Methods for obfuscating device functionality

Abstract

A computer-implemented method executed on a device includes receiving input data describing one or more ML model characteristics of a machine learning (ML) model to be scheduled for execution by the device. The method further includes determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with the device executing the model instructions. The method further includes executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

Description

[Technical Field]

[0001] REFERENCE TO RELATED APPLICATIONS This application claims priority to U.S. Provisional Application No. 63 / 299,259, filed January 13, 2022, the contents of which are incorporated herein by reference. [Background technology]

[0002] This application relates generally to devices including computer processors. In particular, this application describes a method for obfuscating the functionality of a device and a device implementing the method.

[0003] 2. Description of Related Art Many devices implement proprietary processes that provide the manufacturers of these devices with a competitive advantage. Some of these processes also improve the security of the device. For example, a particular device may include a face detection feature that facilitates convenient unlocking of the device by the device owner. Significant research and development time may have been spent to implement that feature.

[0004] In some cases, a competing manufacturer or malicious user can gain insight into the inner workings of a feature's implementation by observing how a device behaves when the feature is utilized. For example, the power consumed by inference hardware implementing a particular feature can, in some instances, provide insight into the number of layers the inference model utilizes, the weights associated with the nodes in the layers, the node activation functions, etc. This insight may enable a competitor to quickly develop competing versions of the feature or may enable a malicious user to determine security vulnerabilities in the feature. Summary of the Invention

[0005] In a first aspect, a computer-implemented method executed on a device includes receiving input data describing one or more ML model characteristics of a machine learning (ML) model scheduled for execution by the device. The method further includes determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the device. The method further includes executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0006] In a second aspect, a computing device includes a memory and a processor, the memory storing instruction code. The processor is in communication with the memory. The instruction code is executable by the processor and causes the computing system to perform operations including receiving input data describing one or more ML model characteristics of a machine learning (ML) model scheduled for execution by the computing device. The operations further include determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the computing device. The operations further include executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0007] In a third aspect, a non-transitory computer-readable medium has instruction code stored thereon. The instruction code, when executed by a processor of a computing system, causes the computing system to perform operations including receiving input data describing one or more ML model characteristics of a machine learning (ML) model scheduled for execution by the computing system. The operations further include determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the computing system. The operations further include executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0008] In a fourth aspect, a device includes means for receiving input data describing one or more ML model characteristics of a machine learning (ML) model scheduled for execution by the device. The device further includes means for determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with execution of model instructions associated with the ML model. Execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with execution of the model instructions by the device. The device further includes means for executing the one or more determined obfuscation instructions concurrently or sequentially with execution of the model instructions.

[0009] The above summary is illustrative only and is not intended to be in any way limiting. In addition to the exemplary aspects, embodiments, and features described above, further aspects, embodiments, and features will become apparent by reference to the figures and the following detailed description, and accompanying drawings. [Brief explanation of the drawings]

[0010] [Figure 1]1 illustrates an environment with a device and a sensing system in accordance with an illustrative embodiment. [Figure 2] 1 illustrates a block diagram of a device according to an exemplary embodiment. [Figure 3] 1 illustrates machine learning (ML) logic, according to an example embodiment. [Figure 4] 1 illustrates operations that facilitate scheduling an obfuscated model with ML logic, in accordance with an example embodiment. [Figure 5A] 1 illustrates a measurable parameter profile associated with the execution of a model instruction, according to an example embodiment. [Figure 5B] 1 illustrates a measurable parameter profile associated with an obfuscated instruction, according to an example embodiment. [Figure 5C] 5B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 5A and the obfuscated instructions of FIG. 5B, according to an example embodiment. [Figure 6A] 1 illustrates a measurable parameter profile associated with the execution of a model instruction, according to an example embodiment. [Figure 6B] 1 illustrates a measurable parameter profile associated with an obfuscated instruction, according to an example embodiment. [Figure 6C] 6B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 6A and the obfuscated instructions of FIG. 6B, according to an example embodiment. [Figure 7A] 1 illustrates a measurable parameter profile associated with the execution of a model instruction, according to an example embodiment. [Figure 7B] 1 illustrates a measurable parameter profile associated with the execution of obfuscated instructions, according to an example embodiment. [Figure 7C] 7B illustrates a measurable parameter profile of a device associated with concurrent execution of the model instructions of FIG. 7A and the obfuscated instructions of FIG. 7B, according to an example embodiment. [Figure 8] 1 illustrates operations performed by a device according to an example embodiment. [Figure 9]1 illustrates a computer system according to an exemplary embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Various example systems, devices, and / or methods are described herein. Any embodiment, implementation, and / or feature described herein as an example should not necessarily be construed as preferred or advantageous over any other embodiment, implementation, and / or feature, unless so expressly stated. Accordingly, other embodiments, implementations, and / or features may be utilized, and other changes may be made, without departing from the scope of the subject matter presented herein.

