Methods for obfuscating device functionality

Abstract

A computer-implemented method executed on a device includes receiving input data describing one or more ML model characteristics of a machine learning (ML) model to be scheduled for execution by the device. The method further includes determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with the device executing the model instructions. The method further includes executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

Description

[Technical field]

[0001] REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Application No. 63 / 299,259, filed January 13, 2022, the contents of which are incorporated herein by reference. [Background technology]

[0002] The present application relates generally to devices including computer processors. In particular, the present application describes a method for obfuscating the functionality of a device and a device implementing the method.

[0003] 2. Description of Related Art Many devices implement proprietary processes that provide the manufacturers of these devices with a competitive advantage. Some of these processes also improve the security of the device. For example, a particular device may include a face detection feature that facilitates easy unlocking of the device by the device owner. Significant research and development time may have been spent to implement that feature.

[0004] In some cases, a competing manufacturer or malicious user can gain insight into the inner workings of a feature's implementation by observing how a device behaves when the feature is utilized. For example, the power consumed by inference hardware implementing a particular feature can, in some instances, provide insight into the number of layers an inference model utilizes, the weights associated with the nodes of the layers, the activation functions of the nodes, etc. This insight may enable a competitor to rapidly develop competing versions of the feature or may enable a malicious user to determine security vulnerabilities in the feature. Summary of the Invention

[0005] In a first aspect, a computer-implemented method executed on a device includes receiving input data describing one or more ML model characteristics of a machine learning (ML) model to be scheduled for execution by the device. The method further includes determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the device. The method further includes executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0006] In a second aspect, a computing device includes a memory and a processor, the memory storing instruction code. The processor is in communication with the memory. The instruction code is executable by the processor to cause the computing system to perform operations including receiving input data describing one or more ML model characteristics of a machine learning (ML) model to be scheduled for execution by the computing device. The operations further include determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the computing device. The operations further include executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0007] In a third aspect, a non-transitory computer-readable medium has instruction codes stored thereon. The instruction codes, when executed by a processor of a computing system, cause the computing system to perform operations including receiving input data describing one or more ML model characteristics of a machine learning (ML) model scheduled for execution by the computing system. The operations further include determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the computing system. The operations further include executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0008] In a fourth aspect, a device includes means for receiving input data describing one or more ML model characteristics of a machine learning (ML) model to be scheduled for execution by the device. The device further includes means for determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the device. The device further includes means for executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0009] The above summary is illustrative only and is not intended to be in any way limiting. In addition to the exemplary aspects, embodiments, and features described above, further aspects, embodiments, and features will become apparent by reference to the figures and the following detailed description, and accompanying drawings. [Brief description of the drawings]

[0010] [Figure 1]1 illustrates an environment with a device and a sensing system, according to an illustrative embodiment. [Diagram 2] 1 shows a block diagram of a device according to an exemplary embodiment. [Diagram 3] 1 illustrates machine learning (ML) logic, according to an example embodiment. [Figure 4] 1 illustrates operations that facilitate scheduling an obfuscated model with ML logic, in accordance with an example embodiment. [Figure 5A] 1 illustrates a measurable parameter profile associated with execution of a model instruction, in accordance with an example embodiment. [Figure 5B] 1 illustrates a measurable parameter profile associated with an obfuscated instruction, according to an example embodiment. [Figure 5C] 5B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 5A and the obfuscated instructions of FIG. 5B, according to an example embodiment. [Figure 6A] 1 illustrates a measurable parameter profile associated with execution of a model instruction, in accordance with an example embodiment. [Figure 6B] 1 illustrates a measurable parameter profile associated with an obfuscated instruction, according to an example embodiment. [Figure 6C] 6B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 6A and the obfuscated instructions of FIG. 6A, according to an example embodiment. [Figure 7A] 1 illustrates a measurable parameter profile associated with execution of a model instruction, in accordance with an example embodiment. [Figure 7B] 1 illustrates a measurable parameter profile associated with execution of obfuscated instructions, according to an example embodiment. [Figure 7C] 7B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 7A and the obfuscated instructions of FIG. 7B, in accordance with an example embodiment. [Figure 8] 4 illustrates operations performed by a device according to an example embodiment. [Figure 9]1 illustrates a computer system in accordance with an exemplary embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Various example systems, devices, and / or methods are described herein. Any embodiment, implementation, and / or feature described herein as an example should not necessarily be construed as preferred or advantageous over any other embodiment, implementation, and / or feature, unless so expressly stated. Accordingly, other embodiments, implementations, and / or features may be utilized, and other changes may be made, without departing from the scope of the subject matter presented herein.

