Method, device and system for authenticity assurance of inference requests and inference responses - Patents.com

Abstract

Some embodiments of the present disclosure provide guarantees for the handling of inference requests sent to a DNN hosted on a remote computing system. Output data received in response to an inference request can be guaranteed to have been properly generated by the DNN, and not tampered with or generated by a malicious DNN. Output data from the DNN can also be guaranteed to properly correspond to the input data included in the inference request. Linear block coding may be used during transmission to prevent eavesdropping and tampering. Through the use of a guaranteed DNN, some degree of comfort can be obtained that the provided output data properly corresponds to the input data included in a given inference request. Furthermore, known patterns inherent in the DNN output can be used to establish the integrity of the received output data.

Description

[Technical field]

[0001] The present disclosure generally relates to methods, devices and systems for ensuring the authenticity of inference requests and inference responses generated by deep neural networks implemented in computing systems, such as cloud computing systems. [Background technology]

[0002] Deep neural networks (DNNs) are known for their complexity and the demands placed on computing resources. DNNs that approximate nonlinear functions are trained to perform specific tasks, such as computer vision tasks, natural language processing tasks, and speech processing tasks. DNNs receive input data in the form of vectors and tensors and generate inference data (e.g., predictions) based on the input data. Due to their size and complexity, DNNs are typically hosted on remote computing systems that have a large amount of computing resources (e.g., memory and processing resources). Hosting DNNs on a remote computing system, such as a cloud computing system, allows a third party entity, such as a cloud computing provider, to create and manage DNNs that perform specific tasks and provide access to the DNNs to users of the DNNs over the Internet to provide input data for the specific DNN to perform inference for the specific task. To access a DNN hosted on a remote computing system, a client computing device ("client device") uses a communications network to send an inference request, including input data for the DNN, to the remote computing system hosting the implemented DNN, and receives an inference response, including inference data generated by the DNN based on the input data, from the remote computing system using a communications network.

[0003] By sending inference requests from a client device to a remote computing system on which a DNN is implemented using wireless and wired network connections, and receiving inference responses generated by the DNN using the same wireless and wired network connections, the inference requests and inference responses are exposed to malicious attacks such as eavesdropping and tampering. Summary of the Invention

[0004] In the present disclosure, a method, device, and system are provided for ensuring the authenticity of input data included in an inference request sent by a client device to a remote computing system hosting a DNN, such as a cloud computing system, via a network of a communication system. The inference data included in an inference response sent by the remote computing system to the client device can be guaranteed as having been properly received from the client device and generated by the DNN, and not tampered with or generated by a malicious DNN. The inference data included in the inference response can also be guaranteed as properly corresponding to the input data included in the inference request.

[0005] An undesirable side effect of hosting a DNN on a computing system remote from the client device is that transmissions between the client device and the computing system are subject to various malicious attacks. Malicious attacks may occur as eavesdropping or tampering with transmissions containing inference requests and inference responses as they are received and forwarded by various network entities of the communication system. The transmissions may contain inference requests containing input data and may contain corresponding inference responses containing inference data. In addition to the above, malicious attacks may be fundamentally performed on the computing system hosting the DNN. Such malicious attacks may involve the DNN providing responses containing inference data that do not correspond to the input data contained in the request, possibly to conserve computing resources. Thus, the extent to which the inference data corresponds to the input data may be in question.

[0006] Aspects of the present application relate to preventing eavesdropping or tampering of input data contained in an inference request generated by an application running on an electronic device using linear block coding of the input data. Through the use of a guaranteed DNN, some degree of confidence can be obtained that a given inference response inference data properly corresponds to the given input data. Furthermore, known patterns inherent in the output data generated by the DNN can be used to establish the integrity of the output data. [Means for solving the problem]

[0007] According to one aspect of the present disclosure, a method is provided that includes encoding an input data vector with a linear block encoder to obtain an encoded input vector, sending an inference request including the encoded input vector, and receiving an inference response.

[0008] According to another aspect of the present disclosure, there is provided a method for handling inference requests, the method including the steps of receiving an inference request, the inference request including an input data vector, transmitting the inference request, encoding the input data vector with a linear block encoder to obtain an actual encoded input vector, receiving an inference response, the inference response including an output data vector, obtaining an estimated encoded input vector based on the output data vector, obtaining a confidence score representative of a comparison between the estimated encoded input vector and the actual encoded input vector, and transmitting the output data vector in response to determining that the confidence score exceeds a threshold.

[0009] For a more complete understanding of the present embodiments and their advantages, reference is now made by way of example to the following description taken in conjunction with the accompanying drawings, in which: FIG. [Brief description of the drawings]

[0010] [Figure 1] 1 illustrates, in a schematic diagram, a communication system in which embodiments of the present disclosure may occur, the communication system including a number of example Electronic Devices (EDs) and a number of example Radio Access Network (RAN) nodes along with various networks. [Diagram 2] FIG. 1 illustrates a block diagram of a communication system including multiple example EDs, example terrestrial RAN nodes, and example non-terrestrial RAN nodes along with various networks. [Diagram 3] 3 illustrates, as a block diagram, elements of an example ED of FIG. 2, elements of an example terrestrial RAN node of FIG. 2, and elements of an example non-terrestrial RAN node of FIG. 2, in accordance with aspects of the present application. [Figure 4] 1 illustrates, as block diagrams, various modules that may be included in an example electronic device, an example terrestrial transmission reception point, and an example non-terrestrial transmission reception point, in accordance with aspects of the present application. [Diagram 5]1 illustrates a block diagram of a sensing management function according to an aspect of the present application. [Figure 6] The block diagram shows a typical scenario in which an ED sends a request to a DNN-on-Cloud via a RAN node. [Figure 7A] 1 illustrates components of an ED that are in part responsible for processing inference requests, according to an embodiment of the present application. [Figure 7B] 1 illustrates components of an ED that are in part responsible for processing inference responses, according to an embodiment of the present application. [Figure 8A] 1 illustrates components of a computing system and a RAN node that are in part responsible for processing an inference response in accordance with an aspect of the present application. [Figure 8B] 1 illustrates components of a computing system and a RAN node that are in part responsible for processing an inference request, according to an aspect of the present application. [Figure 9] 7 shows a scene similar to that of FIG. 6, where the ED is a particular ED. [Figure 10] 10 illustrates example steps of a method for obtaining a guaranteed inference response from the perspective of the ED of FIG. 9 according to an embodiment of the present application. [Figure 11] 10 illustrates example method steps for handling an inference request from the perspective of the RAN node of FIG. 9 according to an aspect of the present application. [Figure 12] 10 illustrates further example steps of a method for handling inference requests from the perspective of the RAN node of FIG. 9 according to an aspect of the present application. [Figure 13] 10 illustrates yet another example step of a method for obtaining a guaranteed inference response from the perspective of the ED of FIG. 9 according to an embodiment of the present application. [Figure 14] 10 illustrates further example steps of a method for handling inference requests from the perspective of the RAN node of FIG. 9 according to an aspect of the present application. [Figure 15] 10 illustrates example method steps for handling an inference request from the perspective of the RAN node of FIG. 9, where the RAN node is not provided with access to a linear block encoding matrix, according to an embodiment of the present application. [Figure 16] 10 illustrates an overview of the assurance as an example of method steps performed by the RAN node of FIG. 9 according to an embodiment of the present application. [Figure 17] 10 illustrates example method steps for performing a security protocol in the RAN node of FIG. 9 according to an embodiment of the present application. [Figure 18] 18 illustrates example method steps for performing intra-group consistency checking as part of the method illustrated in FIG. 17 according to an aspect of the present application. [Figure 19] 18 illustrates example method steps for performing inter-group consistency checking as part of the method illustrated in FIG. 17 according to aspects of the present application. [Figure 20] 10 illustrates example method steps performed in the ED of FIG. 9 to receive an encoded guaranteed inference response vector according to an embodiment of the present application. [Figure 21] 10 illustrates example method steps performed in the ED of FIG. 9 according to an embodiment of the present application, the method relating to coded input data vectors and encoded inference response vectors. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] In the following, for purposes of example, specific embodiments will be described in more detail in conjunction with the figures.

[0012] The embodiments described herein represent sufficient information to implement the claimed subject matter and illustrate how such subject matter may be implemented. Upon reading the following description in light of the accompanying drawings, one skilled in the art will understand the concepts of the claimed subject matter and recognize applications of that concept not specifically addressed herein. It is understood that such concepts and applications are within the scope of this disclosure and the accompanying claims.

[0013] It is further understood that any module, component, or device disclosed herein that executes instructions may include, or alternatively have access to, one or more non-transitory computer / processor readable storage media used to store information such as computer / processor readable instructions, data structures, program modules, and / or other data. Examples of non-transitory computer / processor readable storage media include, but are not limited to, magnetic cassettes, magnetic tapes, magnetic disk storage and other magnetic storage devices, compact disk read only memories (CD-ROMs), digital video disks or digital versatile disks (or DVDs), optical disks such as Blu-ray Discs™ and other optical storage, volatile and non-volatile removable and non-removable media implemented in any manner or technology, random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory, and other memory technologies. Such non-transitory computer / processor storage media may be part of, accessible to, or connectable to the device. Computer / processor readable / executable instructions for implementing the applications and modules described herein may be stored by, or maintained separately from, such non-transitory computer / processor readable storage media.

[0014] 1, a simplified schematic diagram of an example of a communication system 100 is shown. The communication system 100 comprises several networks, including a wireless access network 120, a core network 130, a public switched telephone network (PSTN) 140, the Internet 150, other networks 160, and a remote computing system 600 hosting a DNN 650.

[0015] The radio access network (RAN) 120 may be a next generation (e.g., sixth generation (6G) or later) radio access network or a legacy (e.g., 5G, 4G, 3G, or 2G) radio access network. One or more electronic communication devices (EDs) 110a, 110b, 110c, 110d, 110e, 110f, 110g, 110h, 110i, 110j (often referred to as EDs 110 and collectively referred to as EDs 110) may be connected to each other and to one or more radio access network (RAN) nodes 170a, 170b (often referred to as RAN nodes 170 and collectively referred to as RAN nodes 170) of the RAN 120. The core network 130 may or may not depend on the radio access technology used in the communication system 100.

[0016] The remote computing system 600 ("computing system 600") of the communication system 100 shown in FIG. 1 may be directly or indirectly connected to the core network 130. The computing system 600 includes multiple powerful computing resources, including a central processing unit, a hardware accelerator, a graphics processing unit, and memory, which are used to train the DNN 650 hosted on the computing system 600. The remote computing system 600 may be a cloud computing system ("cloud") that hosts multiple different DNNs trained for various tasks, including the DNN 650. The DNN 650 hosted on the computing system 600 may receive multiple inference requests from one ED 110, multiple inference requests from different EDs 100, and perform multiple different inferences simultaneously. As an example, when an application working on the ED 110 generates an inference job including one or more inference requests to the DNN 650, the ED 110 ("requesting ED 110") transmits the inference job for the DNN 650 to the RAN node 170 via wireless transmission, which processes the wireless transmission to obtain the inference request, and transmits the inference request to the computing system 600 hosting the DNN 650 via the core network 130 using wired and / or wireless transmission. When the computing system 600 receives the transmission including the inference job for the DNN 650, it registers the inference job with the DNN 650. The computing system 600 invokes the DNN 650 hosted on the computing system 600 to perform the requested inference job. The ED 110 then sends an inference request for the DNN 650 included in the inference job to the computing system 600 hosting the DNN 650 via the RAN node 170 and the core network 130, as described in more detail below. As described in more detail below, an inference request includes input data for the inference request, a control header that includes an indication of the DNN 650 to which the inference request is directed.When an inference request is received by the computing system 600, the cloud computing system 600 provides the input data of the inference request to the DNN 650, which performs the inference, which generates the inference data. The DNN 650 then generates an inference response and provides the inference response to the computing system 600. The inference response includes the inference data generated and provided by the DNN 650, as well as other parameters that are consequently related to the inference data. The computing system 600 hosting the DNN 650 sends the inference response to the ED 110 via the core network 130 and the RAN node 170.

[0017] In some embodiments, the computing system 600 hosting the DNN 650 may be indirectly connected to the core network 130 via the Internet 150. In this embodiment, inference requests and inference responses sent between the ED and the computing system 600 may be encapsulated in TCP / IP packets.

[0018] The RAN node 170 may be equipped with powerful computing resources. Alternatively, the RAN node 170 may be connected by a wireless connection, such as a wireless connection, or a wired connection to a computing system including powerful computing resources. A RAN node 170 equipped with powerful computing resources is often referred to as an edge computing system, or a computing system located close to the RAN node 170 and connected to the RAN node 170 is often referred to as an edge computing system.

[0019] FIG. 2 illustrates various exemplary networks and EDs of the exemplary communication system 100 shown in FIG. 1. In general terms, the communication system 100 enables multiple wireless and wireline elements (e.g., EDs 110, RANs 120, and core networks 130) to communicate data and other content with each other. The communication system 100 may enable communication of data and other content, such as audio, video, and / or text, via broadcast, multicast, and unicast transmissions. The communication system 100 may operate by sharing resources, such as carrier spectrum bandwidth, among the wireless elements (e.g., EDs 110 and RANs 120) of the communication system 100 for wireless communication. The communication system 100 may include terrestrial and / or non-terrestrial communication networks. The communication system 100 may provide a wide range of communication services and applications, such as earth monitoring, remote sensing, passive sensing and positioning, navigation and tracking, autonomous delivery, and mobility. The communication system 100 may provide high availability and robustness through cooperation between terrestrial and non-terrestrial communication networks. For example, a non-terrestrial communication network (or components thereof) may be integrated into a terrestrial communication network to obtain what may be considered a heterogeneous network with multiple layers. Compared to traditional communication networks, the heterogeneous network may achieve an overall improvement in performance through efficient multi-link cooperation, more flexible function sharing, and faster switching of physical layer links between the terrestrial and non-terrestrial networks. The RAN 120 and the core network 130 may be a non-terrestrial communication network, a non-terrestrial communication network, or a heterogeneous communication network.

[0020] The terrestrial and non-terrestrial communication networks can be considered as sub-networks of the RAN 120 of the communication system 100. In the example shown in Figure 2, the communication system 100 includes electronic devices (EDs) 110a, 110b, 110c, and 110d, radio access networks (RANs) 120a, 120b, and 120c, a core network 130, a public switched telephone network (PSTN) 140, the Internet 150, and other networks 160. The RANs 120a and 120b are terrestrial communication networks and include RAN nodes 170a and 170b, which may be base stations, eNBs, gNBs, or transmission / reception points (TRPs). The RAN network 120c is a non-terrestrial communication network and includes one or more RAN nodes 172, which may often be referred to as non-terrestrial transmission / reception points (NT-TRPs) 172.

[0021] Alternatively or additionally, any ED 110 may be configured to interface, access, or communicate with any RAN node 170, the Internet 150, the core network 130, the PSTN 140, other networks 160, or any combination thereof. In some examples, the ED 110a may communicate with the RAN node 170a, which may be a T-TRP, using a terrestrial air interface 190a to convey uplink and / or downlink transmissions. In some examples, the EDs 110a, 110b, 110c, and 110d may also communicate directly with each other via one or more sidelink air interfaces 190b. In some examples, the ED 110d may communicate with the RAN node 170c of the RAN 120c to convey uplink and / or downlink transmissions using a non-terrestrial air interface 190c, which may be a NT-TRP.

[0022] Air interfaces 190a and 190b may use similar communication technologies, such as any suitable radio access technology. For example, communication system 100 may implement one or more channel access methods, such as code division multiple access (CDMA), spatial division multiple access (SDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), or single carrier FDMA (SC-FDMA), in air interfaces 190a and 190b. Air interfaces 190a and 190b may utilize other higher dimensional signal spaces, which may involve combinations of orthogonal and / or non-orthogonal dimensions.

[0023] The air interface 190c enables communication between the ED 110d and one or more RAN nodes 170 via a wireless link, or simply a link. In some examples, the link may be a dedicated connection for unicast transmissions, a connection for broadcast transmissions, or a connection between a group of EDs 110 and one or more RAN nodes 170 for multicast transmissions.