[0012] Accordingly, the examples set forth herein are not intended to be limiting, as it will be readily understood that the aspects of the present disclosure, as generally described and illustrated in the Figures herein, can be arranged, substituted, combined, separated, and designed in a wide variety of different configurations.

[0013] Furthermore, unless the context suggests otherwise, the features illustrated in each of the figures may be used in combination with one another. Thus, the figures should generally be viewed as component aspects of one or more overall embodiments, with the understanding that not all of the illustrated features are required for each embodiment.

[0014] Furthermore, any recitation of elements, blocks, or steps in the specification or claims is for clarity purposes only, and therefore, such recitation should not be construed as requiring or implying that these elements, blocks, or steps be adhered to a particular arrangement or performed in a particular order.

[0015] Furthermore, terms such as "substantially" or "about" that may be used herein mean that the stated property, parameter, or value need not be obtained exactly, but that deviations or variations, such as tolerances, measurement errors, limitations in measurement accuracy, and other factors known to those skilled in the art, may occur in an amount that does not interfere with the effect of the property intended to be provided.

[0016] As noted above, certain measurable parameters of a device, such as the power consumed by the device, can sometimes provide insight into how a particular feature is implemented, which may enable others to quickly develop competing versions of the feature or allow malicious users to determine security vulnerabilities in the feature.

[0017] For example, a secure process or application on a device may implement a facial recognition function using machine learning (ML) inference. As used herein, ML inference corresponds to hardware configured to execute ML instructions that implement a trained ML model. The ML inference may reside on the device (e.g., an edge device) as opposed to the cloud (e.g., running on a server). Because this process is a security-sensitive authentication mechanism, it is important to keep details about the ML model private. In this regard, the model instructions associated with the ML model may be encrypted on the device. Additionally, the device may incorporate various hardware and software safeguards to prevent the model from being directly analyzed.

[0018] The model instructions may be executed on a specialized processing unit (e.g., inference hardware) of the device, and the power dissipated by the processing unit may be measured during execution of the model instructions. Changes in power dissipation during execution of the model instructions may provide insight into the specific processes being performed by the model. For example, with basic knowledge of the hardware architecture, it may be possible to determine aspects of the ML model, such as the number of layers, the number of nodes in each layer, the activation functions used in each layer, and the input weights to each neuron.

[0019] The embodiments disclosed herein obfuscate power / leakage and EM information available to attackers by introducing dummy or arbitrary work into ML inference hardware. Typically, on-device inference is scheduled to physical hardware at compile time. Introducing arbitrary work concurrently during inference introduces enough noise into the physical properties of the inference that it is visible through side-channel attacks (SCAs), preventing reverse engineering of the model details.

[0020] In some embodiments, the arbitrary work is introduced in the form of scheduled concurrent work on different processing units of the inference hardware that are compiled into the same binary. In some embodiments, a separate obfuscated binary is created that is scheduled concurrently with the ML model that implements the security-sensitive process.