[0012] Thus, the examples described herein are not intended to be limiting, as it will be readily understood that the aspects of the present disclosure, as generally described and illustrated in the Figures herein, can be arranged, substituted, combined, separated, and designed in a wide variety of different configurations.

[0013] Moreover, unless the context suggests otherwise, the features illustrated in each of the figures may be used in combination with one another. Thus, the figures should generally be viewed as component aspects of one or more overall embodiments, with the understanding that not all of the illustrated features are required for each embodiment.

[0014] Moreover, any recitation of elements, blocks, or steps in the specification or claims is for clarity purposes, and therefore such recitation should not be construed as requiring or implying that those elements, blocks, or steps be adhered to in a particular arrangement, or performed in a particular order.

[0015] Furthermore, terms such as "substantially" or "about" may be used herein to mean that the stated property, parameter, or value need not be obtained exactly, but that deviations or variations, such as, for example, tolerances, measurement errors, limitations of measurement precision, and other factors known to those of ordinary skill in the art, may occur in an amount that does not interfere with the effect of the property intended to be provided.

[0016] As noted above, certain measurable parameters of a device, such as the power consumed by the device, may in some cases provide insight into how a particular feature is implemented. This insight may enable others to quickly develop competing versions of the feature, or may allow malicious users to determine security vulnerabilities in the feature.

[0017] For example, a secure process or application on the device may implement a face recognition function using machine learning (ML) inference. As used herein, ML inference corresponds to hardware configured to execute ML instructions that implement a trained ML model. The ML inference may reside on the device (e.g., an edge device) as opposed to the cloud (e.g., running on a server). Because this process is a security-sensitive authentication mechanism, it is important to keep details about the ML model private. In this regard, the model instructions associated with the ML model may be encrypted on the device. Additionally, the device may incorporate various hardware and software safeguards to prevent the model from being directly analyzed.

[0018] The model instructions may be executed on a specialized processing unit (e.g., inference hardware) of the device, and the power dissipated by the processing unit may be measured during execution of the model instructions. Changes in power dissipation during execution of the model instructions may provide insight into the particular process being performed by the model. For example, with basic knowledge of the hardware architecture, it may be possible to determine aspects of the ML model, such as the number of layers, the number of nodes in each layer, the activation functions used in each layer, and the input weights to each neuron.

[0019] The embodiments disclosed herein obfuscate the power / leakage and EM information available to an attacker by introducing dummy or arbitrary work into the ML inference hardware. Typically, on-device inference is scheduled to the physical hardware at compile time. Introducing arbitrary work at the same time during inference introduces enough noise into the physical properties of the inference that it is visible via side-channel attacks (SCAs), preventing reverse engineering of the details of the model.

[0020] In some embodiments, arbitrary work is introduced in the form of scheduled concurrent work on different processing units of inference hardware that are compiled into the same binary. In some embodiments, a separate obfuscated binary is created that is scheduled concurrently with the ML model that implements the security-sensitive process.

[0021] In some embodiments, any work introduced is random to increase its effectiveness in hiding SCA information. In some embodiments, for ML compilation systems that do not support control flow modification, randomness is emulated by creating a larger set of deterministically obfuscated binaries and making the order in which they are scheduled onto the ML hardware random, but still concurrent with the actual secret model.

[0022] 1 illustrates an example of an environment 100 including a device 105 and a sensing system 110. Examples of the device 105 correspond to edge devices (e.g., devices owned by end users). Examples of the device 105 correspond to smartphones, tablets, wearable devices, personal computers, etc.