[0024] The RANs 120a and 120b communicate with the core network 130, which provides various services, such as voice, data, and other services, to the EDs 110a, 110b, and 110c. The RANs 120a and 120b and / or the core network 130 may communicate directly or indirectly with one or more other RANs (not shown), which may or may not be served directly by the core network 130, and which may or may not employ the same radio access technology as the RANs 120a, 120b, or both. The core network 130 also serves as a gateway access between (i) the RANs 120a and 120b or the EDs 110a, 110b, and 110c, or both, and (ii) other networks, such as the PSTN 140, the Internet 150, and other networks 160. Additionally, some or all of the EDs 110a, 110b, 110c may use different wireless technologies and / or protocols and may include the capability of communicating with different wireless networks using different wireless links. Instead of (or in addition to) wireless communication, the EDs 110a, 110b, 110c may communicate with a service provider or switch (not shown) and the Internet 150 via wired communication channels. The PSTN 140 may include a circuit-switched telephone network for providing plain old telephone service (POTS). The Internet 150 may include a network of computers and subnets (intranets) or both, and may incorporate protocols such as the Internet Protocol (IP), Transmission Control Protocol (TCP), User Datagram Protocol (UDP), etc. The EDs 110a, 110b, 110c may be multi-mode devices capable of operating according to multiple wireless access technologies, and the EDs 110a, 110b, 110c may incorporate multiple transceivers necessary to support such.

[0025] Figure 3 shows a block diagram of an ED 110, a RAN node 170A that is an NT-TRP, and a RAN node 170B that is a T-TRP. Other EDs 110 and RAN nodes 170 in the communication system 100 may be similar to the ED 110 and RAN nodes 170A, 170B shown in Figure 3. The ED 110 may be used by a person, object, machine, etc., and may be connected to a network, such as the RAN 120, or to another ED 110. The ED110 may be widely used in various scenarios, such as, for example, cellular communication, device-to-device (D2D), vehicle-to-everything (V2X), peer-to-peer (P2P), machine-to-machine (M2M), machine-based communication (MTC), Internet of Things (IOT), virtual reality (VR), augmented reality (AR), industrial control, autonomous driving, telemedicine, smart grid, smart furniture, smart office, smart wearables, smart transportation, smart city, drones, robots, remote sensing, passive sensing, positioning, navigation and tracking, autonomous delivery and mobility.

[0026] Each ED 110 is any suitable electronic device configured for wireless communication with the RAN 120 and / or a wireless network, such as a WiFi network, and may be referred to as a user equipment (UE) or user device. The ED 110 may be any type of end-user device, such as an electronic device, a wireless transmit / receive unit (WTRU), a mobile station, a fixed or mobile subscriber unit, a cellular telephone, a station (STA), a machine type communication (MTC) device, a personal digital assistant (PDA), a smartphone, a laptop, a computer, a tablet, a wireless sensor, a consumer electronics device, a smartbook, a vehicle, an automobile, a truck, a bus, a train, an IOT device, an industrial device, or an apparatus (e.g., a communication module, a modem, or a chip) of the above devices, among other possibilities. Future generations of EDs 110 may be referred to using other terms. Depending on one or more of the availability and need for the connection, each ED 110 connected to the RAN node 170 that is a T-TRP and / or the RAN node 170c that is an NT-TRP 170c may be dynamically or semi-statically turned on (established, activated or enabled), turned off (released, deactivated or disabled) and / or configured.

[0027] The ED 110 includes a transmitter 201 and a receiver 203 coupled to one or more antennas 204. Only one antenna 204 is shown in FIG. 3. Alternatively, one, some or all of the antennas 204 may be panels. The transmitter 201 and the receiver 203 may be integrated into a single device, often referred to as a transceiver. The transceiver is configured to modulate data or other content for transmission by at least one antenna 204 or a network interface controller (NIC). The transceiver may also be configured to demodulate data or other content received by at least one antenna 204. Each transceiver includes any suitable structure used to generate signals for wireless or wired transmission and / or process signals received wirelessly or wired. Each antenna 204 includes any suitable structure used to transmit and / or receive wireless or wired signals.

[0028] The ED 110 includes at least one memory 208. The memory 208 stores instructions and data used, generated, or collected by the ED 110. For example, the memory 208 may store software instructions or modules configured to perform some or all of the functions and / or embodiments described herein and executed by one or more processing units (e.g., processor 210). Each memory 208 includes any suitable volatile and / or non-volatile storage and one or more retrieval devices. Any suitable type of memory may be used, such as random access memory (RAM), read only memory (ROM), hard disk, optical disk, subscriber identity module (SIM) card, memory stick, secure digital (SD) memory card, on-processor cache, etc.

[0029] The ED 110 may further include one or more input / output devices (not shown) or interfaces (such as a wired interface to the Internet 150 in FIG. 1). The input / output devices enable interaction with a user device or other devices in a network. Each input / output device includes any suitable structure for providing information to and receiving information from a user, such as by operating as a speaker, microphone, keypad, keyboard, display or touch screen, including network interface communications.

[0030] The ED 110 includes a processor 210 that performs operations including operations related to preparing an uplink transmission for the RAN node 170c, which is an NT-TRP, and / or the RAN nodes 170a, 170b, which are T-TRPs, operations related to processing a downlink transmission received from the RAN node 170c and / or the RAN nodes 170a, 170b, and operations related to processing a sidelink transmission for and from another ED 110. Processing operations related to preparing an uplink transmission may include operations such as encoding, modulating, transmit beamforming, generating symbols for the uplink transmission. Processing operations related to processing a downlink transmission may include operations such as receive beamforming, demodulating and decoding received symbols. According to an embodiment, the downlink transmission is received by the receiver 203, possibly using receive beamforming, and the processor 210 may extract signaling from the downlink transmission (e.g., by detecting and / or decoding the signaling). An example of signaling may be a reference signal transmitted by RAN node 170c and / or RAN nodes 170a, 170b. In some embodiments, processor 210 performs transmit beamforming and / or receive beamforming based on beam direction indications, e.g., beam angle information (BAI), received from RAN node 170a. In some embodiments, processor 210 may perform operations related to network access (e.g., initial access) and / or downlink synchronization (e.g., operations related to detecting synchronization sequences, decoding and obtaining system information, etc.). In some embodiments, processor 210 may perform channel estimation using, for example, reference signals received from RAN node 170c and / or RAN nodes 170a, 170b.

[0031] Although not shown, the processor 210 may form part of the transmitter 201 and / or may form part of the receiver 203. Although not shown, the memory 208 may form part of the processor 210.

[0032] The processor 210, the processing components of the transmitter 201, and the processing components of the receiver 203 may each be implemented by the same or different processor(s) configured to execute instructions stored in a memory (e.g., in memory 208). Alternatively, some or all of the processor 210, the processing components of the transmitter 201, and the processing components of the receiver 203 may each be implemented using special purpose circuitry, such as a programmed field programmable gate array (FPGA), a graphical processing unit (GPU), or an application specific integrated circuit (ASIC).

[0033] In some implementations, the RAN node 170 may be referred to by other names such as a base station, a base transceiver station (BTS), a radio base station, a network node, a network device, a network side device, a transmitting / receiving node, a Node B, an evolved Node B (eNodeB or eNB), a home eNodeB, a next generation Node B (gNB), a transmission point (TP), a terrestrial transmitting / receiving point (TRP), a non-terrestrial transmitting / receiving point (NT-TRP), a site controller, an access point (AP), a wireless router, a relay station, a remote radio head, a terrestrial node, a terrestrial network device, a terrestrial base station, a baseband unit (BBU), a remote radio unit (RRU), an active antenna unit (AAU), a remote radio head (RRH), a central unit (CU), a distribute unit (DU), a positioning node, among other possibilities. With reference to FIG. 3, the RAN node 170a, which is a T-TRP, may be a macro BS, a pico BS, a relay node, a donor node, and the like, or a combination thereof. The RAN node 170a may refer to the above devices or may refer to the apparatus of the above devices (eg, communication modules, modems, chips).

[0034] In some embodiments, parts of the RAN node 170 may be distributed. For example, some of the modules of the RAN node 170 may be located remotely from the equipment housing the antenna 256 of the RAN node 170 and may be coupled to the equipment housing the antenna 256 using a communication link (not shown), sometimes referred to as a fronthaul, such as a common public radio interface (CPRI). Thus, in some embodiments, the term RAN node may also refer to a network-side module that performs processing operations such as determining the location of the ED 110, resource allocation (scheduling), message generation and encoding / decoding, etc., and that is not necessarily part of the equipment housing the antenna 256 of the RAN node 170. The module may also be coupled to other RAN nodes. In some embodiments, the RAN node 170 may comprise multiple TRPs (e.g., N-TRP and / or T-TRP) that operate together to serve the ED 110, for example by using coordinated multipoint transmission.

[0035] As shown in FIG. 3, the RAN node 170a includes at least one transmitter 252 and at least one receiver 254 coupled to one or more antennas 256. Only one antenna 256 is shown. Alternatively, one, some, or all of the antennas 256 may be panels. The transmitter 252 and receiver 254 may be integrated as a transceiver. The RAN node 170a further includes a processor 260 that performs operations including operations related to preparing a transmission for downlink transmission to the ED 110, processing an uplink transmission received from the ED 110, preparing a transmission for backhaul transmission to the RAN node 170c, and processing a transmission received using the backhaul from the RAN node 170c. Processing operations related to preparing a transmission for downlink or backhaul transmission may include operations such as encoding, modulation, precoding (e.g., multiple input multiple output (MIMO) precoding), transmit beamforming, generating symbols to be used for transmission, etc. Processing operations related to processing of transmissions received on the uplink or backhaul may include operations such as receive beamforming, demodulation of received symbols, and decoding of received symbols. The processor 260 may also perform operations related to network access (e.g., initial access) and / or downlink synchronization, such as generating synchronization signal block (SSB) content, generating system information, and the like. In some embodiments, the processor 260 also generates beam direction indications, such as BAI, which may be scheduled for transmission by the scheduler 253. The processor 260 performs other network side processing operations described herein, such as determining the location of the ED 110 and determining where to deploy the RAN node 170c. In some embodiments, the processor 260 may generate signaling, for example, to configure one or more parameters of the ED 110 and / or one or more parameters of the RAN node 170c. Any signals generated by the processor 260 are sent by the transmitter 252.It is noted that "signaling" as used herein may alternatively be referred to as control signaling. Dynamic signaling may be transmitted on a control channel, e.g., the Physical Downlink Control Channel (PDCCH), and static or semi-static higher layer signaling may be included in packets transmitted on a data channel, e.g., the Physical Downlink Shared Channel (PDSCH).

[0036] The scheduler 253 may be coupled to the processor 260. The scheduler 253 may be included in the RAN node 170a or may be operated separately from the RAN node 170a. The scheduler 253 may schedule uplink, downlink and / or backhaul transmissions, including issuing scheduling grants and / or setting up scheduling-free ("configured grant") resources. The RAN node 170a, which is a T-TRP, further includes a memory 258 for storing information and data. The memory 258 stores instructions and data used, generated or collected by the RAN node 170a. For example, the memory 258 may store software instructions or modules executed by the processor 260 configured to implement some or all of the functions and / or embodiments described herein.

[0037] Although not shown, the processor 260 may form part of the transmitter 252 and / or part of the receiver 254. Also, although not shown, the processor 260 may implement the scheduler 253. Although not shown, the memory 258 may form part of the processor 260.

[0038] Each of the processor 260, the scheduler 253, the processing components of the transmitter 252, and the processing components of the receiver 254 may be implemented by the same or different ones of one or more processors configured to execute instructions stored in a memory, such as the memory 258. Alternatively, some or all of the processor 260, the scheduler 253, the processing components of the transmitter 252, and the processing components of the receiver 254 may be implemented using dedicated circuitry, such as an FPGA, a GPU, or an ASIC.

[0039] In particular, while the NT-TRP RAN node 170c in FIG. 3 is shown as being implemented in a drone, this is by way of example only and the RAN node 170c may be implemented in any suitable non-terrestrial device. In some implementations, the NT-TRP may also be referred to by other names, such as a non-terrestrial node, a non-terrestrial network device, or a non-terrestrial base station. The NT-TRP RAN node 170c includes a transmitter 272 and a receiver 274 coupled to one or more antennas 280. Only one antenna 280 is shown. Alternatively, one, some, or all of the antennas may be panels. The transmitter 272 and the receiver 274 may be integrated as a transceiver. The RAN node 170c, which is an NT-TRP, further includes a processor 276 that performs operations including operations related to preparing a transmission for downlink transmission to the ED 110, processing an uplink transmission received from the ED 110, preparing a transmission for backhaul transmission to the RAN node 170a, and processing a transmission received over the backhaul from the RAN node 170a, where the processing operations related to preparing a transmission for downlink or backhaul transmission may include operations such as encoding, modulation, precoding (e.g., MIMO precoding), transmit beamforming, generating symbols used for transmission, etc. The processing operations related to processing a transmission received over the uplink or backhaul may include operations such as receive beamforming, demodulating received signals, decoding received symbols, etc. In some embodiments, the processor 276 performs transmit beamforming and / or receive beamforming based on beam direction information (e.g., BAI) received from the RAN node 170a. In some embodiments, the processor 276 may generate signaling, for example, to configure one or more parameters of the ED 110. In some embodiments, the RAN node 170c performs physical layer processing but does not perform higher layer functions, such as functions at the medium access control (MAC) layer or radio link control (RLC) layer.This is by way of example only; more generally, the RAN node 170c may perform higher layer functions in addition to physical layer processing.

[0040] The RAN node 170c further includes a memory 278 for storing information and data. Although not shown, the processor 276 may form part of the transmitter 272 and / or part of the receiver 274. Although not shown, the memory 278 may form part of the processor 276.

[0041] The processor 276, the processing components of the transmitter 272, and the processing components of the receiver 274 may each be implemented by the same or different processor(s) configured to execute instructions stored in a memory, such as the memory 278. Alternatively, some or all of the processor 276, the processing components of the transmitter 272, and the processing components of the receiver 274 may be implemented using dedicated circuitry, such as programmed FPGAs, GPUs, or ASICs. In some embodiments, the RAN node 170c may include multiple NT-TRPs operating together to serve the EDs 110, for example, by using coordinated multipoint transmission.

[0042] A RAN node 170, such as RAN node 170a or RAN node 170c, and / or the ED 110 may include other components, which are omitted for clarity.

[0043] One or more steps of the method for implementing the reliability assurance of inference requests and inference responses described herein may be performed by a portion or module of the ED 110 or the RAN node 170. FIG. 4 illustrates portions or modules of the ED 110 or the RAN node 170. As an example, a wireless signal, such as a radio frequency signal, may be transmitted by a transmitter or a transmission module of the ED 110 or the RAN node. The transmitter or the transmission module may perform source encoding and channel encoding at a media access control (MAC) layer and a physical layer, as known to those skilled in the art. The wireless signal, such as a radio frequency signal, may be received by a receiver or a reception module of the ED 110 or the RAN node 170. The wireless signal may be processed by a processor or a processing module of the ED 110. The receiver or the reception module may perform source decoding and channel decoding at a media access control (MAC) layer and a physical layer, as known to those skilled in the art. Other operations, including generating an inference job including one or more inference requests and encoding input data for each inference request, may be performed by an artificial intelligence (AI) module or a machine learning (ML) module of the ED 110. Each portion or module may be implemented using hardware, one or more components or devices executing software, or a combination thereof. For example, one or more of the portions or modules may be a programmed integrated circuit such as an FPGA, GPU, or ASIC. When a module is implemented using software for execution by a processor, it will be understood that, for example, all or part of the instruction module may be retrieved by the processor as single or multiple instances, individually or together, for processing as desired, and the module itself may include instructions for further deployment and instantiation.

[0044] Many more details regarding the ED 110, the RAN node 170 are known to those skilled in the art, and therefore these details are omitted herein.