[0021] In some embodiments, any work introduced is random to increase its effectiveness in hiding SCA information. In some embodiments, for ML compilation systems that do not support control flow modification, randomness is emulated by creating a larger set of deterministically obfuscated binaries and making the order in which they are scheduled onto the ML hardware random, but still concurrent with the actual secret model.

[0022] 1 illustrates an example environment 100 including a device 105 and a sensing system 110. An example device 105 corresponds to an edge device (e.g., a device owned by an end user). An example device 105 corresponds to a smartphone, a tablet, a wearable device, a personal computer, etc.

[0023] Some embodiments of device 105 execute an obfuscated model 115. Some examples of obfuscated model 115 include model instructions 115A and obfuscated instructions 115B. Some embodiments of model instructions 115A define an ML model that facilitates implementation of ML-based applications such as face detection, voice recognition, and fingerprint authentication. In some embodiments, a model constructed solely based on model instructions 115A (e.g., the obfuscated model) changes a measurable parameter 120 of device 105. For example, execution of the obfuscated model changes the power consumption of device 105 or the amount of EM energy emitted by device 105. In some embodiments, the change in measurable parameter 120 follows a particular profile (e.g., as shown in FIG. 5A ) during execution of the obfuscated model.

[0024] In this regard, some embodiments of the obfuscation instructions 115B define a miscellaneous process (e.g., "dummy work") that is not necessarily configured to produce any meaningful output. In some embodiments, one or more obfuscation instructions 115B are executed simultaneously or sequentially with the model instructions 115A to obfuscate a particular profile of measurable parameters 120 of the device 105 associated with execution of the obfuscation model.

[0025] Some examples of the sensing system 110 correspond to test equipment configured to sense measurable parameters 120 of the device 105. For example, an example of the sensing system 110 corresponds to an oscilloscope. The oscilloscope may be configured to measure the power consumption of the device 105 during execution of, for example, the de-obfuscated model and the obfuscated model 115. In some embodiments, the change in power consumption during execution of the de-obfuscated model follows a particular profile, and this profile can be used to reveal the inner workings of the de-obfuscated model.

[0026] Another example of the detection system 110 corresponds to a radio frequency (RF) analyzer. The RF analyzer may be configured, for example, to measure electromagnetic (EM) energy emanating from the device 105 during execution of the de-obfuscated and obfuscated models 115. In some embodiments, changes in the EM energy (e.g., changes in frequency and amplitude) during execution of the de-obfuscated model follow a particular profile, which can be used to reveal the inner workings of the de-obfuscated model.

[0027] 2 shows a block diagram of an embodiment of device 105. Referring to the figure, device 105 includes memory 227, processor 225, user interface 230, input / output (I / O) subsystem 210, and ML logic 215.

[0028] The processor 225 is configured to communicate with the memory 227 and execute instruction code stored in the memory 227. The instruction code facilitates the device 105 performing various operations described herein. In this regard, some embodiments of the instruction code cause the processor 225 to control and coordinate various activities performed by different subsystems of the device 105. Some examples of the processor 225 include standalone computer systems, such as ARM®, Intel®, AMD®, or PowerPC®-based computer systems, or different computer systems, including special-purpose computer systems. Some examples of computer systems include operating systems. Examples of operating systems include Android™, Windows®, Linux®, Unix®, or different operating systems.

[0029] Some examples of user interface 230 include display circuitry. Examples of display circuitry include a liquid crystal display (LCD), a light-emitting diode display (LED) display, etc. Some examples of displays include a capacitive transparency touchpad that facilitates receiving user commands. In this regard, some embodiments of display circuitry are configured to present a graphical user interface (GUI). Some examples of user interface 230 include a camera that facilitates performing facial recognition. Some examples of user interface 230 include a microphone that facilitates performing voice recognition. Some examples of user interface 230 include a fingerprint reader that facilitates performing fingerprint authentication.