[0023] Some embodiments of the device 105 execute an obfuscated model 115. Some examples of the obfuscated model 115 include model instructions 115A and obfuscated instructions 115B. Some embodiments of the model instructions 115A define an ML model that facilitates implementation of ML-based applications such as face detection, voice recognition, fingerprint authentication, etc. In some embodiments, a model constructed solely based on the model instructions 115A (e.g., the obfuscated model) changes a measurable parameter 120 of the device 105. For example, executing the obfuscated model changes the power consumption of the device 105 or the amount of EM energy emitted from the device 105. In some embodiments, the change in the measurable parameter 120 follows a particular profile (e.g., as shown in FIG. 5A ) during execution of the obfuscated model.

[0024] In this regard, some embodiments of the obfuscation instructions 115B define a multi-faceted process (e.g., "dummy work") that is not necessarily configured to generate any meaningful output. In some embodiments, one or more obfuscation instructions 115B are executed simultaneously or sequentially with the model instructions 115A to obfuscate a particular profile of measurable parameters 120 of the device 105 associated with execution of the obfuscated model.

[0025] Some examples of the sensing system 110 correspond to a test instrument configured to sense a measurable parameter 120 of the device 105. For example, an example of the sensing system 110 corresponds to an oscilloscope. The oscilloscope can be configured to measure, for example, the power consumption of the device 105 during execution of the de-obfuscated model and the obfuscated model 115. In some embodiments, the change in power consumption during execution of the de-obfuscated model follows a particular profile, and this profile can be used to reveal the inner workings of the de-obfuscated model.

[0026] Another example of the detection system 110 corresponds to a radio frequency (RF) analyzer. The RF analyzer can be configured, for example, to measure electromagnetic (EM) energy emanating from the device 105 during execution of the de-obfuscated and obfuscated models 115. In some embodiments, changes in the EM energy (e.g., changes in frequency and amplitude) during execution of the de-obfuscated model follow a particular profile, and this profile can be used to reveal the inner workings of the de-obfuscated model.

[0027] 2 shows a block diagram of an embodiment of device 105. With reference to the figure, device 105 includes memory 227, a processor 225, a user interface 230, an input / output (I / O) subsystem 210, and ML logic 215.

[0028] The processor 225 is configured to communicate with the memory 227 and execute instruction codes stored in the memory 227. The instruction codes facilitate the device 105 to perform various operations described herein. In this regard, some embodiments of the instruction codes cause the processor 225 to control and coordinate various activities performed by different subsystems of the device 105. Some examples of the processor 225 include standalone computer systems, such as ARM®, Intel®, AMD®, or PowerPC® based computer systems, or different computer systems, including application specific computer systems. Some examples of computer systems include operating systems. Examples of operating systems include Android™, Windows®, Linux®, Unix®, or different operating systems.

[0029] Some examples of user interfaces 230 include display circuitry. Examples of display circuitry include liquid crystal displays (LCDs), light emitting diode display (LED) displays, and the like. Some examples of displays include capacitive transparent touch pads that facilitate receiving user commands. In this regard, some embodiments of display circuitry are configured to present a graphical user interface (GUI). Some examples of user interfaces 230 include cameras that facilitate performing face recognition. Some examples of user interfaces 230 include microphones that facilitate performing voice recognition. Some examples of user interfaces 230 include fingerprint readers that facilitate performing fingerprint authentication.

[0030] Some examples of I / O subsystem 210 include one or more input / output interfaces configured to facilitate communication with entities external to device 105. Some examples of I / O subsystem 210 include wireless communication circuitry configured to facilitate communicating information to and from device 105. Examples of wireless communication circuitry include cellular communication circuitry configured to communicate information over cellular communication networks, such as 3G, 4G, and / or 5G networks. Other examples of wireless communication circuitry facilitate communication of information over WiFi-based networks, Bluetooth®, Zigbee®, near-field communication technology, or different wireless networks.

