execution environment according to claim 1, characterized in that, It also includes a model reconstruction unit, which, after the computation task is completed, performs a global loss function minimization operation based on the residual correction factor generated by the logic compensation module and the output data of the extended operator cluster, so as to update the operator weights in the protected execution region and the untrusted execution region.

Images