[0030] Some examples of I / O subsystem 210 include one or more input / output interfaces configured to facilitate communication with entities external to device 105. Some examples of I / O subsystem 210 include wireless communication circuitry configured to facilitate communicating information to and from device 105. Examples of wireless communication circuitry include cellular communication circuitry configured to communicate information over cellular communication networks, such as 3G, 4G, and / or 5G networks. Other examples of wireless communication circuitry facilitate communication of information over WiFi-based networks, Bluetooth®, Zigbee®, near-field communication technology, or different wireless networks.

[0031] Some examples of ML logic 215 include hardware, software, or a combination thereof specifically configured to implement or assist in the implementation of various supervised and unsupervised machine learning models. Within the scope of embodiments, these include implementations of the Holt-Winters algorithm, the Exponential Time Smoothing (ETS) algorithm, an artificial neural network (ANN), a recurrent neural network (RNN), a convolutional neural network (CNN), a seasonal autoregressive moving average (SARIMA) algorithm, a network of long short-term memory (LSTM), and a gated recurrent unit (GRU) algorithm. Some embodiments of ML logic 215 implement other machine learning (ML) logic and / or artificial intelligence (AI) algorithms.

[0032] FIG. 3 illustrates an example of ML logic 215. Referring to FIG. 3, ML logic 215 includes a group of processing units 305A-305D. Examples of processing units 305 correspond to processors of a complex instruction set computer (CISC). Some examples of processing units 305 include hardware and corresponding instruction sets that facilitate performing operations such as matrix multiplication or convolution, application of activation functions, floating-point calculations, etc.

[0033] In some embodiments, the number of processing units 305 used when implementing a particular obfuscated model 115 depends on the complexity of the obfuscated model 115 (e.g., the number of layers specified by model instructions 115A of the obfuscated model 115, the number of nodes within a layer, etc.). In this regard, in some embodiments, model instructions 115A of the obfuscated model 115 are executed by a subset of processing units 305A, 305B. In some embodiments, obfuscated instructions 115B of the obfuscated model 115 are executed by a different subset of processing units 305C, 305D.

[0034] 4 illustrates example operations 400 that facilitate scheduling an obfuscated model 115 in the ML logic 215. At block 405, an ML model is received. At block 410, a first layer of the ML model is selected and 412 Then the first node in that layer is selected.

[0035] The model instructions 115A associated with the selected node are scheduled at block 415. As noted above, in some embodiments, the model instructions 115A are scheduled for execution by a first subset of processing units 305A, 305B.

[0036] At block 420, the obfuscated instructions associated with the selected node are scheduled. As noted above, in some embodiments, the obfuscated instructions 115B are scheduled for execution by the second subset of processing units 305C, 305D. Some embodiments of the obfuscated instructions 115B are configured to implement a loop that repeats a specified number of times to obfuscate a change in a parameter measurable by the execution of the model instructions 115A by the first subset of processing units 305A, 305B at block 415. An increase in the number of times, for example, increases the power consumption or EM energy of the device 105 associated with executing the obfuscated instructions 115B. A decrease in the number of times, for example, decreases the power consumption or EM energy of the device 105 associated with executing the obfuscated instructions 115B.

[0037] In some embodiments, the obfuscated instructions 115B associated with a particular node are configured to execute concurrently with the execution of the model instructions 115A associated with that node. For example, the model instructions 115A execute on a first subset of the processing units 305A, 305B, and then the obfuscated instructions 115B execute on the same processing units 305A, 305B after execution of the model instructions 115A has completed. In some embodiments, the obfuscated instructions 115B associated with a particular node are configured to execute concurrently with the execution of the model instructions 115A. For example, the model instructions 115A execute on a first subset of processing units 305A, 305B, and the obfuscated instructions 115B execute concurrently on a second subset of processing units 305C, 305D.

[0038] In block 425, if there are additional nodes, the operations repeat from block 410. Otherwise, in block 430, if there are additional layers, the operations repeat from block 405.