[0045] Typically, the air interface includes several components and associated parameters that collectively specify how transmissions are sent and / or received using a wireless communication link between two or more communication devices (e.g., between an ED 110 and one or more RAN nodes 170, between a RAN node 170 and one or more EDs 110, or between EDs 110). For example, the air interface may include one or more components that define one or more waveforms, one or more frame structures, one or more multiple access schemes, one or more protocols, one or more coding schemes, and / or one or more modulation schemes for conveying information (e.g., data) using a wireless communication link. The wireless communication link may be a link between a RAN node 170 (e.g., a T-TRP or an NT-TRP) and an ED 110 (e.g., a "Uu" link), and / or the wireless communication link may be a link (two EDs 110) (e.g., a "sidelink"), and / or the wireless communication link may be a link between a non-terrestrial (NT) communication network and an ED 110. The following are some examples of the above components:

[0046] A waveform component may specify the shape and form of a transmitted signal. Waveform components may include orthogonal multiple access waveforms and non-orthogonal multiple access waveforms. Non-limiting examples of such waveform components include Orthogonal Frequency Division Multiplexing (OFDM) waveforms, Filtered OFDM (f-OFDM) waveforms, Time windowing OFDM, Filter Bank Multicarrier (FBMC) waveforms, Universal Filtered Multicarrier (UFMC) waveforms, Generalized Frequency Division Multiplexing (GFDM) waveforms, Wavelet Packet Modulation (WPM) waveforms, and Faster Than Nyquist (FTN) Peak to Average Power Ratio Waveform (low PAPR WF).

[0047] The frame structure component may specify a configuration of a frame or a group of frames. The frame structure component may indicate one or more of the time, frequency, pilot signature, code, and / or other parameters of the frame or group of frames. Details of the frame structure are described below.

[0048] The multiple access scheme component may specify multiple access technique options, including techniques that define how the communication devices share a common physical channel, e.g., TDMA, FDMA, CDMA, SDMA, SC-FDMA, Low Density Signature Multicarrier CDMA (LDS-MC-CDMA), Non-orthogonal Multiple Access (NOMA), Pattern Division Multiple Access (PDMA), Lattice Partition Multiple Access (LPMA), Resource Spread Multiple Access (RSMA), and Sparse Code Multiple Access (SCMA). Additionally, the multiple access technique options may include scheduled access, unscheduled access, also referred to as grant-free access, non-orthogonal multiple access or orthogonal multiple access, e.g., via dedicated channel resources (e.g., not shared between multiple communication devices), shared channel resources with contention or shared channel resources without contention, and access using cognitive radio.

[0049] A hybrid automatic repeat request (HARQ) protocol component may specify how transmission and / or retransmission is performed. Non-limiting examples of transmission and / or retransmission mechanism options include scheduled data pipe size, signaling mechanisms for transmission and / or retransmission, and options that specify retransmission mechanisms.

[0050] The coding and modulation components specify how the information to be transmitted is encoded / decoded and modulated / demodulated for transmission / reception. Coding may refer to methods of error detection and forward error correction. Non-limiting examples of coding options include turbo trellis codes, turbo product codes, fountain codes, low density parity check codes, and polar codes. Modulation may simply refer to the constellation (including, for example, the modulation technique and modulation order), and may specifically refer to various types of advanced modulation methods such as hierarchical modulation and low PAPR modulation.

[0051] In some embodiments, the air interface may be a "one-size-fits-all" concept. For example, this may mean that once the air interface is defined, the components included in the air interface cannot be changed or adapted. In some implementations, only limited parameters or modes of the air interface, such as the cyclic prefix (CP) length or MIMO mode, can be configured. In some embodiments, the air interface design may provide a unified and flexible framework to support frequencies below the known 6 GHz band and frequencies above the 6 GHz band (e.g., mmWave bands) for both licensed and unlicensed access. As an example, the flexibility of the configurable air interface provided by scalable numerology and symbol width may enable optimization of transmission parameters for different spectrum bands and different services / devices. As another example, the unified air interface is self-contained in the frequency domain, and a self-contained design in the frequency domain may support more flexible RAN slicing through channel resource sharing between different services in both frequency and time.

[0052] The frame structure is a wireless communication physical layer feature that defines a time domain signal transmission structure, e.g., to allow timing alignment with reference to the timing of an underlying time domain transmission unit. Wireless communication between communication devices may occur over time-frequency resources governed by the frame structure. The frame structure may also be referred to as a radio frame structure.

[0053] Depending on the frame structure and / or the configuration of frames in the frame structure, Frequency Division Duplex (FDD) and / or Time Division Duplex (TDD) and / or Full Duplex (FD) communication may be possible. FDD communication is when transmissions in different directions (e.g., uplink or downlink) occur in different frequency bands. TDD communication is when transmissions in different directions (e.g., uplink or downlink) occur in different time durations. FD communication is when transmission and reception occur in the same time-frequency resource, i.e., a device can transmit and receive in the same frequency resource during the same period.

[0054] An example of a frame structure is that specified for use in known Long Term Evolution (LTE) cellular systems, with each frame having a width of 10 ms, each frame having 10 subframes, each subframe having a width of 1 ms, each subframe containing two slots, each slot having a width of 0.5 ms, each slot being used to transmit seven OFDM symbols (assuming the CP is conventional), each OFDM symbol having a particular bandwidth (or sub-bandwidth or bandwidth partition) related to the symbol width and the number of subcarriers and the subcarrier spacing, the frame structure being based on OFDM waveform parameters such as subcarrier spacing and CP length (there are fixed length and limited length options for the CP), and the uplink / downlink switching gap in TDD is specified as an integer number of times the OFDM symbol width.

[0055] Another example of a frame structure is that specified for use in the known New Radio (NR) cellular system, where multiple subcarrier spacings are supported, each corresponding to a respective numerology, and the frame structure is dependent on the numerology, but in any case, the frame length is set to 10 ms, each frame consists of 10 subframes, each subframe is 1 ms wide, and the slots are defined as 14 OFDM symbols, with the slot length dependent on the numerology. For example, the NR frame structure for a 15 kHz subcarrier spacing with normal CP ("numerology 1") is different from the NR frame structure for a 30 kHz subcarrier spacing with normal CP ("numerology 2"). For a 15 kHz subcarrier spacing, the slot length is 1 ms, and for a 30 kHz subcarrier spacing, the slot length is 0.5 ms. The NR frame structure may be more flexible than the LTE frame structure.

[0056] Another example of a frame structure is, for example, that used in 6G and beyond networks. In a flexible frame structure, a symbol block may be defined to have a width that is the smallest time width that can be scheduled in the flexible frame structure. A symbol block may be a unit of transmission having a selectable redundant part (e.g., CP part) and an information (e.g., data) part. An OFDM symbol is an example of a symbol block. A symbol block may alternatively be referred to as a symbol. Flexible frame structure embodiments include different parameters that may be configurable, such as frame length, subframe length, symbol block length, etc. In some embodiments of a flexible frame structure, examples of possible configurable parameters include frame length, subframe width, slot configuration, subcarrier spacing (SCS), flexible transmission width of the basic transmission unit, and flexible switch gap.

[0057] The frame length need not be limited to 10 ms, and may be configurable and may vary over time. In some embodiments, each frame may include one or more downlink synchronization channels and / or one or more downlink broadcast channels, and each synchronization channel and / or broadcast channel may be transmitted in a different direction by performing different beamforming. The frame length may be one or more feasible values ​​and may be set based on the application. For example, an autonomous vehicle may require relatively early first access, in which case the frame length may be set to 5 ms for use in the autonomous vehicle application. As another example, a residential smart meter may not require early first access, in which case the frame length may be set as 20 ms for use in the smart meter application.

[0058] Subframes may or may not be defined in a flexible frame structure depending on the implementation. For example, a frame may be defined to include slots but not subframes. In frames in which subframes are defined, the width of the subframes may be configurable, e.g., to align in the time domain. For example, subframes may be configured to have a length of 0.1 ms, 0.2 ms, 0.5 ms, 1 ms, 2 ms, 5 ms, etc. In some embodiments, if subframes are not required in a particular scenario, the subframe length may or may not be defined to be the same as the frame length.

[0059] Slots may or may not be defined in a flexible frame structure depending on the implementation. In the frame in which slots are defined, in this case the definition of the slots (e.g. the time width and / or the number of symbol blocks) may be configurable. In one embodiment, the slot configuration is common to all EDs 110 or common to a group of EDs 110. In this case, the slot configuration information may be transmitted to the EDs 110 on a broadcast channel or one or more common control channels. In other embodiments, the slot configuration may be UE specific, in which case the slot configuration information may be transmitted on a UE specific control channel. In some embodiments, the slot configuration signaling may be transmitted together with the frame configuration signaling and / or the subframe configuration signaling. In other embodiments, the slot configuration may be transmitted independently of the frame configuration signaling and / or the subframe configuration signaling. In general, the slot configuration may be common to the system, common to a base station, common to a group of UEs, or specific to a UE.

[0060] The SCS may range from 15KHz to 480KHz. The SCS may vary depending on the frequency of the spectrum and / or the maximum UE speed to minimize the impact of Doppler shift and phase noise. In some examples, the transmit and receive frames are separate and the SCS of the symbols of the receive frame structure may be set independently of the SCS of the symbols of the transmit frame structure. The SCS of the receive frames may be different from the SCS of the transmit frames. In some examples, the SCS of each transmit frame may be half the SCS of each receive frame. In cases where the SCS of the receive and transmit frames are different, the difference need not necessarily be magnified by a factor of two, for example, when an inverse discrete Fourier transform (IDFT) is used instead of a fast Fourier transform (FFT) to implement a more flexible symbol width. Other examples of frame structures can be used with different SCS.

[0061] The basic transmission unit is a symbol block (also called a symbol), which typically includes a redundant portion (applied as a CP) and an information (e.g., data) portion. In some embodiments, the CP may be omitted from the symbol block. The CP length may be flexible and configurable. The CP length may be fixed within a frame, or may be flexible within a frame, and in some cases the CP length may vary from a given frame to another frame, from a given group of frames to another group of frames, from a given subframe to another subframe, from a given slot to another slot, or dynamically, from a given schedule to another schedule. The information (e.g., data) portion may be flexible and configurable. Another possible parameter related to the symbol block that can be defined is the ratio of the CP width to the information (e.g., data) width. In some embodiments, the symbol block length may be adjusted depending on the channel conditions (e.g., multipath delay, Doppler) and / or latency requirements and / or available time width. As another example, the symbol block length may be adjusted to fit the available time width into a frame.

[0062] A frame may include both a downlink portion used for downlink transmission from the RAN node 170 and an uplink portion used for uplink transmission from the ED 110. A gap may exist between each uplink and downlink portion, which is referred to as a switching gap. The switching gap length (width) may be configurable. The switching gap width may be fixed within a frame, may be flexible within a frame, and in some cases the switching gap width may vary from a given frame to another frame, from a given group of frames to another group of frames, from a given subframe to another subframe, from a given slot to another slot, or dynamically from a given schedule to another schedule.

[0063] A RAN node 170, such as a base station, may provide coverage across a cell. Wireless communication with devices may occur using one or more carrier frequencies. A carrier frequency is referred to as a carrier. A carrier may alternatively be referred to as a component carrier (CC). A carrier may be characterized by its bandwidth and a reference frequency, e.g., a center frequency, a minimum frequency, and a maximum frequency of the carrier. A carrier may be on a licensed or unlicensed spectrum. Similarly or alternatively, wireless communication with devices may occur using one or more bandwidth parts (BWPs). By way of example, a carrier may have one or more BWPs. More generally, wireless communication with devices may occur across a spectrum. A spectrum may comprise one or more carriers and / or one or more BWPs.

[0064] A cell may include one or more downlink resources and one or more uplink resources, which may be added optionally. A cell may include one or more uplink resources and one or more downlink resources, which may be added optionally. A cell may include both one or more downlink resources and one or more uplink resources. As an example, a cell may include only one downlink carrier / BWP, only one uplink carrier / BWP, multiple downlink carriers / BWPs, multiple uplink carriers / BWPs, one downlink carrier / BWP and one uplink carrier / BWP, one downlink carrier / BWP and multiple uplink carriers / BWPs, multiple downlink carriers / BWPs and one uplink carrier / BWP, or multiple downlink carriers / BWPs and multiple uplink carriers / BWPs. In some embodiments, instead or in addition, a cell may include one or more sidelink resources, including sidelink transmission and reception resources.

[0065] A BWP may be a set of contiguous or non-contiguous frequency subcarriers on a carrier, a set of contiguous or non-contiguous frequency subcarriers on multiple carriers, or a set of non-contiguous or contiguous frequency subcarriers that may have one or more carriers.

[0066] In some embodiments, a carrier may have one or more BWPs, for example, a carrier may have a bandwidth of 20 MHz and may consist of one BWP, a carrier may have a bandwidth of 80 MHz and may consist of two adjacently consecutive BWPs, etc. In other embodiments, a BWP may have one or more carriers, for example, a BWP may have a bandwidth of 40 MHz and may consist of two adjacently consecutive carriers, each carrier having a bandwidth of 20 MHz. In some embodiments, a BWP may comprise non-contiguous spectrum resources of multiple, non-contiguous carriers, where a first carrier of the non-contiguous carriers may be in the mmW band, a second carrier may be in the low band (such as the 2 GHz band), a third carrier (if present) may be in the THz band, and a fourth carrier (if present) may be in the visible light band. Resources in one carrier belonging to a BWP may be contiguous or non-contiguous. In some embodiments, a BWP has non-contiguous spectrum resources on one carrier.

[0067] Wireless communication may occur over an occupied bandwidth, which may be defined as the width of a frequency band below a lower frequency limit and above an upper frequency limit such that the average power emitted each is equal to a specified fraction β / 2 of the total average transmitted power (e.g., the value of β / 2 is taken as 0.5%).

[0068] The carrier, BWP or occupied bandwidth may be dynamically signaled by a network device (e.g., RAN node 170) in, for example, a known physical layer control signaling such as a Downlink Control Channel (DCI), semi-statically signaled in, for example, Radio Resource Control (RRC) signaling or Medium Access Control (MAC) layer signaling, or may be predetermined based on the application scenario, or determined by ED 110 as a function of other parameters known by ED 110, or may be fixed, for example by a standard.

[0069] In cellular communication networks, location information of EDs 110 (hereinafter referred to as ED location information) is frequently used to improve various performance metrics of the network, including, for example, capacity, agility, and efficiency. Such improvements may be achieved when elements of the network exploit the location, behavior, mobility patterns, etc. of EDs 110, where the radio environment in which the EDs 110 are operating is described by a priori information.

[0070] A sensing system may be used to help gather ED attitude information, including the location of the ED 110 in a global coordinate system, the speed and direction of movement of the ED 110 in the global coordinate system, orientation information, and information about the radio environment. "Location" may also be referred to as "position," and the two terms may be used interchangeably herein. Examples of known sensing systems include RADAR (Radio Detection and Ranging) sensing systems and LIDAR (Light Detection and Ranging) sensing systems. While the sensing system may be separate from the communication system, it may be useful to gather information using an integrated system, thereby reducing the hardware (and cost) of the integrated system, as well as the time, frequency, and space resources required to perform both functions. However, using the communication system hardware to perform sensing of the ED attitude and environmental information is a very challenging and unsolved problem. The difficulty of this problem is related to factors such as the limited resolution of the communication system, the dynamic nature of the environment, and the large number of objects whose electromagnetic properties and positions are to be estimated.

[0071] Therefore, integrated sensing and communication (also referred to as integrated communication and sensing) is a desired feature in existing and future communication systems.

[0072] Any or all of the ED 110 and the RAN nodes 170 may be sensing nodes of the system 100. A sensing node is a network entity that performs sensing by transmitting and receiving sensing signals. A sensing node is a communication device that performs both communication and sensing. However, some sensing nodes may not perform communication and may be dedicated to sensing, unlike the above. The sensing agent 174 is an example of a sensing node dedicated to sensing. Unlike the ED 110 and the BS 170, the sensing agent 174 does not transmit or receive communication signals. However, the sensing agent 174 may communicate configuration information, sensing information, signaling information, and other information within the communication system 100. The sensing agent 174 may communicate with the core network 130 to communicate and convey information with the rest of the communication system 100. As an example, the sensing agent 174 may determine the location of the ED 110a and transmit this information to the base station 170a via the core network 130. 2, any number of sensing agents may be implemented in the communications system 100. In some embodiments, one or more sensing agents may be implemented in one or more RANs 120.

