Methods, devices, and systems for ensuring the reliability of inference requests and inference responses

Abstract

Some embodiments of the present disclosure provide guarantees for the handling of inference requests sent to a DNN hosted on a remote computing system. Output data received in response to an inference request can be guaranteed to have been properly generated by the DNN, and not tampered with or generated by a malicious DNN. Output data from the DNN can also be guaranteed to properly correspond to the input data included in the inference request. Linear block coding may be used during transmission to prevent eavesdropping and tampering. Through the use of a guaranteed DNN, some degree of comfort can be obtained that the provided output data properly corresponds to the input data included in a given inference request. Furthermore, known patterns inherent in the DNN output can be used to establish the integrity of the received output data.

Description

[Technical Field]

[0001] This disclosure generally relates to methods, devices, and systems for ensuring the reliability of inference requests and inference responses generated by deep neural networks implemented in computing systems such as cloud computing systems. [Background technology]

[0002] Deep neural networks (DNNs) are known for their complexity and heavy use of computing resources. DNNs, which approximate nonlinear functions, are trained to perform specific tasks such as computer vision tasks, natural language processing tasks, and speech processing tasks. DNNs receive input data in the form of vectors or tensors and generate inference data (e.g., predicted values) based on the input data. Due to their size and complexity, DNNs are typically hosted on remote computing systems with large amounts of computing resources (e.g., memory and processing resources). Hosting DNNs on remote computing systems, such as cloud computing systems, allows third-party entities, such as cloud computing providers, to create and manage DNNs that perform specific tasks, and to provide users with access to the DNNs via the internet, providing input data for a particular DNN to perform inference on a specific task. To access a DNN hosted on a remote computing system, a client computing device ("client device") uses a communication network to send an inference request containing the DNN's input data, including the input data, to the remote computing system hosting the DNN being implemented, and receives an inference response from the remote computing system using the communication network, containing the inference data generated by the DNN based on the input data.

[0003] By sending inference requests from a client device to a remote computing system where a DNN is being implemented, using wireless and wired network connections, and receiving inference responses generated by the DNN using the same wireless and wired network connections, the inference requests and inference responses are exposed to malicious attacks such as eavesdropping and tampering. [Overview of the Initiative]

[0004] This disclosure provides methods, devices, and systems for ensuring the reliability of input data included in inference requests transmitted by a client device to a remote computing system hosting a DNN, such as a cloud computing system, via a network of communication systems. Inference data included in inference responses transmitted from the remote computing system to the client device can be guaranteed to have been properly received by the client device and generated by the DNN, rather than being tampered with or generated by a malicious DNN. Inference data included in inference responses can also be guaranteed to appropriately correspond to the input data included in the inference request.

[0005] An undesirable side effect of hosting a DNN on a computing system located remotely from client devices is that transmissions between the client devices and the computing system are exposed to various malicious attacks. These malicious attacks can occur as eavesdropping or tampering with transmissions containing inference requests and inference responses as they are received and forwarded by various network entities in the communication system. A transmission may contain an inference request with input data, or a corresponding inference response with inference data. In addition, malicious attacks may fundamentally occur on the computing system hosting the DNN. Such malicious attacks may involve DNNs that provide responses containing inference data that does not correspond to the input data included in the request, sometimes in order to conserve computing resources. Therefore, the extent to which the inference data corresponds to the input data can become a concern.

[0006] Aspects of this application relate to preventing eavesdropping and tampering of input data using linear block coding of input data included in inference requests generated by applications operating on electronic devices. By using a guaranteed DNN, a certain degree of assurance can be obtained that the given inference response data will appropriately correspond to the given input data. Furthermore, the integrity of the output data can be established by using known patterns inherent in the output data generated by the DNN. [Means for solving the problem]

[0007] A method is provided according to one aspect of the present disclosure. The method includes the steps of: encoding an input data vector using a linear block encoder to obtain an encoded input vector; sending an inference request containing the encoded input vector; and receiving an inference response.

[0008] A method for handling an inference request is provided in another aspect of the present disclosure. The method includes the steps of: receiving an inference request, wherein the inference request includes an input data vector; transmitting the inference request; encoding the input data vector using a linear block encoder to obtain an actual encoded input vector; receiving an inference response, wherein the inference response includes an output data vector; obtaining an estimated encoded input vector based on the output data vector; obtaining a confidence score representing a comparison between the estimated encoded input vector and the actual encoded input vector; and transmitting the output data vector if it is determined that the confidence score exceeds a threshold.