[0031] Some examples of ML logic 215 include hardware, software, or combinations thereof specifically configured to implement or aid in the implementation of various supervised and unsupervised machine learning models. Within the scope of embodiments, these include implementations of the Holt-Winter algorithm, the Exponential Time Smoothing (ETS) algorithm, artificial neural networks (ANN), recurrent neural networks (RNN), convolutional neural networks (CNN), seasonal autoregressive moving average (SARIMA) algorithms, networks of long short-term memory (LSTM), and gated recurrent units (GRU) algorithms. Some embodiments of ML logic 215 implement other machine learning (ML) logic and / or artificial intelligence (AI) algorithms.

[0032] FIG 3 illustrates an embodiment of ML logic 215. Referring to FIG 3, ML logic 215 includes a group of processing units 305A-305D. Examples of processing units 305 correspond to processors of a Complex Instruction Set Computer (CISC). Some examples of processing units 305 include hardware and corresponding instruction sets that facilitate performing operations such as matrix multiplication or convolution, application of activation functions, floating point calculations, etc.

[0033] In some embodiments, the number of processing units 305 used when implementing a particular obfuscated model 115 depends on the complexity of the obfuscated model 115 (e.g., the number of layers specified by model instructions 115A of the obfuscated model 115, the number of nodes within a layer, etc.). In this regard, in some embodiments, model instructions 115A of the obfuscated model 115 are executed by a subset of processing units 305A, 305B. In some embodiments, obfuscated instructions 115B of the obfuscated model 115 are executed by a different subset of processing units 305C, 305D.

[0034] 4 illustrates an example of operations 400 that facilitate scheduling an obfuscated model 115 with the ML logic 215. At block 405, an ML model is received. At block 410, a first layer of the ML model is selected, and at block 415, a first node of the layer is selected.

[0035] The model instructions 115A associated with the selected node are scheduled at block 415. As noted above, in some embodiments, the model instructions 115A are scheduled for execution by a first subset of the processing units 305A, 305B.

[0036] At block 420, the obfuscated instructions associated with the selected nodes are scheduled. As noted above, in some embodiments, the obfuscated instructions 115B are scheduled for execution by the second subset of processing units 305C, 305D. Some embodiments of the obfuscated instructions 115B are configured to implement a loop that repeats a certain number of times to obfuscate a change in a measurable parameter due to the execution of the model instructions 115A by the first subset of processing units 305A, 305B at block 415. An increase in the number of times, for example, increases the power consumption or EM energy of the device 105 associated with the execution of the obfuscated instructions 115B. A decrease in the number of times, for example, decreases the power consumption or EM energy of the device 105 associated with the execution of the obfuscated instructions 115B.

[0037] In some embodiments, the obfuscated instructions 115B associated with a particular node are configured to execute concurrently with the execution of the model instructions 115A associated with that node. For example, the model instructions 115A execute on a first subset of the processing units 305A, 305B, and then the obfuscated instructions 115A execute on the same processing units 305A, 305B after execution of the model instructions 115A is completed. In some embodiments, the obfuscated instructions 115B associated with a particular node are configured to execute concurrently with the execution of the model instructions 115A. For example, the model instructions 115A execute on a first subset of the processing units 305A, 305B, and the obfuscated instructions 115B execute concurrently on a second subset of the processing units 305C, 305D.

[0038] In block 425, if there are additional nodes, the operations repeat from block 410. Otherwise, in block 430, if there are additional layers, the operations repeat from block 405.

[0039] As described above, a model constructed solely based on model instructions 115A (e.g., an obfuscated model) causes certain changes to measurable parameters 120 of device 105 that can be utilized to determine the internal operation of the model. Obfuscated instructions 115B are executed simultaneously or sequentially with model instructions 115A to obfuscate changes in measurable parameters 120 associated with execution of model instructions 115A.

[0040] 5A and 5B show example measurable parameter profiles 505, 510 associated with execution of model instructions 115A and obfuscated instructions 115B, respectively. In some embodiments, each measurable parameter profile 505, 510 is associated with execution of instructions in the ML logic 215 described above.