[0073] Sensing-based and reference signal-based techniques may be combined by a sensing node to enhance the determination of the UE's attitude. This type of sensing node may also be referred to as a sensing management function (SMF). In some networks, the SMF may also be referred to as a location management function (LMF). The SMF may be implemented as a physically separate entity located in the core network 130 that is connected to multiple RAN nodes 170. In other aspects of the application, the SMF may be implemented as a co-located logical entity within the RAN node 170 through logic performed by the processor 260.

[0074] As shown in FIG. 5, the SMF 176, when implemented as a physically separate entity, includes at least one processor 290, at least one transmitter 282, at least one receiver 284, one or more antennas 286, and at least one memory 288. Transceivers, not shown, may be used instead of the transmitter 282 and the receiver 284. A scheduler 283 may be coupled to the processor 290. The scheduler 283 may be included within the SMF 176 or may be operated separately from the SMF 176. The processor 290 performs various processing operations of the SMF 176, such as signal coding, data processing, power control, input / output processing, and other functions. The processor 290 may be configured to perform some or all of the functions and / or embodiments described in more detail above. Each processor 290 includes any suitable processing or computing device configured to perform one or more operations. Each processor 290 may include, for example, a microprocessor, a microcontroller, a digital signal processor, a field programmable gate array, or an application specific integrated circuit.

[0075] Attitude determination techniques using reference signals belong to the "active" attitude estimation paradigm. In the active attitude estimation paradigm, an attitude information inquirer (e.g., ED 110) participates in a process to determine the attitude of the inquirer. The inquirer may transmit or receive (or both) signals specific to the attitude determination process. Global Navigation Satellite System (GNSS)-based positioning techniques, such as the well-known Global Positioning System (GPS), are other examples of the active attitude estimation paradigm.

[0076] In contrast, sensing techniques based on radar, for example, may be considered to belong to the "passive" attitude determination paradigm, in which the target is not aware of the attitude determination process.

[0077] By integrating sensing and communications in one system, the system does not have to operate according to a single fundamental principle, and so sensing-based and reference-based techniques can be combined to enhance attitude determination.

[0078] The enhanced attitude determination may include, for example, obtaining UE channel subspace information, which is particularly useful for UE channel reconstruction at the sensing node, especially for beam-based operation and communication. The UE channel subspace is a subset of the entire algebraic space defined over the spatial domain in which the entire TP to UE channel resides. Thus, the UE channel subspace defines the TP to UE channel with very high accuracy. Signals transmitted over other subspaces have negligible effects on the UE channel. Knowledge of the UE channel subspace helps to reduce the effort required for channel measurement at the UE and channel reconstruction on the network side. Thus, a combination of sensing-based and reference signal-based techniques can enable UE channel reconstruction with much less overhead compared to conventional methods. Subspace information can also facilitate subspace-based sensing, reducing sensing complexity and improving sensing accuracy.

[0079] In some embodiments of integrated sensing and communication, the same radio access technology (RAT) is used for sensing and communication, which avoids the need to multiplex two different RATs using one carrier spectrum or the necessity of two different carrier spectrums for the two different RATs.

[0080] In an embodiment where sensing and communication are integrated with one RAT, a first set of channels may be used to transmit sensing signals and a second set of channels may be used to transmit communication signals, in some embodiments each channel in the first set of channels and each channel in the second set of channels may be a logical channel, a transport channel, or a physical channel.

[0081] In the physical layer, communication and sensing may be performed through separate physical channels. For example, a first physical downlink shared channel PDSCH-C is defined for data communication, and a second physical downlink shared channel PDSCH-S is defined for sensing. Similarly, separate physical uplink shared channels (PUSCHs) PUSCH-C and PUSCH-S may be defined for uplink communication and sensing.

[0082] In another example, the same PDSCH and PUSCH may be used for both communication and sensing, and separate logical and / or transport layer channels are defined for communication and sensing. It is also noted that one or more control channels and one or more data channels for sensing may have the same or different channel structures (formats), and may occupy the same or different frequency bands or bandwidth parts.

[0083] In yet another example, a common physical downlink control channel (PDCCH) and a common physical uplink control channel (PUCCH) may be used to carry control information for both sensing and communication. Alternatively, separate physical layer control channels may be used to carry separate control information for communication and sensing. For example, PUCCH-S and PUCCH-C may be used for uplink control of sensing and communication, respectively, and PDCCH-S and PDCCH-C may be used for downlink control of sensing and communication, respectively.

[0084] Different combinations of shared and dedicated channels for sensing and communication at each of the physical, transport and logical layers are possible.

[0085] Terrestrial communication systems are also referred to as land-based or land-based communication systems, but as well or instead, terrestrial communication systems can be implemented on or under water. Non-terrestrial communication systems may fill coverage gaps in underserved areas by extending the coverage of cellular networks through the use of non-terrestrial nodes, which is key to establishing global seamless coverage and providing mobile broadband services to unserved / underserved areas. Currently, it is hardly possible to implement terrestrial access point / base station infrastructure in areas such as ocean, mountain, forest, and remote areas.

[0086] The terrestrial communication network may be a wireless communication network using 5G technology and / or later generation wireless technologies (e.g., 6G and beyond). In some examples, the terrestrial communication network may also accommodate traditional wireless technologies (e.g., 3G and 4G wireless technologies). The non-terrestrial communication network may be a communication network using a satellite constellation, such as a traditional geostationary orbit (GEO) satellite, which broadcasts public / general content to local servers. The non-terrestrial communication network may be a communication system using low earth orbit (LEO) satellites, which is known to establish a good balance between large coverage area and propagation path loss / delay. The non-terrestrial communication network may be a communication network using satellites stabilized with very low earth orbit (VLEO) technology, which significantly reduces the cost of launching satellites into low earth orbit. The non-terrestrial communication network may be a communication network using high altitude platforms (HAPs), which is known to provide a low path loss radio interface to users with limited power budgets. The non-terrestrial communication network may be a communication system using unmanned aerial vehicles (UAVs) (or unmanned aerial systems (UASs)), such as airborne, balloons, quadcopters, drones, etc., which achieve high density deployment because coverage can be limited to a local area. In some examples, GEO satellites, LEO satellites, UAVs, HAPs, and VLEOs may be horizontal and two-dimensional. In some examples, UAVs, HAPs, VLEOs may be combined and satellite communication may be integrated into a cellular network. The emerging 3D vertical network consists of a large number of moving objects (other than geostationary satellites) and high altitude access points such as UAVs, HAPs, and VLEOs.

[0087] MIMO technology can achieve a single signal transmission and reception with an antenna array of multiple antennas to meet the requirement of high transmission speed. ED 110 and RAN node 170, which are T-TRP and / or NT-TRP, may use MIMO to communicate using radio resource blocks. MIMO utilizes multiple antennas at the transmitter to transmit radio resource blocks using parallel radio signals. Therefore, multiple antennas may be used at the receiver. MIMO may perform beamforming on the parallel radio signals for reliable multipath transmission of the radio resource blocks. MIMO may concatenate parallel radio signals carrying different data to increase the data rate of the radio resource blocks.

[0088] In recent years, MIMO (Massive MIMO) wireless communication networks with T-TRP and / or NT-TRP RAN nodes 170 configured with multiple antennas have gained widespread attention from academia and industry. In a Massive MIMO system, the T-TRP RAN node 170 and / or NT-TRP RAN node 170 are typically configured with more than 10 antenna units (see antenna 256 and antenna 280 in FIG. 3). Typically, the T-TRP RAN node 170 and / or NT-TRP RAN node 170 are operable to serve dozens (e.g., 40) of EDs 110. The multiple antenna units of the T-TRP RAN node 170 and NT-TRP RAN node 170 can greatly increase the spatial freedom of wireless communication, greatly improve the transmission speed, spectrum efficiency and power efficiency, and greatly reduce the interference between cells. By increasing the number of antennas, the size of each antenna unit can be reduced while reducing the cost. Using the spatial freedom provided by the large antenna units, the RAN node 170, T-TRP, and the RAN node 170, NT-TRP, of each cell can simultaneously communicate with multiple EDs 110 in the cell using the same time-frequency resources, greatly increasing the spectrum efficiency. The large number of antenna units of the RAN node 170, T-TRP, and / or the RAN node 170, NT-TRP, also allows for high spatial directivity of uplink and downlink transmissions of each user, thereby reducing the transmission power of the RAN node 170, T-TRP, and / or the RAN node 170, NT-TRP, and the EDs 110, and correspondingly increasing the power efficiency. When the number of antennas of the RAN node 170 that is a T-TRP and / or the RAN node 170 that is an NT-TRP is sufficiently large, random channels between each ED 110 and the RAN node 170 that is a T-TRP and / or the RAN node 170 that is an NT-TRP can approach an orthogonal state such that interference and noise effects between cells and users can be reduced.Due to the multiple effects described above, massive MIMO may have great application potential.

[0089] A MIMO system may include a receiver connected to a receive (Rx) antenna, a transmitter connected to a transmit (Tx) antenna, and a signal processor connected to the transmitter and the receiver. Each of the Rx antenna and the Tx antenna may include multiple antennas. As an example, the Rx antenna may have a uniform linear array (ULA) antenna in which multiple antennas are arranged in a row at equal intervals. When a radio frequency (RF) signal is transmitted through the Tx antenna, the Rx antenna may receive a signal reflected back from a target in front of the Rx antenna.

[0090] An illustrative list of possible locations or possible configuration parameters or in some embodiments of a MIMO system includes panels and beams.

[0091] A panel is a portion of an antenna group, antenna array or antenna sub-array that can individually control Tx beams or Rx beams.

[0092] The beam may be formed by performing amplitude and / or phase weighting on data transmitted or received by at least one antenna port. The beam may be formed using other methods, for example, by adjusting related parameters of the antenna unit. The beam may include a Tx beam and / or an Rx beam. The transmit beam refers to a distribution of signal strength formed in various directions in space after a signal is transmitted through an antenna. The receive beam refers to a distribution of signal strength of a wireless signal received from an antenna in different directions in space. The beam information may include a beam identifier, one or more antenna port identifiers, a channel state information reference signal (CSI-RS) resource identifier, an SSB resource identifier, a sounding reference signal (SRS) resource identifier, or other reference signal resource identifier.

[0093] DNNs trained to perform various tasks, such as computer vision tasks, natural language processing tasks, and speech recognition tasks, may be hosted on a remote computing system, such as a cloud computing system. The ED 110 may communicate with such a remote computing system via a next-generation communication system, such as the communication system 100 shown in FIG. 1 and FIG. 2, to access the DNNs hosted on the remote computing system. In a typical scenario shown in FIG. 6, an application running on the ED 110 generates a request for a DNN 650 hosted on the computing system 600, and the ED 110 sends a wireless transmission 601 including a request to the DNN 650 hosted on the computing system 600 (i.e., deployed and running on the computing system 600) to perform inference on input data included in the request. The DNN 650 is configured to perform a specific task (e.g., trained to perform a specific task, such as a computer vision task, a speech signal processing task, a natural language processing task, etc.). If the request specifies that the DNN 650 should perform inference on the input data included in the request, the request sent by the ED 110 may be referred to as an "inference request." The inference request may include the input data. When the wireless transmission 601 containing the inference request is received at the RAN node 170 using the radio / air interface 630, the RAN node 170 transmits a further transmission 602 containing the inference request to the computing system 600 hosting the DNN 650. The RAN node 170 may transmit the further transmission 602 directly to the computing system 600 via the core network 130 or may transmit the further transmission 602 to the core network 130 and then via the Internet 150, which forwards the further transmission 602 to the computing system 600. As shown in Figures 1 and 2, the core network 130 may be connected to the computing system 600 via the Internet 150.

[0094] 6 shows the DNN 650 being hosted on a computing system 600 that is directly connected to the core network 130 (or indirectly via the Internet 150), the DNN 650 may be hosted on other types of computing systems in the communication system 100. For example, the DNN 650 may be hosted on one or more edge nodes, where the one or more edge nodes are located near the RAN node 170 and connected to the RAN node 170. Alternatively, the DNN 650 may be hosted on (i.e., deployed and running on) the computing system of the RAN node 170.

[0095] Although only one DNN 650 is shown in FIG. 6, it will be understood that the computing system 600 may host multiple DNNs, where each DNN is configured (i.e., trained) to perform a different task.

[0096] When yet another transmission 602 containing an inference request is received by the computing system 600 hosting the DNN 650, the input data contained in the inference request may be queued by the DNN 650. The DNN 650 makes the inference request (i.e., performs inference using the input data contained in the inference request). When the DNN 650 completes the inference, inference data is output by the DNN 650. The inference data may include a prediction value generated by the DNN 650 based on the input data. The computing system 600 transmits a backbone transmission 603 containing the inference response over the core network 130 (or over a combination of the Internet 150 and the core network 130) to the RAN node 170 associated with the requesting ED 110. The RAN node 170 then transmits a wireless transmission 604 containing the inference response to the ED 110 over the air 630.

[0097] It can be seen that the exemplary scenario described above has at least one deficiency in that the reliability of the inference response contained in the radio transmission 604 received by the ED 110 from the RAN node 170 or the backbone transmission 603 received by the RAN node 170 from the computing system 600 hosting the DNN 650 appears to be uncertain.

[0098] Conventional communication systems are known to establish secure, reliable, and even trustworthy transmissions over the airwaves 630 and within the core network 130. Such known secure and reliable transmissions do not help ensure the reliability of the input data included in the inference request and the inference data received in the output inference response generated by the DNN 650.

[0099] 6, it is worth noting that an inference request originating at the ED 110 and destined for the DNN 650 may be subject to two main types of malicious attacks. Type I malicious attacks can be defined as those related to malicious behavior of the DNN 650 or related to tampering with one of the transmissions 601, 602 containing an inference request, while Type II malicious attacks can be defined as those related to tampering with one of the transmissions 603, 604 containing an inference response. To protect against both Type I and Type II malicious attacks, it is proposed herein to establish a method for ensuring the authenticity of inference requests and inference responses in the communication system connecting the ED 110, the RAN node 170 (edge ​​computing node), and the computing system 600 hosting the DNN 650. In one aspect, the method for ensuring authenticity involves establishing a trust level that the input data received at the DNN 650 is the same as the input data sent by the ED 110. In another aspect, a method for ensuring reliability involves establishing a level of confidence that the inference data received at ED 110 is the same as the inference data generated by DNN 650.

[0100] Unfortunately, little attention has been paid to the reliability of the inference data contained in the inference response received from the RAN node 170 via wireless transmission. In the initial setting, the computing system 600 hosting the DNN 650 requires a grant that is unconditionally reliable for the inference response. That is, it is expected that the end user will be confident that the inference data indirectly received from the computing system 600 hosting the DNN 650 is the inference data that is the result of the DNN 650 performing inference on the specific input data provided to the DNN 650 by the end user. Such an unconditionally reliable grant causes a large potential safety problem in the future wireless society. In the near future, it can be expected that a high density of IOT-UEs, such as unmanned cars and components of industrial automation factories connected to the RAN 120 of the communication system 100, will penetrate various industries. It can be fully expected that malicious attacks on the DNN 650 will cause great chaos. Of course, there is no promise that the computing system 600 hosting the DNN 650 will not perform easy operations for economic gain, and therefore has an impact similar to that of a malicious attack. Such careless behavior may involve, for example, a malicious provider of a cloud computing system offering access to the DNN 650 as a service, arranging for the DNN 650 to generate and output corresponding inference responses that include inference data that is unrelated to the input data received.

[0101] In addition to the reliability and privacy concerns from the perspective of the ED 110, there are similar concerns from the perspective of the DNN 650. If a third party eavesdrops on a sufficient number of pairs of inference requests contained in transmissions 602 sent to the computing system 600 hosting the DNN 650 and inference responses contained in transmissions 603 sent by the computing system 600 hosting the DNN 650, the third party can configure (i.e., train) their DNN to be similar to the DNN 650 using the input data contained in the inference requests and the inference data contained in the inference responses.