[0009] To better understand this embodiment and its effects, the following description, accompanied by the attached drawings, will be used as an example. [Brief explanation of the drawing]

[0010] [Figure 1] A schematic diagram shows a communication system in which embodiments of the present disclosure may arise, the communication system including examples of multiple electronic devices (EDs) and examples of multiple radio access network (RAN) nodes along with various networks. [Figure 2] The communication system in Figure 1 is shown in a block diagram, and the communication system includes examples of multiple EDs, an example of a terrestrial RAN node, and an example of a non-terrestrial RAN node, along with various networks. [Figure 3] The elements of the example ED in Figure 2, the elements of the example terrestrial RAN node in Figure 2, and the elements of the example non-terrestrial RAN node in Figure 2, according to the embodiments of this application, are shown as block diagrams. [Figure 4] Various modules that may be included in examples of electronic devices, terrestrial wave transmission and reception points, and non-terrestrial wave transmission and reception points according to embodiments of this application are shown as block diagrams. [Figure 5]The sensing management function according to an embodiment of this application is shown as a block diagram. [Figure 6] A block diagram illustrates a typical scenario where an ED sends a request to a cloud-based DNN (DNN-on-Cloud) via a RAN node. [Figure 7A] This invention illustrates components of an ED that are partially responsible for processing inference requests. [Figure 7B] This invention illustrates components of an ED that are partially responsible for processing inference responses. [Figure 8A] This invention illustrates components of a computing system and a RAN node that are partially responsible for processing inference responses. [Figure 8B] This invention illustrates components of a computing system and a RAN node that are partially responsible for processing inference requests. [Figure 9] The scene shown is similar to the one in Figure 6, and ED refers to a specific ED. [Figure 10] An example of the steps for obtaining a guaranteed inference response, as viewed from the perspective of ED in Figure 9, according to an aspect of this application, is shown. [Figure 11] An example of the steps for handling an inference request, as viewed from the perspective of the RAN node in Figure 9, according to an aspect of this application, is shown. [Figure 12] An example of yet another step in the method for handling inference requests, as seen from the perspective of the RAN node in Figure 9, according to an aspect of this application, is shown. [Figure 13] An example of yet another step in the method for obtaining a guaranteed inference response, as viewed from the perspective of ED in Figure 9, according to an aspect of this application, is shown. [Figure 14] An example of yet another step in the method for handling inference requests, as seen from the perspective of the RAN node in Figure 9, according to an aspect of this application, is shown. [Figure 15] An example of steps in a method for handling an inference request, as viewed from the perspective of the RAN node in Figure 9, according to an aspect of this application, is shown, where the RAN node is not provided with access to a linear block encoding matrix. [Figure 16] An example of the steps of the method performed by the RAN node in Figure 9, according to an aspect of this application, is shown as an outline of the assurance. [Figure 17] An example of the steps for performing the assurance protocol on the RAN node shown in Figure 9, according to an aspect of this application, is shown. [Figure 18] An example of a step in a method for performing an intragroup consistency check as part of the method shown in Figure 17, relating to an aspect of this application, is shown. [Figure 19] An example of a step in a method for performing intergroup consistency checks as part of the method shown in Figure 17, relating to an aspect of this application, is shown. [Figure 20] An example of the steps of the method performed in ED of Figure 9, which receives an encoded guaranteed inference response vector according to an aspect of this application, is shown. [Figure 21] An example of the steps of the method described in Figure 9 ED, relating to an embodiment of this application, is shown, and the method is associated with a coded input data vector and an encoded inference response vector. [Modes for carrying out the invention]

[0011] Specific embodiments are described in more detail below, in conjunction with the figures, for illustrative purposes.

[0012] The embodiments described herein provide sufficient information to implement the claimed subject matter and illustrate ways in which such subject matter can be implemented. A person skilled in the art will understand the concept of the claimed subject matter and recognize the applications of such concept that are not specifically addressed herein. It will be understood that such concept and applications are within the scope of this disclosure and the attached claims.