[0041] In the figure, measurable parameters 120 associated with model instructions 115A and obfuscated instructions 115B transition between first, second, and third states during first, second, and third intervals (e.g., 10 ms intervals), respectively, during execution.

[0042] For example, when measurable parameters 120 correspond to power consumption or EM energy of device 105, measurable parameter profile 505 associated with model instructions 115A indicates that the power consumption or EM energy associated with execution of model instructions 115A transitions between successively higher power levels during the first, second, and third intervals. Measurable parameter profile 510 associated with obfuscated instructions 115B indicates that the power consumption or EM energy associated with execution of obfuscated instructions 115B transitions between successively lower power levels or EM energy during the first, second, and third intervals.

[0043] 5C illustrates an example of a measurable parameter profile 515 of the device 105 associated with the execution of the above model instructions 115A and obfuscated instructions 115B. As illustrated, the measurable parameter profile 515 associated with the combined execution of these instructions is relatively constant, thereby obfuscating the measurable parameter profile 505 associated with the obfuscated model 115.

[0044] 6A and 6B show examples of measurable parameter profiles 605, 610 associated with the execution of model instructions 115A and obfuscated instructions 115B, respectively. In accordance with the above example, the measurable parameter profile 505 associated with model instructions 115A exhibits successively higher power or EM levels throughout the first, second, and third intervals, and the measurable parameter profile 610 associated with obfuscated instructions 115B exhibits successively lower power levels or EM energy throughout the first, second, and third intervals. As shown in FIG. 6C, the measurable parameter profile 615 associated with the combined execution of these instructions is relatively constant, thus obfuscating the measurable parameter profile 505 associated with the obfuscated model 115.

[0045] In the above example, the obfuscation instructions 115B are configured to obfuscate the model instructions 115A by canceling the changes to the measurable parameter profile 615 associated with the model instructions 115A.

[0046] 7A-7C show examples of measurable parameter profiles 705, 710, 715 associated with the execution of obfuscated instructions 115B configured to randomly display changes in the measurable parameter profile 615 associated with the model instructions 115A. The measurable parameter profile 705 of FIG. 7A corresponds to the measurable parameter profile of FIG. 5A. As shown in FIG. 7B, the measurable parameter profile 710 associated with the execution of obfuscated instructions 115B is random when compared to the measurable parameter profile 705 associated with the model instructions 115A. As shown in FIG. 7C, the measurable parameter profile 715 associated with the combined profiles is randomly displayed, thereby obfuscating the measurable parameter profile 705 associated with the model instructions 115A.

[0047] 8 illustrates example operations 800 performed by some examples of device 105. The operations at block 805 include receiving input data describing one or more machine learning (ML) model characteristics of an ML model to be scheduled for execution by the device.

[0048] The operations at block 810 include determining, based on one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with the execution of the model instructions associated with the ML model, where the execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with a device that executes the model instructions.

[0049] The operations at block 815 include executing one or more determined obfuscated instructions either simultaneously or sequentially with the execution of the model instructions.

[0050] In some embodiments, the number of one or more obfuscation instructions executed is proportional to the number of layers of the ML model.

[0051] In some embodiments, the number of one or more obfuscation instructions that are executed is proportional to the number of nodes in each of multiple layers of the ML model.

[0052] In some embodiments, the processor includes multiple processing units, and in these embodiments, executing the one or more obfuscated instructions concurrently or sequentially with the execution of the model instructions includes executing the model instructions on a subset of the multiple processing units and executing the one or more obfuscated instructions on a different subset of the multiple processing units.

[0053] In some embodiments, executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions includes executing one or more obfuscated instructions that cause a change in a measurable parameter of the device due to execution of the model instructions to be substantially undetectable.

[0054] In some embodiments, executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions includes executing one or more obfuscated instructions that cause changes in a measurable parameter of the device due to execution of the model instructions to be substantially random.

[0055] In some embodiments, the measurable parameter corresponds to a power consumption of the device. In these embodiments, executing the one or more obfuscated instructions includes executing the one or more obfuscated instructions to adjust the power consumption of the device, thereby obfuscating a power consumption profile associated with execution of the ML instructions.