[0039] As described above, a model constructed solely based on model instructions 115A (e.g., an obfuscated model) causes specific changes to measurable parameters 120 of device 105 that can be utilized to determine the internal operation of the model. Obfuscation instructions 115B are executed concurrently or sequentially with model instructions 115A to obfuscate changes to measurable parameters 120 associated with the execution of model instructions 115A.

[0040] 5A and 5B illustrate example measurable parameter profiles 505, 510 associated with the execution of model instructions 115A and obfuscated instructions 115B, respectively. In some embodiments, each measurable parameter profile 505, 510 is associated with the execution of instructions in ML logic 215 described above.

[0041] In the figure, measurable parameters 120 associated with model instructions 115A and obfuscated instructions 115B transition between first, second, and third states during first, second, and third intervals (e.g., 10 ms intervals), respectively, during execution.

[0042] For example, when measurable parameters 120 correspond to power consumption or EM energy of device 105, measurable parameter profile 505 associated with model instructions 115A indicates that the power consumption or EM energy associated with executing model instructions 115A transitions between successively higher power levels during first, second, and third intervals. Measurable parameter profile 510 associated with obfuscated instructions 115B indicates that the power consumption or EM energy associated with executing obfuscated instructions 115B transitions between successively lower power levels or EM energy during first, second, and third intervals.

[0043] 5C illustrates an example of a measurable parameter profile 515 of device 105 associated with the execution of the above-described model instructions 115A and obfuscated instructions 115B. As illustrated, the measurable parameter profile 515 associated with the combined execution of these instructions is relatively constant, thereby obfuscating the measurable parameter profile 505 associated with the obfuscated model 115.

[0044] 6A and 6B illustrate example measurable parameter profiles 605, 610 associated with the execution of model instructions 115A and obfuscated instructions 115B, respectively. In accordance with the above example, the measurable parameter profile associated with model instructions 115A 605 6C, the measurable parameter profile 615 associated with the combined execution of these instructions is relatively constant, and thus the measurable parameter profile 615 associated with the obfuscated model 115A is relatively constant. 605 Obfuscate the

[0045] In the above example, obfuscation instructions 115B are configured to obfuscate model instructions 115A by canceling the changes to measurable parameter profile 615 associated with model instructions 115A.

[0046] 7A-7C illustrate example measurable parameter profiles 705, 710, 715 associated with the execution of obfuscated instructions 115B configured to randomly display changes in the measurable parameter profile 615 associated with model instructions 115A. The measurable parameter profile 705 of FIG. 7A corresponds to the measurable parameter profile of FIG. 5A. As shown in FIG. 7B, the measurable parameter profile 710 associated with the execution of obfuscated instructions 115B is random when compared to the measurable parameter profile 705 associated with model instructions 115A. As shown in FIG. 7C, the measurable parameter profile 715 associated with the combined profile is randomly displayed, thereby obfuscating the measurable parameter profile 705 associated with model instructions 115A.

[0047] 8 illustrates example operations 800 performed by some examples of device 105. The operations at block 805 include receiving input data describing one or more machine learning (ML) model characteristics of an ML model to be scheduled for execution by the device.

[0048] The operations at block 810 include determining, based on one or more ML model characteristics of the ML model, one or more obfuscation instructions to execute concurrently or sequentially with the execution of the model instructions associated with the ML model, wherein the execution of the one or more obfuscation instructions obfuscates a profile of measurable parameters associated with a device executing the model instructions.

[0049] The operations at block 815 include executing one or more determined obfuscated instructions simultaneously or sequentially with the execution of the model instructions.

[0050] In some embodiments, the number of one or more obfuscation instructions executed is proportional to the number of layers of the ML model.

[0051] In some embodiments, the number of one or more obfuscation instructions executed is proportional to the number of nodes in each of the multiple layers of the ML model.

[0052] In some embodiments, the processor includes multiple processing units, and in these embodiments, executing the one or more obfuscated instructions concurrently or sequentially with the execution of the model instructions includes executing the model instructions on a subset of the multiple processing units and executing the one or more obfuscated instructions on a different subset of the multiple processing units.