[0102] Generally, aspects of the present application relate to a method for trust assurance that includes evaluating the trustworthiness of an inference response received from a computing system 600 hosting a DNN 650 via a transmission in a communication system. Advantageously, aspects of the present application relate to preventing theft of, and malicious attacks on, the inference requests contained in transmissions 601, 602 and the inference responses contained in transmissions 603, 604.

[0103] For an inference job, the requesting ED 110 sends one or more inference requests to the DNN 650 via the RAN node 170 to the computing system 600 hosting the DNN 650, the DNN 650 generates an inference response corresponding to each inference request, and the inference response is sent by the computing system 600 back to the ED 110 via the core network 130 and the RAN node 170 (or the Internet 150, the core network 130, and the RAN node 170). It can be understood that an inference request includes both a control header and input data, and other information as appropriate. An inference request may be transmitted over one or more uplink transmission intervals. As an example, if the inference request includes high definition video, a frame of the video may be transmitted over multiple source blocks using multiple code words that may be transmitted over multiple uplink transmission intervals. As another example, if the inference request includes simple text, the inference request may be transmitted over one source block using one code word during one uplink transmission interval.

[0104] There are concerns regarding the privacy of the inference request and the inference response. The inference request and the inference response are respectively encapsulated in wireless transmissions 601, 604 transmitted using the airwaves 630 between the ED 110 and the RAN node 170. The inference request and the inference response are also respectively encapsulated in transmissions 602, 603 transmitted between the RAN node 170 and the computing system 600 hosting the DNN 650 via the core network 130 or via the core network 130 and the Internet 150. Thus, malicious attacks, including hacking, eavesdropping, alteration, substitution and blocking, may occur against the wireless transmissions 601, 604 or against the transmissions 602, 603.

[0105] There are also concerns about the theft of raw data, i.e., input data included in an inference request. For example, if the ED 110 is an autonomous vehicle, video data generated by a digital camera mounted on the autonomous vehicle forms the basis of input data used in the inference of pedestrian detection. The video data generated by the camera may contain personal data. In such cases, it may be considered undesirable for the video data to be obtained by a third party. This is particularly a concern when a third party can also access the predicted values ​​(e.g., inference data) contained in the inference response generated and output by the DNN 650 in response to an inference request. If a third party has access to the input data provided to the DNN 650 and the inference data output by the DNN 650 on numerous occasions, the third party may at some point think that a sufficient number of pairs of inference requests and inference responses have been accumulated to form a new training dataset with training data samples, each training data sample including the input data and inference data of an inference request and inference response pair. It is clear that the accumulated pairs are not the pairs that formed the training dataset used to train the cloud-based DNN 650. On the other hand, there is a risk that a third party could use a new training dataset to train a malicious DNN using a machine learning algorithm so that the malicious DNN has similar parameters and performance to DNN650.

[0106] In theory, the ED 110 can accumulate multiple pairs of inference requests and inference responses. However, it is believed that it is rare and difficult for the ED 110 to accumulate a sufficient number of pairs of inference requests and inference responses from a targeted DNN, such as the DNN 650, with a reasonable amount of diversity to successfully train a DNN that successfully mimics the targeted DNN. Because the RAN node 170 can communicate with a large number of different EDs 110 and computing systems 600 that host the DNN 650, it is believed that the number and diversity of pairs of inference requests and inference responses that can be accumulated at the RAN node 170 may be sufficient to successfully train a malicious DNN substantially similar to the DNN 650.

[0107] Aspects of the present application relate to the use of a reliability assurance method that addresses the concerns described above. However, the reliability assurance method of the present disclosure may result in the performance of some extra calculations for the inference response transmitted using the communication system 100. The ED 110, particularly the ED 110 that is an IoT device ("IOT-UE"), may have limited computational resources. Thus, in some embodiments of the present application, an edge computing system (e.g., a computing system including a large amount of computing resources (e.g., memory and processing resources) or a RAN node 170 equipped with a computing system including a large amount of computing resources connected to the RAN node 170) may perform the reliability assurance method of the present disclosure.

[0108] Consider an example in which the ED 110 communicates with a computing system 600 hosting a DNN 650 via the communication system 100. The ED 110 transmits a wireless transmission 601 containing an inference request for the DNN 650 to the RAN node 170. The inference request for the DNN 650 contains the input data X and information that allows the RAN node 170 to identify the DNN 650. The inference request may contain more than only the input data X and information that allows the DNN 650 to be identified. Of course, it is clear that the inference request contains one or more control headers and possibly other parts related to the DNN 650, such as the current accuracy of the input if dynamic accuracy is allowed, support for early termination if early termination is allowed, latency priority, etc. The RAN node 170 receives the wireless transmission 601, obtains the inference request from the wireless transmission 601, and transmits yet another transmission 602 containing the inference request to the computing system 600 hosting the DNN 650 via the core network 130 and / or the Internet 150. Further transmissions 602 containing the inference request may be transmitted, for example, across several backbone connections in the core network 130 and several connections in the Internet 150. Upon receiving the further transmissions 602, the inference request may be added to a service queue of the DNN 650 at the computing system 600 hosting the DNN 650. After the DNN 650 services the inference request (i.e., after the DNN 650 completes inference on the input data X included in the inference request and generates inference data Y), the DNN 650 generates and outputs an inference response to the inference request. The inference response includes the inference data Y. The DNN 650 provides the inference response to the computing system 600, which transmits the inference response to the ED 110. The inference response is sent to the ED 110 in two transmissions, the first being a backbone transmission 603 from the computing system 600 hosting the DNN 650 via the core network 130 and / or the Internet 150 to the RAN node 170, and the second being an over-the-air transmission 604 from the RAN node 170 to the ED 110.It should be clear that the inference response includes more than just the inference data Y generated by the DNN 650 based on the input data X. It should be clear that the inference response includes one or more control headers and possibly other portions that point to the ED 110 to which the inference response is to be sent.

[0109] Referring again to FIG. 6, malicious attacks may occur against the transmissions 601, 602 containing an inference request containing input data X, the transmissions 603, 604 containing an inference response containing inference data Y, and the DNN 650. A malicious attack against the transmissions 601, 602 containing an inference request containing input data X may delete, tamper with, poison, eavesdrop on, or even replace the input data X contained in the inference request. Similarly, a malicious attack against the transmissions 603, 604 containing an inference response containing inference data Y may delete, tamper with, poison, eavesdrop on, or even replace the inference data Y. Another malicious attack may be attempted by establishing an unauthorized DNN in place of an authorized DNN 650, as allowing access to unauthorized DNNs, or by performing phishing attempts against administrative roles associated with the computing system 600 hosting the DNN 650. A malicious attack on the DNN 650 may give the appearance that the DNN 650 generates and outputs an inference response based on the input data X, but in reality, the DNN 650 may generate and output random noise instead of appropriate inference data Y for the input data X. Alternatively, a malicious attack on the DNN 650 may result in the compromise of the DNN 650, causing the DNN 650 to multicast a single inference response to several EDs 110 that have sent inference requests to the DNN 650 that include separate input data X. One of the economic and competitive incentives for a provider of the DNN 650 (e.g., a provider of a computing system that hosts the DNN 650) to perform such a malicious attack relates to the fact that the DNN 650 may require a large amount of computational resources (e.g., memory and processing resources) for inference (i.e., to perform the operation of the DNN 650 to perform inference), and therefore the computing system 600 that hosts the DNN 650 may consume a large amount of energy when performing inference.All of the above possible malicious attacks will result in a malicious inference response.

[0110] Future communication networks have the potential to provide reliable services, i.e., DNNs that perform specific tasks as services, to a large number of IoT EDs (also called "IOT devices"). It can be easily understood that malicious attacks have the potential to aggravate security concerns, thereby causing serious social and economic damage.

[0111] It is expected that IOT EDs are low-power, low-cost devices that do not have enough hardware or power to constantly run complex guarantee algorithms against malicious attacks. Therefore, IOT EDs may be configured to not only filter out malicious inference responses, but also rely on the RAN node 170 as a last resort to protect the privacy of inference requests and corresponding inference responses. Advantageously, it is expected that future RAN nodes 170 will have suitable computational and storage resources to enable a typical RAN node 170 to act as an edge computing system. However, it is not expected that future RAN nodes 170 will have suitable computational resources to perform DNN computations or storage resources to store DNNs that may have billions or even trillions of parameters.

[0112] As described above, a computing system (e.g., computing system 600) that hosts a DNN (e.g., DNN 650) and provides access to the DNN (e.g., DNN 650) as a service may be concerned about theft of the DNN. If a third party is successful in eavesdropping on transmissions containing inference requests and transmissions containing inference responses containing inference data generated by the DNN (e.g., DNN 650) in response to the inference requests, a sufficient number of training data samples may be accumulated that would enable the third party to engage in theft of the DNN by recreating or training a new DNN similar to the DNN (e.g., DNN 650).

[0113] The trustworthiness of an ED (e.g., ED 110) accessing a DNN (e.g., DNN 650) hosted on a computing system (e.g., computing system 600) involves three entities: the ED 110, the RAN node 170, and the DNN on the computing system (e.g., DNN 650 hosted on computing system 600). The RAN node 170 may be equipped with sufficiently powerful computational resources, and may be referred to as an "edge computational node." It can be shown that the ED 110 is low-energy and low-cost, but benefits from reliability assurance against malicious attacks and privacy protection against eavesdropping and interception of communications (e.g., transmissions 601, 602) related to an inference job. It can be shown that a computing system (e.g., computing system 600) that hosts a DNN (e.g., DNN 650) and provides access to the DNN (e.g., DNN 650) as a service benefits from preventing theft of the DNN through interception of transmissions related to training the DNN.

[0114] An aspect of the present application relates to using code theory to provide a reliability assurance method for ensuring both that input data X included in an inference request sent from ED110 to a computing system hosting DNN650 can be trusted, and that inference data Y included in an inference response sent from the computing system hosting DNN650 to ED110 can be trusted.

[0115] FIG. 7A illustrates the ED 110, a component responsible in part for processing an inference request 700 using code logic to ensure that the input data X (704) included in the inference request 700 sent by the ED 110 to the computing system 600 can be trusted. An inference request to the DNN 650 is generated by an application running on the ED 110 requesting inference on the input data X (704). The inference request 700 to the DNN 650 is shown as including an inference request control header 702 and the input data X (704), and optionally other information 706. The input data X (704) may be an integer or a floating point number. As illustrated in FIG. 7A, the medium access control (MAC) layer 710 of the ED 110 includes a reshaper 712, a reliability specific encoder 714, and a source encoder 720. The physical (PHY) layer 720 of the ED 110 includes a source encoder 722 and a channel encoder 724.

[0116] The input data X (704) included in the inference request 700 to the DNN 650 is provided to a reshaper 712, which processes the input data X (704) to generate an input data vector X * In FIG. 7A, the input data vector X * (742) is shown as the output of reshaper 712. If the input data X (704) is integer or floating point, then the input data vector X * (742) is also expected to be an integer or floating point number.

[0117] In addition to the input data X (704) being integers or floating point, the input data X (704) may also have high dimensionality. As an example, the input data X (704) is image data corresponding to an image. In this case, the example of input data X (704) is two-dimensional, with each pixel of the image being represented by an integer value. Another example of input data X (704) is text-based (e.g., a one-hot encoding of the words of a sentence). In this case, the example of input data X (704) is a one-dimensional vector, with each word in the one-dimensional vector being a one-hot encoding.

[0118] In FIG. 7A, the encoded input vector 744 is shown as the output of the reliability specific encoder 714. * If (742) is an integer or floating point, then the encoded input data vector (744) is expected to be an integer or floating point as well.

[0119] The reliability-specific encoder 714 may add some coding redundancy to the encoded input vector 744, in which case the reliability-specific encoder 714 encodes the input data vector X * It can be shown that the process of (742) improves the robustness of the transmission.

[0120] After the reliability specific encoder 714 generates the encoded input vector 744, the MAC layer 710 of the ED 100 reconstructs an encoded inference request 708 that includes the control header 702, the encoded input vector (744), and other information 706. The encoded inference request 708 is passed to a source encoder 722, which processes the encoded inference request 708. The output of the source encoder 722 is a source block 746. The source encoder 722 may apply quantization and add compression to the inference request. Thus, the source block 746 is expected to be binary. The source encoder 722 may also split the inference request into multiple binary source blocks 746. That is, the output of the source encoder 722 may be multiple source blocks 746.

[0121] The source blocks 726 are then passed to a channel encoder 724 in the PHY layer 720. The channel encoder 720 processes each source block 746 to protect it from a hostile wireless channel or a hostile wired channel. The output of the channel encoder 724 is a (binary) codeword 748. It is the codeword 748 that is transmitted by the ED 110 as a wireless transmission 901 (see FIG. 9).

[0122] In some aspects of the disclosure, the reliability encoder 714 may be implemented at the MAC layer of the RAN node 170. In this aspect of the disclosure, the inference request 700 is provided to a source encoder 722, which generates a source block as described above. The source block 746 is provided to a channel encoder, which generates a codeword 748 as described above. The codeword 748 is received by the RAN node 170, which decodes the codeword 748 using a channel decoder (not shown) to obtain a source block 746, and which decodes the source block 746 to obtain an input data vector 742. The RAN node 170 may store the input data vector 742 in memory. The input data vector 742 is then received by a reliability encoder 714, implemented at the MAC layer of the RAN node 170, which generates an encoded input data vector 744. The RAN node 170 then regenerates the encoded inference request 708, which includes the control header 702, the encoded input data vector 744, and the other information 706, and transmits the encoded inference request 708 to the computing system 600 in a transmission 902 (see FIG. 9 ).

[0123] FIG. 8A illustrates components of the computing system 600 and the RAN node 170 that are responsible, in part, for processing an inference response 800 generated and output by the DNN 650. The illustrated inference response 800 includes a response control header 802 and inference data Y (804) generated by the DNN 650, as well as other information 806, as appropriate. The inference data Y (804) may be an integer or a floating point number. The reshaper 812 and the reliability specific encoding 814 illustrated in FIG. 8A are implemented in the computing system 600 hosting the DNN 650. The MAC layer 810 and the PHY layer 820 are implemented in the RAN node 170. The MAC layer 810 implemented in the RAN node 170 includes a source encoder 822. The PHY layer 820 implemented in the RAN node 170 includes a channel encoder 824.

[0124] In FIG. 8A, the inference data vector Y * (842) is shown. If the inference data Y (804) is an integer or floating point, then the inference data vector Y * (842) is also expected to be an integer or floating point number.

[0125] In FIG. 8A, the encoded inference data vector W (844) is shown as the output of the reliability-specific encoder 814. * If (842) is an integer or floating point, then it is expected that the encoded inference data vector W (844) will also be an integer or floating point.

[0126] As described below, the purpose of the reliability specific encoder 814 includes enabling the ED 110 or RAN node 170 to detect malicious inference responses and protecting user privacy.

[0127] The encoded inference data vector W (844) is processed by a source encoder 822 of the RAN node 170. After processing, the output of the source encoder 822 is a source block 846. The source encoder 822 may operate to apply quantization to add compression to the inference response, including the encoded output vector 844. Thus, it is expected that the source block 846 is binary. The source encoder 822 also operates to split the encoded output vector W (844) into multiple binary source blocks 846. That is, the output of the source encoder 822 may be multiple source blocks 846.

[0128] A channel encoder 824 in the PHY layer 820 of the RAN node processes each source block 846 to protect it from a hostile wireless channel or a hostile wired channel. The output of the channel encoder 824 is a (binary) codeword 848. It is this codeword 848 that is transmitted by the computing system 600 hosting the DNN 650 to the ED 110 as a transmission 904 (see FIG. 9 ), as described in more detail below.