[0056] In some examples, the measurable parameter corresponds to electromagnetic energy emanating from the device, in these examples, executing the one or more obfuscated instructions includes executing one or more obfuscated instructions that adjust the electromagnetic energy of the device to obfuscate an electromagnetic energy profile associated with the model instructions.

[0057] 9 illustrates an embodiment of a computer system 900 that may form part of or implement any of the systems and / or devices described above. The computer system 900 may include a set of instructions 945 that a processor 905 may execute to cause the computer system 900 to perform any of the operations described above. An embodiment of the computer system 900 may operate as a stand-alone device or may be connected to other computer systems or peripherals, for example, using a network.

[0058] In networked embodiments, computer system 900 may operate in the capacity of a server, or as a client computer in a server-client network environment, or as a peer computer system in a peer-to-peer (or distributed) environment. Computer system 900 may also be implemented as or incorporated into a variety of devices, such as personal computers or mobile devices, that can execute instructions 945 (sequentially or otherwise) to cause the device to perform one or more actions. Additionally, each of the described systems may include a collection of subsystems that individually or collectively execute an instruction set, or multiple instruction sets, to perform one or more computer operations.

[0059] The computer system 900 can include one or more memory devices 910 communicatively coupled to a bus 920 for communicating information. Additionally, code operable to cause the computer system to perform the operations described above can be stored in the memory 910. The memory 910 can be a random access memory, a read-only memory, a programmable memory, or any other type of memory or storage device.

[0060] The computer system 900 may include a display 930, such as a liquid crystal display (LCD), an organic light emitting diode (OLED) display, or any other display suitable for conveying information. The display 930 may serve as an interface for a user to view processing results generated by the processor 905.

[0061] Additionally, the computer system 900 may include input devices 925 , such as a keyboard or mouse or touch screen, configured to allow a user to interact with the components of the system 900 .

[0062] Computer system 900 can also include a non-volatile memory (NVM) controller 915. NVM controller 915 can include a computer-readable medium 940 (e.g., a flash drive) that can store instructions 945. The instructions 945 can reside completely or at least partially within memory 910 and / or within processor 905 during execution by computer system 900. Memory 910 and processor 905 can also include computer-readable media, as described above.

[0063] The computer system 900 may include a communication interface 935 to support communications over a network 950. The network 950 may include a wired network, a wireless network, or a combination thereof. The communication interface 935 may enable communications via any number of wireless broadband communications standards.

[0064] Thus, the methods and systems described herein can be realized in hardware, software, or a combination of hardware and software. The methods and systems can be realized in a centralized fashion in at least one computer system, or in a distributed fashion where different elements are spread across interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods described herein can be used.

[0065] The methods and systems described herein may also be embedded in a computer program product, which contains all functionality enabling the performance of the operations described herein and, when loaded into a computer system, is capable of executing these operations. A computer program, as used herein, refers to the expression in a machine-executable language, code, or representation of a set of machine-executable instructions intended to cause a device to perform a particular function, either directly or after one or more of a) conversion of a first language, code, or representation into another language, code, or representation, and b) copying of the first language, code, or representation.

[0066] Although the system and method of operation have been described with reference to specific embodiments, those skilled in the art will recognize that various modifications may be made and equivalents may be substituted without departing from the scope of the invention. Accordingly, the method and system are not limited to the specific embodiments disclosed, but rather the disclosed method and system are intended to include all embodiments falling within the scope of the appended claims.

Claims

1. 1. A computer-implemented method executed on a device, comprising: Receiving input data describing one or more machine learning (ML) model characteristics of a ML model; determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to be used to obfuscate a profile of measurable parameters associated with the device when the device executes model instructions of the ML model; executing the one or more obfuscated instructions simultaneously or sequentially with execution of the model instructions; 4. A computer-implemented method comprising:

2. The computer-implemented method of claim 1 , wherein a number of the one or more obfuscated instructions that are executed is proportional to a number of layers of the ML model.