[0013] Furthermore, it is understood that any module, component, or device disclosed herein that performs instructions may include, or otherwise access, one or more non-temporary computer / processor-readable storage media used to store information such as computer / processor-readable instructions, data structures, program modules, and / or other data. Examples of non-temporary computer / processor-readable storage media include magnetic cassettes, magnetic tapes, magnetic disk storage and other magnetic storage devices, compact disc read-only memory (CD-ROM), digital video discs, i.e., digital multi-purpose discs (i.e., DVDs), optical discs such as Blu-ray Disc® and other optical storage, volatile and non-volatile removable and non-removable media implemented in any way or technique, random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory and other memory technologies. Such non-temporary computer / processor storage media may be part of a device, accessible from a device, or connectable to a device. Computer / processor-readable / executable instructions for implementing the applications and modules described herein may be stored in, or held in a manner different from, such non-temporary computer / processor-readable storage media.

[0014] Referring to Figure 1, a simplified schematic diagram of an example of a communication system 100 is shown. The communication system 100 comprises several networks, including a wireless access network 120, a core network 130, a public switched telephone network (PSTN) 140, the Internet 150, other networks 160, and a remote computing system 600 that hosts a DNN 650.

[0015] The Radio Access Network (RAN) 120 may be a next-generation (e.g., 6th generation (6G) or later) radio access network or a legacy (e.g., 5G, 4G, 3G, or 2G) radio access network. One or more electronic communication devices (EDs) 110a, 110b, 110c, 110d, 110e, 110f, 110g, 110h, 110i, 110j (often referred to as ED110, and collectively as ED110) may be connected to each other or to one or more Radio Access Network (RAN) nodes 170a, 170b of the RAN 120 (often referred to as RAN node 170, and collectively as RAN node 170). The core network 130 may or may not depend on the radio access technology used in the communication system 100.

[0016] The remote computing system 600 ("Computing System 600") of the communication system 100 shown in Figure 1 may be directly or indirectly connected to the core network 130. Computing System 600 includes multiple powerful computing resources, including a central processing unit, hardware accelerators, graphics processing units, and memory, which are used to train the DNN 650 hosted on Computing System 600. The remote computing system 600 may be a cloud computing system ("Cloud") that hosts multiple different DNNs, including DNN 650, trained for various tasks. The DNN 650 hosted on Computing System 600 may receive multiple inference requests from one ED 110, multiple inference requests from different ED 100s, or perform multiple different inferences simultaneously. For example, when an application running on ED110 generates an inference job that includes one or more inference requests to DNN650, ED110 ("requesting ED110") transmits the DNN650 inference job wirelessly to RAN node 170, which processes the wireless transmission to obtain the inference request and transmits the inference request via wired and / or wireless transmission to the computing system 600 hosting DNN650 through the core network 130. When computing system 600 receives the transmission containing the DNN650 inference job, it registers the inference job with DNN650. Computing system 600 calls DNN650, which is hosted on computing system 600, to perform the requested inference job. Subsequently, as described in more detail below, ED110 transmits the inference request to DNN650 included in the inference job to computing system 600 hosting DNN650 via RAN node 170 and the core network 130. As will be described in more detail later, an inference request includes a control header containing the input data for the inference request and a reference to the DNN650 that the inference request is targeting.When an inference request is received by the computing system 600, the cloud computing system 600 provides the input data for the inference request to the DNN650, which then performs the inference, generating inference data. Subsequently, the DNN650 generates an inference response and provides it to the computing system 600. The inference response includes the inference data generated and provided by the DNN650, as well as other parameters that consequently relate to the inference data. The computing system 600 hosting the DNN650 sends the inference response to the ED110 via the core network 130 and the RAN node 170.

[0017] In some embodiments, the computing system 600 hosting the DNN650 may be indirectly connected to the core network 130 via the Internet 150. In this embodiment, inference requests and inference responses transmitted between the ED and the computing system 600 may be encapsulated in TCP / IP packets.

[0018] RAN node 170 may be equipped with powerful computing resources. Alternatively, RAN node 170 may be connected to a computing system containing powerful computing resources via wireless or wired connections. A RAN node 170 equipped with powerful computing resources is often referred to as an edge computing system, or a computing system located near and connected to RAN node 170 is often referred to as an edge computing system.