[0129] 7B, components of the ED 110 that are partially responsible for processing the encoded inference response 800 are shown. As shown in FIG. 7B, the ED 110 receives a codeword 848 and decodes it using a channel decoder 750 in the PHY layer 710 to generate one or more source blocks 846. The channel decoder 750 performs the inverse operation of the channel encoder 824 to generate one or more source blocks 846. The channel decoder 750 outputs one or more source blocks 846, which are provided to a source decoder 752 in the MAC layer 710 of the ED 110. The source decoder 752 in the MAC layer 710 of the ED 110 performs the inverse operation of the source encoder 822 to generate an encoded inference data vector W(844), and outputs an encoded inference data vector W(844), which is provided to a reliability-specific decoder 754 in the MAC layer 710 of the ED 110. The reliability specific decoder 754 of the MAC layer 710 of the ED 110 performs the inverse operation of the reliability specific encoder 814 to obtain the inference data vector Y * (842) and generate the inference data vector Y * (842). The inferred data vector is then provided to reshaper 756 of MAC layer 710 of ED 110. Reshaper 756 of MAC layer 710 of ED 110 performs the inverse operation of reshaper 812 to output inferred data vector Y * (842) is reshaped into inference data Y (804). The inference data Y (804) is passed to the application of the ED 110 that generated the inference request 700.

[0130] 8B, components of a computing system 600 are shown as being, in part, responsible for processing an encoded inference request 708. As shown in FIG. 8B, an encoded inference request 708 is received by the computing system 600. The computing system 600 includes a reliability-specific decoder 850 that performs the inverse operation of the reliability-specific encoder 714. The reliability-specific decoder 850 receives the encoded input data vector Z (744) and generates an input data vector X based on the input data vector Z (744). * (744) and input data vector X * (744). Computing system 600 also includes a reshaper 852 that performs the inverse operation of reshaper 712. Reshaper 852 receives an input data vector X * (744) and input data vector X * (744), and outputs the input data X (704). The computing system then forms an inference request 700 using the control header 702, the encoded inference request 708, and other information from the input data X (704). The inference request 700 is then provided to the DNN 650 for inference.

[0131] In particular, as described above, a given malicious attack may be classified into one of two types: a Type I malicious attack and a Type II malicious attack. A trust assurance method may include both Type I assurance and Type II assurance. It may be understood that Type I assurance includes verifying that the inference data Y (804) originates from the input data X (704). It may be understood that Type II assurance includes verifying the integrity of the inference data Y (804).

[0132] Aspects of the present application relate to a reliability-specific encoder 714 of the ED 110 applying a linear block code to the input data vector 742, and a reliability-specific encoder 814 of the DNN 650 applying a linear block code to the inference data vector (842). The linear block code not only supports reliability assurance against Type I and Type II malicious attacks, but also protects the privacy of the input data X, the inference data Y, and the output by the DNN 650.

[0133] It can be shown that if sufficient redundancy is injected by the linear block code implemented by the reliability specific encoder 714 / 814 and a more desirable decoding algorithm is implemented, the coding gain makes it possible to tolerate a certain channel erasure rate over the transmission medium, such as the air / radio interface 630 or the core network 130, for each transmission.

[0134] A type I malicious attack has been defined above as relating to malicious operation of the DNN 650. The DNN 650 may be defined as a deep neural network that approximates a nonlinear function F(·), hereafter referred to as DNN 650(F(·)). A type I malicious attack has also been defined above as relating to tampering with one of the transmissions 601, 602 that contain an inference request that includes input data X (704). A typical malicious attack on the input data X (704) occurs on the transmissions 601, 602 (see FIG. 6) that contain an inference request 700. The transmissions 601, 602 that contain the inference request 700 include a wireless transmission 601 by the ED 110 to the RAN node 170 and a wired transmission through the core network 130 (including possibly a transmission through a portion of the Internet 150) by the RAN node 170 to the DNN 650, or in particular, to the computing system that hosts the DNN 650.

[0135] Wireless transmissions containing an inference request 700 with input data X (704) may be eavesdropped on, poisoned, tampered with, or substituted. A malicious attack against a DNN 650 may be said to generate a malicious DNN 650. For some economic reasons, a malicious DNN may not properly handle accepted inference requests by either returning random noise as an inference response or by generating a single valid inference response and returning that single valid inference response in response to multiple inference requests received from separate EDs 110.

[0136] To provide assurance against Type I malicious attacks, the ED 110 and RAN node 170 may operate to determine whether the inferred data Y (804) is correct inferred data Y (804), where Y=F(X) for a given input data X (704). The assurance may involve, for example, determining a score of the reliability of the inferred data Y (804) given the input data X (704).

[0137] A type II malicious attack has been defined above as relating to a malicious attack on the inference data Y (804). A typical malicious attack on the inference data Y (804) occurs on the inference response transmission path. As an example, the inference response transmission path may include a transmission 603 using the core network 130 (possibly including the Internet 150) from a computing system hosting the DNN 650 to a RAN node 170 associated with the ED 110 that sent the inference request to the DNN 650. As another example, the transmission path may include a wireless transmission 604 using radio waves 630 from the RAN node 170 to the ED 110. A hacker may eavesdrop, poison, or tamper with the transmission 603, 604 that contains the inference response 800 that includes the inference data Y (804). That is, a type II malicious attack may involve a hacker changing a portion of the inference data Y (804).

[0138] To provide assurance against Type II malicious attacks, the ED 110 and the RAN node 170 may operate to determine the reliability (i.e., integrity) of the inference data Y (804). The assurance may involve, for example, determining a score of the reliability (i.e., integrity) of the inference data Y (804). Note that determining a score of the integrity of the inference data Y (804) is independent of determining the inference data Y as a result of the input data X, because determining the inference data Y as a result of the input data X is the basis of the assurance against Type I malicious attacks, as explained above. Alternatively, the assurance against Type II malicious attacks may involve assurance against a trick made by a malicious DNN that multicasts one valid inference response to each of multiple other inference requests. In particular, it is expected that the reliability assurance against Type II malicious attacks will allow valid inference data Y (804) to obtain a good score even if the inference data Y (804) does not pass the reliability assurance against Type I malicious attacks.

[0139] In addition to preventing the two types of malicious attacks, data protection may also be involved in achieving two-way reliability. In an aspect of the present application, the ED 110 may be configured to expect that inference requests sent by the ED 110 and inference responses received by the ED 110 are coded against eavesdropping and eavesdropping. In an aspect of the present application, a computing system hosting a DNN may be configured to expect that all accepted inference requests and outgoing inference responses are also coded against eavesdropping and eavesdropping. From the perspective of the ED 110, such coding may be understood to relate to privacy protection, while from the perspective of the DNN 650, such coding may be understood to relate to protection of the DNN 650 and the training dataset used to train the DNN 650.

[0140] In practice, it is not conceivable that type I reliability guarantees, type II reliability guarantees, and protection of input data X (704) and inference data Y (804) are always required together. Some measures may be taken only to guarantee against type I malicious attacks, some measures may only guarantee against type I malicious attacks on inference requests, some measures may be taken only to guarantee against type II malicious attacks, and some measures may not consider data protection at all. In the following description, first each reliability protocol is described separately. Then, various ways in which the protocols work together to provide a two-way reliability protocol are described.

[0141] The reliability involves three entities: the ED 110, the RAN node 170, and the DNN 650. Between the ED 110 and the RAN node 170 is the air interface 630. Between the RAN node 170 and the computing system 600 hosting the DNN is the core network 130, which may include a connection through the Internet 150.

[0142] According to an aspect of the present application, the reliability assurance method may operate in one of three modes: RAN node mode, ED / RAN node mode, and ED / RAN node / cloud mode. In the RAN node mode, most of the assurance related calculations are performed in the RAN node 170. In the ED / RAN node mode, the assurance related calculations are performed by both the RAN node 170 and the ED 110, and transmissions between the RAN node 170 and the ED 110 are coded. In the ED / RAN node / cloud mode, the assurance related calculations are performed by the ED 110, the RAN node 170, and the DNN 650, and all transmissions in the ED / RAN node / cloud mode are coded. According to an aspect of the present application, the reliability assurance protocol is flexible enough to meet various reliability expectations and hardware requirements between the three entities.

[0143] Considering FIG. 9 and the method of ensuring against type I malicious attacks in RAN node mode, it can be considered that the ED 110m transmits an inference request for the DNN 650 to the RAN node 170 for transmission to the computing system 600 hosting the DNN 650. The DNN 650 is understood to be a trained DNN that approximates a nonlinear function F(·)(DNN 650(F(·). The DNN 650 is understood to perform its operation using the computing resources (e.g., infrastructure) of the computing system 600. The DNN 650 is understood to be provided as a service to the ED 110 by the computing system 600. Through the wireless transmission (uplink) 901 and the core network transmission 902, a message containing the inference request including the encoded input data vector 744 is transmitted to the computing system hosting the DNN 650. 600. The RAN node 170 receives a wireless transmission (uplink) 901 (e.g., codeword 748), decodes the received codeword 748 using a channel decoder (not shown) to obtain one or more source blocks 746, and then decodes the source blocks 746 using a source decoder (not shown) to obtain an inference request that includes the encoded input data vector 744. The RAN node 170 then transmits the inference request in a core network transmission 902 via the core network 130 and the Internet 150 to a computing system.

[0144] A computing system 600 receives a core network transmission 902 containing an encoded inference request 708 and processes the encoded inference request 708 to obtain an encoded input data vector (744). The computing system 600 then decodes the encoded input data vector Z (744) using a reliability-specific decoder 850, which performs the inverse operations of the reliability encoder 714 described above (e.g., linear decoding) to obtain the input data vector Z (744).

number

number

[0145] Input data X m After (704) is obtained by the computing system 600, the computing system 600 invokes the DNN 650 and inputs the input data 704 (i.e., the input data X m ) into the inference data Y m (804), where Y m =F(X m )) is the input data X m (704). The computing system 600 hosting the DNN 650 receives the control header 802 and the inference data vectors generated by the reshaper 812.

number

[0146] According to one aspect of the present application, the first assurance protocol is mis random noise or not. From classical information theory, a nonlinear function F(·) can be considered as a nonlinear channel whose input is a random variable X and whose output is another random variable Y. As a channel, the DNN 650, considered to be trained to approximate the nonlinear function F(·), may be configured to provide a predetermined mutual information between two random variables X and Y. The mutual information takes the form of a channel capacity and can be expressed as I(X;Y|F(·)). Recognizing the channel capacity allows an entity to detect that random noise has been returned in response to a nonrandom noise input. That is, it is expected that there is a predetermined mutual information between the valid inference data Y (804) and the input data X (704).

[0147] Aspects of the present application relate to determining a score of reliability of inferred data Y (804) received in an inference response generated by the DNN 650 based on a particular input data X (704). The score can be considered to be related to the range of mutual information found in the inferred data Y (804), which range of mutual information indicates whether the inferred data Y was generated randomly (low score) or properly generated by the DNN 650 in response to receiving the particular input data X (high score). An entity receiving the inferred data Y (804) may measure the mutual information and compare the measured mutual information to a predefined threshold. Upon determining that the measured mutual information exceeds the threshold, the entity may consider the inferred data Y (804) to be trustworthy.

[0148] However, the DNN 650 approximates the nonlinear function F(·) and reduces the dimension l of the input data X (704). X and the dimension l of the inference data Y (804) Y and are usually different from each other (i.e., X ≠l Y), the nonlinear function F(·) is irreversible. Given this irreversibility, it can be seen that it is useful to create a “reverse guarantee DNN”. A function G(·;θ) may be used to represent the inverse guarantee DNN. The inverse guarantee DNN may be configured to enable the determination of a vector X′, where X′=G(Y;θ)=G(F(X);θ), where θ represents a parameter of the inverse guarantee DNN. The inverse guarantee DNN (also referred to herein as inverse guarantee DNN G(·;θ)) is preferably trained using the same dataset used to train DNN650 (also referred to herein as DNN650(F(·))), but with a training target θ * is related to minimizing the squared error between X and X'. The training target θ * can be determined from

number

[0149] If the original training dataset is not available, the inverse guarantee DNN G(·;θ) can be trained using a training dataset artificially generated by a previously trained DNN F(·). It is expected that a computing system 600 that hosts the DNN 650 and provides access to the DNN 650 as a service will provide parameters θ of the inverse guarantee DNN G(·;θ) corresponding to the DNN 650 that approximates the nonlinear function F(·). Note that since G(·;θ) is designed to measure the mutual information between X and Y, it is expected that G(·;θ) is much smaller than F(·). It should be obvious that mutual information is a conceptual metric. In practice, Euclidean distance may be used as the metric.

[0150] X m represents the input data of an inference request to DNN650 generated by ED110m, and Y represents the input data X mConsider the inference data generated and output by the DNN 650 based on (704). Figure 12 illustrates example steps of a method for ensuring the reliability of an inference response from the perspective of a RAN node 170. The RAN node 170 receives (step 1202) a transmission 903 from the computing system 600 hosting the DNN 650, which contains an inference response including an inference data vector 842. The RAN node 170 reshapes the inference data vector Y using a reshaper 852, which performs the inverse operation of the reshaper 812. * (842) to input data X m (704) to obtain inference data Y (804). The inference data Y (804) is input data X that is not randomly generated. m To ensure that the inference data for (704) is correct 、 The RAN node 170 converts the obtained inference data Y (704) into a reverse-assurance DNN

number

number

number

number

number

number

number

[0151] Even if the inverse guarantee DNN G(·;θ) is much smaller than the DNN 650 (F(·)), the method may be shown to be successful in distinguishing between randomly generated data and the inference data Y (804) generated and output by the DNN 650. As can be expected, the guarantee of the inference data Y (804) may be shown to have false negatives, and the inference data vector Y * The inference data Y(804) obtained from (842) is the correct inference data Y m However, this is not guaranteed to be the case. Similarly, as can be expected, the inference data vector Y * The assurance of the inference data Y (804) obtained from (842) may be shown to have a false positive, and the obtained inference data Y (804) may be shown to be correct inference data Y m However, it is guaranteed to be so. 1 The false positive and false negative rates may be adjusted through appropriate adjustment of

[0152] In particular, it can be shown that operating to determine the architecture and parameters of the inverse guarantee DNN (G(·;θ)) does not disclose information about the DNN 650 (F(·)). This lack of disclosure can be considered important to the computing system 600 that hosts the DNN 650 and provides access to the DNN 650 as a service in that information about the DNN 650 (F(·)) can be considered the intellectual property of the entity that owns the computing system that hosts the DNN 650.

[0153] Notwithstanding this, it may be shown that using the inverse guarantee DNN (G(·;θ)) as described above does not work well if the DNN 650 is a so-called malicious DNN. Such a malicious DNN may multicast one valid inference response upon receiving multiple inference requests from multiple EDs 110. As an example, the malicious DNN may send an inference response to an ED 110m that contains inference data Y (704) that actually belongs to another ED 110n (Y=Y n And Y n =F(X n )) Incorrect inference data Y n Based on the fact that is not randomly generated, it is possible that invalid inference data may pass the assurance check using the inverse assurance DNN(G(·;θ)).