3. 3. The computer-implemented method of claim 2, wherein a number of the one or more obfuscation instructions executed is proportional to a number of nodes in each of the layers of the ML model.

4. The device includes a plurality of processing units, and executing the one or more obfuscated instructions concurrently or sequentially with execution of the model instructions comprises: executing the model instructions on a subset of the plurality of processing units; executing the one or more obfuscated instructions on different subsets of the plurality of processing units; The computer-implemented method of claim 1 , comprising:

5. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises: The computer-implemented method of claim 1 , comprising executing one or more obfuscated instructions that cause a change in the measurable parameter of the device due to execution of the model instructions to be substantially undetectable.

6. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises: The computer-implemented method of claim 1 , comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the device due to execution of the model instructions to be substantially random.

7. the measurable parameter corresponds to a power consumption of the device; Executing the one or more obfuscated instructions includes:

2. The computer-implemented method of claim 1, comprising: obfuscating a power consumption profile associated with the execution of the ML instructions by executing one or more obfuscated instructions that adjust the power consumption of the device.

8. the measurable parameter corresponds to electromagnetic energy emanating from the device; Executing the one or more obfuscated instructions includes:

2. The computer-implemented method of claim 1, comprising: obfuscating an electromagnetic energy profile associated with the model instructions by executing one or more obfuscated instructions that adjust the electromagnetic energy of the device.

9. one or more processors; a computing device including a memory in communication with the one or more processors, The memory, when executed by the one or more processors, causes the computing device to: Receiving input data describing one or more machine learning (ML) model characteristics of a ML model; determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to be used to obfuscate a profile of measurable parameters associated with the computing device when the computing device executes model instructions of the ML model; executing the one or more obfuscated instructions simultaneously or sequentially with execution of the model instructions. Computing device.

10. The computing device of claim 9 , wherein a number of the one or more obfuscated instructions executed is proportional to a number of layers of the ML model.

11. The computing device of claim 10 , wherein a number of the one or more obfuscated instructions executed is proportional to a number of nodes in each of the layers of the ML model.

12. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises: executing the model instructions on a subset of the one or more processors; and executing the one or more obfuscated instructions on different subsets of the one or more processors.

13. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises:

10. The computing device of claim 9, further comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the computing device due to execution of the model instructions to be substantially undetectable.

14. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises:

10. The computing device of claim 9, further comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the computing device due to execution of the model instructions to be substantially random.

15. the measurable parameter corresponds to a power consumption of the computing device; Executing the one or more obfuscated instructions includes:

10. The computing device of claim 9, further comprising: obfuscating a power consumption profile associated with the execution of the ML instructions by executing one or more obfuscated instructions that adjust the power consumption of the device.

16. the measurable parameter corresponds to electromagnetic energy emanating from the computing device; Executing the one or more obfuscated instructions includes:

10. The computing device of claim 9, further comprising: obfuscating an electromagnetic energy profile associated with the model instructions by executing one or more obfuscated instructions that adjust the electromagnetic energy of the computing device.

17. A non-transitory computer readable medium having stored thereon instruction code, which when executed by one or more processors of a computing device, causes the computing device to: Receiving input data describing one or more machine learning (ML) model characteristics of a ML model; determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to be used to obfuscate a profile of measurable parameters associated with the computing device when the computing device executes model instructions of the ML model; executing the one or more obfuscated instructions simultaneously or sequentially with execution of the model instructions. Non-transitory computer-readable medium.

18. 20. The non-transitory computer-readable medium of claim 17, wherein a number of the one or more obfuscation instructions executed is proportional to a number of layers of the ML model.

19. 20. The non-transitory computer-readable medium of claim 18, wherein a number of the one or more obfuscation instructions executed is proportional to a number of nodes in each of the layers of the ML model.

20. Executing the one or more obfuscated instructions simultaneously or sequentially with the execution of the model instructions comprises: executing the model instructions on a subset of the one or more processors; and executing the one or more obfuscated instructions on different subsets of the one or more processors.

Images