[0019] Figure 2 shows various network and ED examples of the communication system 100 example shown in Figure 1. Briefly, the communication system 100 enables multiple wireless and wired elements (e.g., ED110, RAN120, core network 130) to communicate data and other content with one another. The communication system 100 may enable the communication of data and other content, such as voice, video, and / or text, via broadcast, multicast, and unicast transmissions, for example. The communication system 100 may operate by sharing resources, such as carrier spectral bandwidth, among the wireless elements of the communication system 100 (e.g., ED110 and RAN120) for wireless communication. The communication system 100 may include a terrestrial communication network and / or a non-terrestrial communication network. The communication system 100 can provide a wide range of communication services and applications (e.g., Earth monitoring, remote sensing, passive sensing and positioning, navigation and tracking, autonomous delivery and mobility). The communication system 100 can provide high availability and robustness through the joint operation of terrestrial and non-terrestrial communication networks. For example, by integrating a non-terrestrial communication network (or its components) into a terrestrial communication network, it is possible to obtain what can be considered a heterogeneous network with multiple layers. Compared to conventional communication networks, heterogeneous networks can achieve improved overall performance through efficient multi-link collaboration, more flexible function sharing, and high-speed switching of physical layer links between terrestrial and non-terrestrial networks. RAN120 and core network 130 may be non-terrestrial communication networks or heterogeneous communication networks.

[0020] The terrestrial and non-terrestrial communication networks can be considered as subnetworks of the RAN 120 of the communication system 100. In the example shown in Figure 2, the communication system 100 includes electronic devices (EDs) 110a, 110b, 110c, 110d, radio access networks (RANs) 120a, 120b, 120c, a core network 130, a public switched telephone network (PSTN) 140, the Internet 150, and other networks 160. RANs 120a and 120b are terrestrial communication networks and include RAN nodes 170a and 170b, which may be base stations, eNBs, gNBs, or transmit / receive points (TRPs). RAN network 120c is a non-terrestrial communication network and includes one or more RAN nodes 172, which are often referred to as non-terrestrial transmit / receive points (NT-TRPs) 172.

[0021] Alternatively, or in addition to the above, any ED110 may be configured to connect, access, and communicate via interfaces with any RAN node 170, the Internet 150, the core network 130, the PSTN 140, other networks 160, or any combination thereof. In some examples, ED110a may communicate with RAN node 170a, which may be T-TRP, using a terrestrial radio interface 190a to transmit uplink and / or downlink transmissions. In some examples, ED110a, 110b, 110c, and 110d may also communicate directly with each other via one or more sidelink radio interfaces 190b. In some examples, ED110d may communicate with RAN node 170c of RAN120c using a non-terrestrial radio interface 190c, which may be NT-TRP, to transmit uplink and / or downlink transmissions.

[0022] The radio interface 190a and the radio interface 190b may use similar communication technologies, such as appropriate radio access technologies. For example, the communication system 100 may implement one or more channel access methods in the radio interfaces 190a and 190b, such as code division multiple access (CDMA), space division multiple access (SDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA), or single-carrier FDMA (SC-FDMA). The radio interfaces 190a and 190b may also utilize other higher-dimensional signal spaces, which may involve combinations of orthogonal and / or non-orthogonal dimensions.

[0023] The radio interface 190c enables a wireless link, i.e., communication between the ED110d and one or more RAN nodes 170 simply over the link. In some examples, the link may be a dedicated connection for unicast transmission, a connection for broadcast transmission, or a connection between a group of ED110s and one or more RAN nodes 170 for multicast transmission.

[0024] RAN120a and 120b communicate with core network 130 and provide various services to ED110a, 110b, and 110c, such as voice, data, and other services. RAN120a and 120b and / or core network 130 may communicate directly or indirectly with one or more other RANs (not shown), and services may or may not be directly provided by core network 130 to one or more other RANs, and one or more other RANs may or may not employ the same radio access technology as RAN120a, RAN120b, or both. Core network 130 also provides services as a gateway access between (i) RAN120a and 120b or ED110a, 110b, 110c, or both, and (ii) other networks (such as PSTN140, the Internet 150, or other networks 160). Furthermore, some or all of the ED110a, 110b, and 110c may include the ability to communicate with different wireless networks using different wireless technologies and / or protocols and different wireless links. Instead of (or in addition to) wireless communication, the ED110a, 110b, and 110c may communicate with a service provider or switch (not shown) and the Internet 150 via a wired communication channel. The PSTN 140 may include a circuit-switched telephone network for providing basic telephone services (POTS). The Internet 150 may include a network of computers and subnets (intranets) or both, and the Internet 150 may incorporate protocols such as the Internet Protocol (IP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP). The ED110a, 110b, and 110c may be multimode devices capable of operating according to multiple wireless access technologies, and the ED110a, 110b, and 110c may incorporate multiple transceivers necessary to support such technologies.