[0154] As a solution to this problem, a reliability-specific encoder 714 (see FIG. 7A) may be introduced. In particular, the reliability-specific encoder 714 may also be referred to as a “transformer”. The reliability-specific encoder 714 has a dimension l Z ×l X The name is "U user " may be used. The encoding matrix U user is the input data vector X user (742)l X ×1 vector) to the encoded input vector Z user(744), where Z user =U user X user (Z user is dimension l Z (L is a vector with a length of 1 x 1). Z ≧l X By establishing user From Z user For a given ED 110, an ED-specific linear block encoding matrix U user For the same ED 100, a guarantee DNN specific to the ED may be established.

number

number

number

[0155] In particular, the pair

number

number

number

number

number

[0156] User-specific pairs

number

[0157] The ED 110m sends a request to the computing system 600 to request the DNN 650 hosted on the computing system 600 to perform inference (step 1002, see FIG. 10). In response to receiving the request for the DNN 650 to perform inference, the RAN node 170 requests a user token from the DNN 650 (step 1102, see FIG. 11). The DNN 650 assigns a user token, e.g., token m, to the ED 110m, and the computing system 600 hosting the DNN 650 assigns a unique pair to the user.

number

number

number

number

number

[0158] The ED 110m transmits an inference request to the DNN 650 to the RAN node 170 (step 1004). The inference request is transmitted by wireless transmission 901. The inference request to the DNN 650 includes input data X m The input data vector generated by the reshaper 712 of ED110m based on (704)

number

number

number

number

number

[0159] When the computing system 600 receives a transmission 902 from the RAN node 170 (step 1202, see FIG. 12), it obtains the encoded inference request 708 for the DNN 650 from the transmission 902 and converts the encoded input vector Z m Decode (744) and here

number

number

number

number

number

number

number

number

number

number

[0160] Upon determining that the squared error exceeds a predefined threshold (step 1208), i.e.

number

[0161] Alternatively, the step of comparing the squared error to a threshold (step 1208) may be bypassed by the RAN node 170. Alternatively, the RAN node 170 may generate the inference data vector Y * The received inference response including (842) may be transmitted to the ED 110m (step 1210). As part of transmitting the inference response (step 1210), the squared error value

number

number

[0162] The trust assurance methods described with reference to Figures 8, 11 and 12 only involve the RAN node 170 and the computing system 600 hosting the DNN 650. It is noted that the transmission 901 (see Figure 9) between the ED 110m and the RAN node 170 may be vulnerable to malicious attacks if implemented as a wireless transmission. For example, if an inference request is sent as a wireless transmission from the ED 110m to the computing system 600 hosting the DNN 650 via the RAN node 170 using the air interface 930, the air interface 930 may be eavesdropped or intercepted. Furthermore, even if a Type I assurance protocol is performed by the RAN node 170, the input data X m (704 to the input data vector generated by the reshaper 712

number

[0163] As an example, an input data vector representing an image used for object detection by a DNN650 trained to perform object detection on images:

number

number

number

number

number

number

number

number

number

[0164] Figure 13 illustrates example method steps for obtaining an assured inference response from the perspective of the ED 110m. Figure 14 illustrates example method steps for handling an inference request from the perspective of the RAN node 170.

[0165] To protect against malicious attacks (eavesdropping and / or tampering) on ​​the inference requests contained in the wireless transmissions 601 using the air interface 630, aspects of the present application provide a method for the reliability specific encoder 714 of the ED 110 to encode the linear block encoding matrix U user We use a linear block encoding matrix such as

number

number

[0166] In preparation for operation, the ED 110m sends an inference request (step 1302) for the DNN 650 to the computing system 600 hosting the DNN 650 (see FIG. 13). In response to sending the inference request, the computing system 600 hosting the DNN 650 transmits the linear block encoding matrix U m In response to a request for inference of the DNN 650 from the ED 110m, the ED 110m receives the inverse guarantee DNN parameters from the computing system 600 that hosts the DNN 650 (step 1304).

number

[0167] ED110m is an inference request and the input data vector

number

number

number

[0168] When the RAN node 170 receives the coded inference request (step 1404), it generates the encoded input vector Z m Create a local copy of (744) and encode the input vector Z m (744) is decoded (step 1406) to obtain the input data vector

number

number

[0046]

number

[0169] As described above, the RAN node 170 sends 602 an inference request to a computing system hosting the DNN 650 F(·) (step 1408). The inference request includes an input data vector 742 (i.e.

number

[0170] When the RAN node 170 receives a transmission 903 (step 1202, see FIG. 12 ) from the computing system 600 hosting the DNN 650 containing an inference response including the encoded inference data vector W (844), it decodes the encoded inference data vector W (844) using a reliability decoder xxx to obtain an inference data vector Y * (842). The RAN node 170 obtains the inference data vector Y * (842) Reverse Guarantee DNN

number

number

number

number

number

[0171] Upon determining that the squared error exceeds a predefined threshold (step 1208), i.e.

number

[0172] l Z >l X , the generalized linear block encoding matrix U user is similar to the well-known linear block code known as "LDPC", an abbreviation for Low Dense Parity Check, which operates on binary vectors. In contrast, the linear block encoding matrix U user is a non-binary input data vector X m or process binary input data vector X m In LDPC, the linear block encoding matrix U user is Z -l X represents a check parity matrix with redundancy of . m Nevertheless, the LDPC code theory still holds.

[0173] lZ and l X (Code length X and the code rate l X / l Z ), there are many check matrices for LDPC. This means that the computing system hosting the DNN650 can encode the linear block encoding matrix U user This means that there is no shortage when selecting.

[0174] The LDPC check matrix can be generated by several rules. Z ×l X Instead of sending a matrix, we generate user tokens and measure their dimensions (l X and Z ) to the ED 110 and the RAN node 170, which allows the linear block encoding matrix U user It can be shown that this not only significantly reduces the amount of information transmitted for, but also improves security.

[0175] The encoded input vector Z user The parity check matrix may be designed such that is robust against hostile (e.g., randomly erased and noisy) wireless channels. user Even if some elements of are lost (i.e., attacked), the RAN node 170 can still obtain the encoded input vector Z user Decode (step 1406) the input data vector

number

[0176] The encoded input vector Z user When receiving , ...

number

[0177] In an optional aspect of the present application, as long as the ED 110m has sufficient computing power, the ED 110m may be configured to use the inverse guarantee DNN

number

number

number

number

number

[0178] Empirical considerations suggest that if DNN650(F(·)) has billions of neurons, the corresponding inverse guarantee DNN

number

number

number

number

[0179] In the Type I guarantee protocol described above, the input data vector

number

[0180] Thus, the RAN node 170 receives each input data vector

number

number

number

[0181] To thwart this type of attack, aspects of the present application provide the RAN node 170 with a linear block encoding matrix U m The linear block encoding matrix U m Without knowing , , RAN node 170 would be unable to perform step 1406 of the method of Figure 14. That is, RAN node 170 would not be able to determine, based on the received coded inference request, the input data vector X m (742) cannot be obtained. The input vector Z m , to the RAN node 170 (step 1308 in FIG. 13). The RAN node 170 simply relays the coded inference request to the DNN 650.

number

number

number

[0182] The operation of the ED 110m in this scheme is consistent with the operation of the ED 110m in the above scheme shown in Figure 13. In preparation for operation, the ED 110m sends a request to the computing system hosting the DNN 650 for the DNN 650 to perform inference (step 1302). In response to the initialization, the ED 110m receives the linear block encoding matrix U m (Step 1304).

[0183] ED110m is an inference request and the input data vector

number

number

[0184] Figure 15 shows the linear block encoding matrix U m 13 shows example steps of a method for handling an inference request from the perspective of a RAN node 170 for which access to the inference request is not provided. In response to an initialization of the inference service by the ED 110m (step 1302), the RAN node 170

number

[0185] As described above, the computing system 600 converts the encoded input data vector () into the input data vector 742 (i.e.

number

[0186] When the RAN node 170 receives a transmission 903 (step 1202, see FIG. 12 ) from the computing system 600 hosting the DNN 650, which contains an inference response including the inference data vector 842 (i.e., Y), it transmits the inference data vector 842 (Y) to the inverse guarantee DNN

number

number

number

number

number

[0187] Upon determining that the squared error exceeds a predefined threshold (step 1208), i.e.

number

[0188] From the above, it can be shown that the assurance protocol described operates to verify the returned inference response against type I malicious attacks and to protect the transmission of the inference response vector over both the wireless connection and the core network (Internet) connection. However, no assurance method is established for the inference response vector. This is addressed as follows.

[0189] A theoretical hacker may attack the inference response contained in the transmission 903 (see FIG. 9) from the computing system hosting the DNN 650 to the RAN node 170 in the following ways:

[0190] In one aspect, a theoretical hacker may intercept an inference response vector and replace the intercepted inference response vector with a forged inference response vector. This aspect can be classified as a Type I malicious attack. Therefore, the Type I assurance protocol described above can be used to check for forged output data vectors from the perspective of mutual information between the input data vectors and the output data vectors.

[0191] In another embodiment, a theoretical hacker may derive the inference data vector Y such that a small (but key) portion of the inference data vector 842 is changed. * (842). The tampered inference data vector may pass the Type I assurance test at the RAN node 170. Thus, the inference data vector Y *A Type II assurance method may be implemented to detect the integrity of (842).

[0192] Besides information theory, DNNs can be interpreted by topology theory, which states that there are some dominant topological patterns in the output of each layer of a DNN, including the output of the last layer. These dominant, hidden and persistent topological patterns are compared with the fingerprints to produce an inference data vector Y * It may also be used when considering the completeness of (842).

[0193] Aspects of the present application relate to a Type II assurance method based on topology patterns. The proposed Type II assurance method is intended to prevent Type II malicious attacks, i.e., the method is intended to detect if a given output data vector has been tampered with. Similar to Type I assurance, according to aspects of the present application, the RAN node 170 obtains an inference data vector Y * The system is arranged to provide a type II guarantee for (842). The computing system 600 hosting the DNN 650 recognizes persistent topology patterns in the DNN 650, and the entity that owns the computing system 600 hosting the DNN 650 (also referred to as the “provider” of the computing system) provides a linear encoding matrix V(l W ×l Y ,l W >l Y ) can be designed. The linear encoding matrix V is used to encode the inference data vector Y * (842) may be encoded to provide an encoded inference data vector W (844), where W=V Y * A computing system 600 hosting a DNN 650 provides the RAN node 170 with a linear encoding matrix V along with some Type II guarantee rules.

[0194] Rules and procedures are WThe method further includes selecting and grouping certain dimensions of the encoded inference data vector W (844), which is a 1× vector, into several groups. For example, the first group may be the selected elements [w 1 ,w 3 ,w 7 ], and the second group contains the selected element [w 3 ,w 5 ], and the third group contains the selected element [w 2 ,w 9 ] may also be included.

[0195] The rules and procedures may also include performing intra-group consistency checks to determine whether there are strong consistency correlations between elements within a group. For example, 1 If the value of w is large, the w 1 and w 7 If all groups pass the intra-group consistency check, the RAN node 170 will perform the inter-group consistency check.

[0196] The rules and procedures also include performing a between-group consistency check to determine whether the distribution of the means of elements in different groups is consistent with a known persistent pattern. For example, given a known persistent pattern, if the mean value of elements in a second group is large, then the mean value of elements in a third group is expected to be small. Any violation of the known persistent pattern will cause the between-group consistency check to fail.

[0197] Inference data vector Y * If (842) passes both the within-group and between-group consistency checks, then the inferred data vector Y *The RAN node 170 may determine that (842) passes Type II assurance. Note that passing Type II assurance is independent of passing Type I assurance. For example, the valid inference data vectors (842) determined by the computing system 600 hosting the DNN 650 based on the inference request received from the ED 110n may be

number

number

number

[0198] In some aspects of the present application, the RAN node 170 in combination with the computing system 600 hosting the (ED 110m and, if necessary, the DNN 650 may only implement Type I guarantees as described above. In other aspects of the present application, the RAN node 170 may only implement Type II guarantees as described above. In preferred aspects of the present application, the RAN node 170 may implement both Type I and Type II guarantees.

[0199] The RAN node 170 may perform the two types of guarantees in parallel or sequentially. From a latency perspective, the parallel approach is preferred. From an energy saving perspective, the sequential approach is preferred. In a preferred embodiment of the present application, the RAN node 170 performs Type II guarantees before performing Type I guarantees. For Type I guarantees, the inference data vector 842 (i.e., Y * ) is inversely guaranteed by DNN

number

[0200] The set of Type II guarantee rules is the encoding matrix V c The first rule, which relates to W = V c The second rule above is for grouping table G c The grouping table indicates the dimension of the encoded inference data vector W (844) that is selected, and indicates the group into which the selected dimension is grouped.

[0201] The third rule above concerns the within-group reference distribution, correlation method, and threshold. If the reference distribution of the i-th group is R i If the received distribution of the i-th group is r i The received distribution r i and the reference distribution R i The similarity between i =corr i (r i ,R i ) as a measure of the intragroup correlation function corr i (r i ,R i ) may be used. i (r i ,R i ) has various options such as dot product or cosine distance. The threshold for the i-th group is T i It may be written as follows.

[0202] The fourth rule above concerns the between-group reference distribution, correlation method and threshold. The reference distribution of the means of all groups is R g If there are L groups, then the mean,reference distribution may be determined as a vector of length L as follows: R g =[avg(R 1 ),avg(R 2 ),…,avg(R L )]

[0203] The received distribution of the means of all groups is r g If there are L groups, then the average, received distribution may be determined as a vector of length L as follows: r g =[avg(r 1 ),avg(r 2 ),…,avg(r L )]

[0204] Received distribution r g and the reference distribution R g The similarity between g =corr g (r g ,R g ) as a measure of the intergroup correlation function corr g (r g ,R g ) may be used. g (r g ,R g ) has various options such as dot product or cosine distance. g It may be written as follows.

[0205] Inference data vector Y * A set of Type II assurance rules from the perspective of the class of (842) may be provided to the RAN node 170. In practice, the computing system hosting the DNN 650 will inform the RAN node 170 of some Type II assurance rules. *In conjunction with the provisioning of (842), an indicator of the inference type may be provided to the RAN node 170. The RAN node 170 may select a set of Type II assurance rules based on the indicator, and then use the selected set of Type II assurance rules to generate the inference data vector Y * (842) may be guaranteed.

[0206] An overview of the assurance is shown as an example of method steps in FIG. 16. The assurance starts with the RAN node 170 receiving (step 1602) a number of sets of Type-II assurance rules from the computing system 600 hosting the DNN 650. Of course, each set of Type-II assurance rules may be associated with a result class c. Alternatively, the computing system hosting 650 may provide only one set of Type-II assurance rules. The inference data vector Y at the RAN node 170 is * Receipt of (842) (step 1604) is associated with receipt of an indicator of outcome class c from the computing system hosting the DNN 650. The RAN node 170 may then perform Type I guarantees (step 1606) in one of many ways as described above.

[0207] Subsequently, the RAN node 170 may perform Type II assurance (step 1608) according to example method steps for performing a Type II assurance protocol shown in FIG.

[0208] Based on the class c indicator, the RAN node 170 reads from the RAN node memory 258 (see FIG. 3 ) the inference data vector Y * In particular, if the RAN node 170 receives only a single set of Type II assurance rules (step 1602), the selection (step 1702) may be skipped. Thereafter, following the above, the RAN node 170 may select an encoding matrix Vc Using the inference data vector Y * (842) may be encoded (step 1704) into an encoded output vector W (844), where W=V c Then, the RAN node 170 generates a grouping table G obtained from the selected set of type II guarantee rules. c , may be used to form groups from the encoded output vector W (844) (step 1706). The RAN node 170 may then perform an intra-group consistency check (FIG. 18) (step 1708) and may also perform an inter-group consistency check (FIG. 19) (step 1712).

[0209] Example method steps for performing an intra-group consistency check (step 1708) are illustrated in Figure 18. The intra-group consistency check involves determining whether the values ​​of the intra-group correlation functions determined for each group are above the corresponding intra-group thresholds for all groups.

[0210] In FIG. 18, the RAN node 170 selects a group i (step 1802) and calculates the value of the intra-group correlation function γ i =corr i (r i ,R i ) (step 1804). The RAN node 170 determines the value of the intra-group correlation function γ i and an appropriate threshold T i (step 1806). When the RAN node 170 determines (step 1806) that the value of the intra-group correlation function is greater than or equal to the threshold, it determines whether all of the groups have been selected (step 1808). When it determines (step 1808) that all of the groups have not been selected, the RAN node 170 selects (step 1802) another group and the process of determining (step 1804) and comparing (step 1806) is repeated for the another group. When the value of the intra-group correlation function is determined (step 1806) to be less than the threshold, the inference data vector Y *The RAN node 170 may indicate that (842) failed the intra-group consistency check and therefore failed Type II guarantees.

[0211] Upon determining that for all groups the value of the intragroup correlation function exceeds the corresponding threshold (step 1806), the inference data vector Y * The RAN node 170 may indicate that (842) has passed the intra-group consistency check.

[0212] Returning to Figure 17, the inference data vector Y * When (842) determines (step 1710) that the intra-group consistency check has failed, the inference data vector Y * The RAN node 170 may indicate (step 1718) that the inference data vector Y * Upon determining (842) that the intra-group consistency check has passed (step 1710), the RAN node 170 may then perform an inter-group consistency check (step 1712).

[0213] Example steps of a method for performing an inter-group consistency check (step 1712) are shown in Figure 19. The inter-group consistency check involves determining whether the value of the inter-group correlation function is above a threshold value.