[0053] In some embodiments, executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions includes executing one or more obfuscated instructions that cause a change in a measurable parameter of the device due to execution of the model instructions to be substantially undetectable.

[0054] In some embodiments, executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions includes executing one or more obfuscated instructions that substantially randomize changes in measurable parameters of the device due to execution of the model instructions.

[0055] In some embodiments, the measurable parameter corresponds to power consumption of the device. In these embodiments, executing the one or more obfuscated instructions includes executing the one or more obfuscated instructions to adjust power consumption of the device, thereby obfuscating a power consumption profile associated with execution of the ML instructions.

[0056] In some examples, the measurable parameter corresponds to electromagnetic energy emanating from the device, and in these examples, executing the one or more obfuscation instructions includes executing one or more obfuscation instructions that adjust the electromagnetic energy of the device to obfuscate the electromagnetic energy profile associated with the model instructions.

[0057] 9 illustrates an embodiment of a computer system 900 that may form part of or implement any of the systems and / or devices described above. The computer system 900 may include a set of instructions 945 that a processor 905 can execute to cause the computer system 900 to perform any of the operations described above. An embodiment of the computer system 900 may operate as a standalone device or may be connected to other computer systems or peripherals, for example, using a network.

[0058] In networked embodiments, computer system 900 may operate in the capacity of a server, as a client computer in a server-client network environment, or as a peer computer system in a peer-to-peer (or distributed) environment. Also, computer system 900 may be implemented as or incorporated into a variety of devices, such as personal computers or mobile devices, that can execute instructions 945 (sequentially or otherwise) to cause the device to perform one or more actions. Furthermore, each of the described systems may include a collection of subsystems that individually or collectively execute an instruction set or multiple instruction sets to perform one or more computer operations.

[0059] Computer system 900 may include one or more memory devices 910 communicatively coupled to bus 920 for communicating information. Additionally, code operable to cause the computer system to perform the operations described above may be stored in memory 910. Memory 910 may be random access memory, read-only memory, programmable memory, or any other type of memory or storage device.

[0060] The computer system 900 may include a display 930, such as a liquid crystal display (LCD), an organic light emitting diode (OLED) display, or any other display suitable for conveying information. The display 930 may serve as an interface for a user to view processing results produced by the processor 905.

[0061] Additionally, the computer system 900 may include input devices 925 , such as a keyboard or mouse or touch screen, configured to allow a user to interact with the components of the system 900 .

[0062] Computer system 900 can also include a non-volatile memory (NVM) controller 915. NVM controller 915 can include a computer-readable medium 940 (e.g., a flash drive) that can store instructions 945. Instructions 945 can reside completely or at least partially within memory 910 and / or within processor 905 during execution by computer system 900. Memory 910 and processor 905 can also include computer-readable media, as described above.

[0063] Computer system 900 may include a communication interface 935 to support communications over a network 950. Network 950 may include a wired network, a wireless network, or a combination thereof. Communication interface 935 may enable communications via any number of wireless broadband communication standards.

[0064] Thus, the methods and systems described herein can be realized in hardware, software, or a combination of hardware and software. The methods and systems can be realized in a centralized fashion in at least one computer system, or in a distributed fashion where different elements are spread across interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods described herein can be used.

[0065] The methods and systems described herein may also be embedded in a computer program product, which contains all functionality enabling the performance of the operations described herein and which, when loaded into a computer system, is capable of executing these operations. As used herein, a computer program refers to the expression in a machine-executable language, code, or notation of a set of machine-executable instructions intended to cause a device to perform a particular function, either directly or after one or more of: a) conversion of the first language, code, or notation into another language, code, or notation; and b) replication of the first language, code, or notation.

[0066] While the system and method of operation have been described with reference to particular embodiments, those skilled in the art will recognize that various modifications may be made and equivalents may be substituted without departing from the scope of the invention. Accordingly, the method and system are not limited to the particular embodiments disclosed, but rather the disclosed method and system are intended to include all embodiments that fall within the scope of the appended claims.