[0214] In FIG. 19, the RAN node 170 calculates the inter-group correlation function value γ g =corr g (r g ,R g ) (step 1904). Then, the RAN node 170 determines the value of the inter-group correlation function γ g and the between-group threshold T g (Step 1906). The value of the intergroup correlation function γ g is the between-group threshold T g Upon determining (step 1906) that the inference data vector Y *The RAN node 170 may indicate that (842) has failed the inter-group consistency check and therefore failed the Type II guarantee. g is the inter-group threshold T g When determining (step 1906) that the inference data vector Y * The RAN node 170 may indicate that (842) passed the inter-group consistency check.

[0215] Returning to Figure 17, the inference data vector Y * When (842) determines (step 1714) that the intergroup consistency check has failed, the inference data vector Y * The RAN node 170 may indicate (step 1718) that the inference data vector Y * Upon determining (step 1714) that (842) passes the intergroup consistency check, the inference data vector Y * The RAN node 170 may indicate that (842) has passed both consistency checks (step 1716).

[0216] Returning to Figure 16, the inference data vector Y * (842) passes both the intragroup and intergroup consistency checks (step 1610), and the inference data vector Y * Upon determining (step 1612) that (842) passes Type I guarantee, the inference data vector Y * The inference data vector Y along with indications that (842) passed two types of guarantees. * The RAN node 170 may transmit the inference data vector Y (842) to the ED 110m (step 1614). * When (842) determines (step 1610) that the consistency check has failed, the inference data vector Y * The RAN node 170 may transmit (step 1616) an indication that the inference data vector Y (842) could not be guaranteed.* Upon determining (step 1612) that (842) fails Type I guarantee, the inference data vector Y * The RAN node 170 may send an indication that (842) could not be guaranteed (step 1616).

[0217] In an aspect of the present application, the RAN node 170 calculates the L distinct intra-group correlation values ​​(γ 1 ,γ 2 ,…,γ L ) is determined (step 1804), and all group correlation values ​​γ g Alternatively, the RAN node 170 may determine (step 1904) the correlation values ​​as the inference data vector Y, leaving it to the ED 110m to compare the correlation values ​​with a corresponding threshold. * (842) may be transmitted to the ED 110m (step 1614).

[0218] In particular, in Figure 17, the intra-group consistency check (step 1708) is shown to occur before the inter-group consistency check (step 1712). It should be clear to one skilled in the art that the order of these two checks is not important to the outcome. Of course, it can be shown that performing these two checks in parallel is a superior implementation. It can be appreciated that such a parallel approach is suitable for implementation in a computing system that includes one or more processors with multiple cores, such as a GPU.

[0219] The inference data vector Y * It has been explained above that a theoretical hacker may attack the inference data vector Y (842). Similarly, the inference data vector Y *It is assumed that a theoretical hacker may attack (842). Of course, the inference data vector Y received from the computing system 600 hosting the DNN 650 * Even after the Type II guarantee of (842) is verified by the RAN node 170, the inference data vector Y contained in the transmission 904 (see FIG. 9 ) transmitted from the RAN node 170 to the ED 110m using the air interface 630 is * (842) could be tampered with or otherwise modified by a theoretical hacker.

[0220] In operation, as part of the Type II assurance method described in relation to FIG. 17, the RAN node 170 selects (step 1702) an encoding matrix V c , the inference data vector Y received in step 1604 (FIG. 16) is * (842) is encoded into the inference data vector W(844), where W=V c It is explained that, Y may be encoded into (step 1704).

[0221] In accordance with an aspect of the present application, upon determining (steps 1610, 1612) that the received inference data vector 842 is warranted (both Type I and Type II), an encoded inference vector W (844), where:

number

number

[0222] In Figure 16, the inference data vector Y * The inference data vector Y along with indications that (842) passed two types of guarantees. * The RAN node 170 transmits (842) to the ED 110m (step 1614).

number

[0223] Figure 20 shows the guaranteed encoded inference vector.

number

[0224] 20 begins with the ED 110m receiving (step 2002) a plurality of sets of Type II guarantee rules from the DNN 650. The ED 110m then receives from the RAN node 170 the guaranteed encoded output vector W m and an indication of result class c (step 2004). The ED 110m may select a set of Type II guarantee rules based on the result class c (step 2006). As described above, there may be only one set, in which case the selecting step is removed. The ED 110m may then receive the decoded guaranteed inference data vector

number

number

number

number

number

[0225] In some aspects of the present application, if the ED 110m has sufficient computing capability, when the ED 110m receives the encoded inference vector (844) and the result class c (step 2004) and decodes the inference data vector (842), the ED 110m can perform example steps of the Type II assurance method shown in Figures 17, 18, and 19.

[0226] The output data vector 842 (Y) is encoded into an output vector 844, W=V c Unlike the RAN node 170 performing the encoding on the output data vector 842, Y (step 1704), the present embodiment performs the encoding on the output data vector 842, Y mThe encoded output vector is 844, W m =V c Y m、 Then, the DNN 650 performs the encoding of the encoded output vector 844 (W m ) to the RAN node 170.

[0227] The inference vector W encoded by the RAN node 170 m Upon receiving (844), the encoded inference vector W m (844) may be decoded to obtain an inference data vector (844), where:

number

[0228] Upon determining that the inference data vector (842) is warranted, the RAN node 170 may then determine whether the inference data vector Y m Alternatively, the RAN node 170 may transmit the encoded inference data vector W (842) to the ED 110m as received by the RAN node 170 from the DNN 650. m (844) may be sent.

[0229] Encoding matrix V c Since is a linear block encoding matrix, the decoding matrix

number

number

[0230] The RAN node 170 receives the encoding matrix V c When equipped with the inference data vector Y m The administrator of the computing system 600 hosting the DNN 650 may be concerned about whether the RAN node 170 has the ability to obtain (842). This arrangement allows the RAN node 170 to perform the Type I assurance method described herein above. In theory, the encoding matrix V c (l W ×l Y ) is linear expansion (l W ≧l Y ), it can be expected that no information about the inference data Y is lost and / or distorted. Therefore, in Type I assurance, the inference data vector 842 (i.e., the inference data vector Y) is fed by the RAN node 170 to the inverse assurance DNN

number

number

number

number

number

number

[0231] FIG. 21 illustrates example method steps associated with an encoded input vector 744 and an encoded output vector 844.

[0232] The ED 110m sends a request to the computing system 600 hosting the DNN 650 to request the DNN 650 to perform inference (step 2102, see FIG. 21). In the request, the ED 110m may specify a single result class c or multiple result classes. In response to the request, the computing system 600 hosting the DNN 650 sends an encoding matrix U m and the class-specific encoding matrix V c The ED 110m receives the request (step 2104). The computing system 600 that hosts the DNN 650 generates an encoding matrix V c may be provided.

[0233] In response to receiving a request to perform inference, a class-specific inverse guarantee DNN

number

[0234] The computing system 600 hosting the DNN 650 may also provide a set of Type II assurance rules to the RAN node 170. The Type II assurance rules are grouped in a table G c , the within-group reference distribution R i The number of groups is L, and the correlation function corr i (·,R i ), L intra-group thresholds T i , Between-group reference distribution R g , the intergroup correlation function corr g (·,R g ) and the between-group threshold T g Note that this includes

[0235] In operation, the reliability specific encoder 714 of the ED110m receives the input data vector

number

number

[0236] The RAN node 170 may simply relay the inference request to the computing system 600 that hosts the DNN 650. m (744) may be saved in the memory 258 of the RAN node 170. A reliability decoder (not shown) of the computing system 600 (i.e., the DNN 650) may then

number

number

[0237] DNN650 takes input vector X m (704) to generate inference data 804. The DNN 650 then generates an inference response including the inference data 804 and outputs the inference data. The computing system 600 then reshapes the inference data vector Y m (842) is the encoded inference data vector W m (844), where W m =V c Y m Then, the encoded output vector 844 (i.e., W m The computing system 600 hosting the DNN 650 may send a transmission 904 to the RAN node 170 containing an inference response that includes, among other things, the inference response.

[0238] The encoded inference vector 844 (i.e., W m ) m (744) has been previously received and memorized, and a class-specific reverser-guaranteed DNN

number

[0239] The encoded inference data vector W m Upon determining that (844) is warranted, the encoded inference data vector 844 (i.e., the inference data vector W m The RAN node 170 may send an inference response including the received inference response ACK to the ED 110m.

[0240] ED110m encoded guarantee vector 844(W m ) (step 2110), the guaranteed inference data vector 842 (Y m ) (step 2112), where

number

[0241] Advantageously, it can be seen that this latter method completely protects inference requests to the DNN 650. First, all transmissions 901, 902, 903, 904 (FIG. 9) are coded. Second, the RAN node 170 is configured to guarantee that an encoded inference data vector 844 is included in an inference response received from the computing system 600 hosting the DNN 650. Third, there is no way for a theoretical hacker to accumulate input data vectors 742 (or input data 704) and corresponding inference data vectors 842 (or inference data 804) that could be used to train a malicious or new DNN.

[0242] A theoretical hacker could hack into the RAN node 170 and receive an encoded input data vector 744 (i.e., Z m) and the encoded output inference data vector 844 (i.e., W m ) can be stored. A theoretical hacker can store the stored encoded input data vector 744 (i.e., Z m ) and the encoded inference data vector 844 (i.e., W m ) to train a fake DNN. Meanwhile, from the above, we can see that the encoded input data vector 744 (i.e., Z m and the encoded inference data vector 844 (i.e., W m ) is the encoding matrix U m and V c It may be noted that the DNN 650 periodically generates the encoding matrix U m and V c It is obvious that such a change will immediately invalidate the fake DNN.

[0243] It is to be understood that one or more steps of the method of the embodiments provided herein may be performed by a corresponding portion or module. For example, data may be transmitted by a transmitting portion or a transmitting module. Data may be received by a receiving portion or a receiving module. Data may be processed by a processing portion or a processing module. Each portion / module may be hardware, software, or a combination thereof. For example, one or more of the portions / modules may be an integrated circuit, such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). It is to be understood that when a module is software, the whole or part of the module may be retrieved by a processor as a single or multiple instances as required, individually or together, for processing as needed, and the module itself may include instructions for further deployment and instantiation.

[0244] Although combinations of features are shown in the illustrated embodiments, not all of these need to be combined to realize the benefits of various embodiments of the present disclosure. In other words, a system or method designed in accordance with an embodiment of the present disclosure does not necessarily include all of the features shown in any one of the figures or all of the parts shown diagrammatically in the figures. Furthermore, specific features of one embodiment may be combined with specific features of other embodiments.

[0245] While the present disclosure has been described with reference to the illustrated embodiments, this description is not intended to be construed in a limiting sense. Various modifications and combinations of the illustrated embodiments, as well as other embodiments of the present disclosure, will be apparent to those skilled in the art upon reference to the description. Accordingly, any such modifications or embodiments are intended to be included in the appended claims. [Explanation of symbols]

[0246] 100ED 100 Communication Systems 110ED 120 RAN 130 Core Network 140 Public Switched Telephone Network (PSTN) 160 Network 170 RAN nodes 172 RAN nodes 174 Sensing Agent 176 SMF 190 Radio Interface 201 Transmitter 203 Receiver 204 Antenna 208 Memory 210 Processor 252 Transmitter 253 Scheduler 254 Receiver 256 Antennas 258 memory 260 processor 272 Transmitter 274 Receiver 276 processors 278 Memory 280 Antenna 282 Transmitter 283 Scheduler 284 Receiver 286 Antenna 288 Memory 290 Processor 600 Computing Systems 601 Sent 602 Sent 603 Send 604 Radio Transmission 630 Radio Interface 650 DNN 700 Inference Requests 702 Control Header 704 Input Data 706 Information 708 Inference Requests 710 MAC layer 712 Reshaper 714 Reliable Intrinsic Encoder 720 PHY layer 722 Source Encoder 724 Channel Encoder 726 Source Blocks 742 input data vector 746 Source Blocks 748 Codeword 750 Channel Decoder 752 Source Decoder 754 Reliable Specific Decoder 756 Reshaper 800 Inference Response 802 Control Header 804 Inference Data 806 Information 808 Inference Response 810 MAC layer 812 Reshaper 814 Reliability Intrinsic Encoder 820 PHY layer 822 Source Encoder 824 Channel Encoder 842 Inference Data Vector 844 inference data vector 846 Source Blocks 848 Codeword 850 Reliable Inherent Decoder 852 Reshaper 901 Sent 902 Sent 903 Send 904 Sent 905 Radio Transmission 930 Radio Interface

Claims

1. 1. A method performed on an electronic device, the method comprising: generating an inference request for a deep neural network (DNN), the inference request comprising input data for the DNN; encoding an input data vector obtained based on the input data using a linear block encoder to generate an encoded input vector; sending the inference request to a computing system hosting the DNN, the inference request including the encoded input vector; receiving an inference response from the computing system hosting the DNN, the inference response comprising a guaranteed inference data vector generated by the DNN based on the input data obtained from the input data vector; The method includes:

2. The method of claim 0, further comprising the step of transmitting a request to request to initialize a coded transmission for inference.

3. The method of claim 0, further comprising receiving the linear block encoding matrix in response to the sending of the request to initialize coded inferences.

4. The method of claim 0 , further comprising receiving an inferred data vector decoding matrix in response to the sending of the request to initialize coded inference.

5. 10. The method of claim 0, wherein the inference response includes an encoded output data vector, the method further comprising: decoding the encoded output data vector with an output data vector decoding matrix, thereby obtaining a decoded output data vector.

6. The method of claim 0 , wherein the inference response includes an output data vector, the method further comprising receiving and associating a confidence score with the output data vector.

7. The method of claim 0 , wherein the reliability score comprises a squared difference between an estimated encoded input data vector and an actual encoded input vector.

8. 1. A method performed by a Radio Access Network (RAN) node, the method comprising: receiving an inference request for the DNN from an electronic device, the inference request including an input data vector; sending the inference request to a computing system hosting the DNN; encoding the input data vector using a linear block encoder to obtain an actual encoded input vector; receiving an inference response from the computing system, the inference response including an output data vector generated by the DNN based on the input data vector; obtaining an estimated encoded input vector based on the output data vector; obtaining a confidence score representative of a comparison between the estimated encoded input vector and the actual encoded input vector; transmitting the output data vector to the electronic device in response to determining that the confidence score exceeds a threshold. A method comprising:

9. The method of claim 0, wherein the reliability score comprises a squared difference between the estimated encoded input vector and the actual encoded input vector.

10. 10. The method of claim 0, wherein the step of sending the inference request comprises sending the inference request to an inference neural network, the inference neural network configured to approximate a nonlinear function.

11. 10. The method of claim 0, wherein obtaining the estimated encoded input vector comprises providing the output data vector to a guarantee neural network, the guarantee neural network being trained to output the estimated encoded input vector in response to receiving the output data vector received as an output of the nonlinear function.

12. The method of claim 0, further comprising receiving the linear block encoding matrix from a provider of the inference neural network.

13. 10. The method of claim 0, wherein the output data vector comprises an encoded output data vector, and wherein obtaining the estimated encoded input vector comprises using the encoded output vector.

14. The method of claim 0, further comprising receiving a plurality of guarantee rules relating to grouping particular dimensions of the encoded output vector.

15. 10. The method of claim 0, wherein the guarantee rules indicate a dimension of the encoded output vector to be selected and include a grouping table indicating one of a plurality of groups into which the selected dimension is grouped.

16. The method of claim 0 , wherein the assurance rule relates to performing an intra-group consistency check.

17. The method of claim 0, wherein the step of performing the intra-group consistency check comprises determining a correlation between a distribution of values ​​of elements of a group and an element value distribution reference.

18. The method of claim 0, further comprising transmitting an indication of the correlation along with the output data vector.

19. The method of claim 0 , wherein the assurance rules relate to performing inter-group consistency checks.

20. The method of claim 0, wherein the step of performing the inter-group consistency check comprises determining a correlation between a group mean of an element's distribution and a reference element mean distribution.

21. The method of claim 0, further comprising transmitting an indication of the correlation along with the output data vector.

Images