Claims

1. 1. A computer-implemented method executed on a device, comprising: receiving input data describing one or more machine learning (ML) model characteristics of an ML model; determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to be used to obfuscate a profile of measurable parameters associated with the device when the device executes model instructions of the ML model; executing the one or more obfuscated instructions simultaneously or sequentially with execution of the model instructions; 11. A computer-implemented method comprising:

2. The computer-implemented method of claim 1 , wherein the number of the one or more obfuscated instructions executed is proportional to the number of layers of the ML model.

3. The computer-implemented method of claim 2 , wherein the number of the one or more obfuscation instructions executed is proportional to the number of nodes in each of the layers of the ML model.

4. the device includes a plurality of processing units, and executing the one or more obfuscated instructions concurrently or sequentially with execution of the model instructions comprises: executing the model instructions on a subset of the plurality of processing units; executing the one or more obfuscated instructions on different subsets of the plurality of processing units; The computer-implemented method of claim 1 , comprising:

5. Executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions comprises: The computer-implemented method of claim 1 , comprising executing one or more obfuscation instructions that cause changes in the measurable parameters of the device due to execution of the model instructions to be substantially undetectable.

6. Executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions comprises: The computer-implemented method of claim 1 , comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the device due to execution of the model instructions to be substantially random.

7. the measurable parameter corresponds to a power consumption of the device; executing the one or more obfuscated instructions 2. The computer-implemented method of claim 1, comprising: obfuscating a power consumption profile associated with the execution of ML instructions by executing one or more obfuscated instructions that adjust the power consumption of the device.

8. the measurable parameter corresponds to electromagnetic energy emanating from the device; executing the one or more obfuscated instructions 2. The computer-implemented method of claim 1, comprising: obfuscating an electromagnetic energy profile associated with the model instructions by executing one or more obfuscated instructions that adjust the electromagnetic energy of the device.

9. one or more processors; a computing device including a memory in communication with the one or more processors, The memory, when executed by the one or more processors, causes the computing device to: receiving input data describing one or more machine learning (ML) model characteristics of an ML model; determining, based on the one or more ML model characteristics of the ML model, one or more obfuscation instructions to be used to obfuscate a profile of measurable parameters associated with the computing device when the computing device executes model instructions of the ML model; executing the one or more obfuscated instructions simultaneously or sequentially with execution of the model instructions; Computing devices.

10. The computing device of claim 9 , wherein the number of the one or more obfuscated instructions executed is proportional to the number of layers of the ML model.

11. The computing device of claim 10 , wherein the number of the one or more obfuscated instructions executed is proportional to the number of nodes in each of the layers of the ML model.

12. Executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions comprises: executing the model instructions on a subset of the one or more processors; and executing the one or more obfuscated instructions on different subsets of the one or more processors.

13. Executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions comprises:

10. The computing device of claim 9, further comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the computing device due to execution of the model instructions to be substantially undetectable.

14. Executing the one or more obfuscated instructions simultaneously with or sequentially with the execution of the model instructions comprises:

10. The computing device of claim 9, further comprising executing one or more obfuscated instructions that cause changes in the measurable parameters of the computing device due to execution of the model instructions to be substantially random.

15. the measurable parameter corresponds to a power consumption of the computing device; executing the one or more obfuscated instructions 10. The computing device of claim 9, further comprising: obfuscating a power consumption profile associated with the execution of ML instructions by executing one or more obfuscated instructions that adjust the power consumption of the computing device.

16. the measurable parameter corresponds to electromagnetic energy emanating from the computing device; executing the one or more obfuscated instructions 10. The computing device of claim 9, further comprising: obfuscating an electromagnetic energy profile associated with the model instructions by executing one or more obfuscated instructions that adjust the electromagnetic energy of the computing device.

17. A program that, when executed by one or more processors, causes the one or more processors to execute the computer-implemented method described in any one of claims 1 to 8.

Images