[0025] Figure 3 shows a block diagram of ED110, RAN node 170A which is an NT-TRP, and RAN node 170B which is a T-TRP. Other ED110s and RAN nodes 170 of the communication system 100 may be similar to the ED110s and RAN nodes 170A and 170B shown in Figure 3. ED110 may be used by people, objects, machines, etc., and may be connected to a network such as RAN120 or to another ED110. The ED110 may be widely used in various applications such as cellular communication, device-to-device (D2D), vehicle-to-vehicle (V2X), peer-to-peer (P2P), machine-to-machine (M2M), machine-to-machine communication (MTC), Internet of Things (IoT), virtual reality (VR), augmented reality (AR), industrial control, autonomous driving, telemedicine, smart grids, smart furniture, smart offices, smart wearables, smart transportation, smart cities, drones, robots, remote sensing, passive sensing, positioning, navigation and tracking, autonomous delivery and mobility.

[0026] Each ED110 is any suitable electronic device configured for wireless communication with the RAN120 and / or a wireless network such as a WiFi network, and may be referred to as a user terminal (UE) or user device. The ED110 may be any type of end-user device, such as an electronic device, a wireless transceiver unit (WTRU), a mobile station, a fixed subscriber unit or a mobile subscriber unit, a cellular telephone, a station (STA), a machine-type communication (MTC) device, a personal digital assistant (PDA), a smartphone, a laptop, a computer, a tablet, a wireless sensor, a consumer electronics device, a smartbook, a vehicle, an automobile, a truck, a bus, a train, or an IoT device, an industrial device, or equipment for the above devices (e.g., communication modules, modems, or chips). Future generations of the ED110 may be referred to by other terms. Depending on one or more of the connection availability and the need for the connection, each ED110 connected to RAN node 170 which is T-TRP and / or RAN node 170c which is NT-TRP170c can be dynamically or quasi-statically turned on (established, activated or enabled), turned off (released, deactivated or disabled), and / or configured.

[0027] The ED110 includes a transmitter 201 and a receiver 203 coupled to one or more antennas 204. Figure 3 shows only one antenna 204. Alternatively, one of the antennas 204 may be a panel, some may be panels, or all may be panels. The transmitter 201 and receiver 203 may be integrated into a single device, often referred to as a transceiver. The transceiver is configured to modulate data or other content used for transmission by at least one antenna 204 or a network interface controller (NIC). The transceiver may also be configured to demodulate data or other content received by at least one antenna 204. Each transceiver includes some suitable structure used for generating signals used for wireless or wired transmission, and / or processing signals received wirelessly or wired. Each antenna 204 includes some suitable structure used for transmitting and / or receiving wireless or wired signals.

[0028] The ED110 includes at least one memory 208. The memory 208 stores instructions and data used, generated, or collected by the ED110. For example, the memory 208 can store software instructions or modules executed by one or more processing units (e.g., processor 210) and configured to carry out some or all of the functions and / or embodiments described herein. Each memory 208 includes some suitable volatile and / or non-volatile storage and one or more retrieval devices. Any suitable type of memory may be used, such as random access memory (RAM), read-only memory (ROM), hard disk, optical disk, subscriber identification module (SIM) card, memory stick, secure digital (SD) memory card, or on-processor cache.

[0029] The ED110 may further include one or more input / output devices (not shown) and interfaces (such as a wired interface to the Internet 150 in Figure 1). The input / output devices enable communication with user devices or other devices in the network. Each input / output device includes some appropriate structure for providing information to or receiving information from a user, such as by operating as a speaker, microphone, keypad, keyboard, display, or touch screen, including network interface communication.

[0030] ED110 includes a processor 210 that performs operations related to preparing uplink transmissions to RAN node 170c, which is an NT-TRP, and / or RAN nodes 170a, 170b, which are T-TRPs; operations related to processing downlink transmissions received from RAN nodes 170c and / or RAN nodes 170a, 170b; and operations related to processing sidelink transmissions to and from another ED110. Processing operations related to preparing uplink transmissions may include operations such as encoding, modulation, transmit beamforming, and symbol generation of the uplink transmission. Processing operations related to processing downlink transmissions may include operations such as receive beamforming, demodulation, and decoding of the received symbols. In some embodiments, the downlink transmission may be received by a receiver 203 using receive beamforming, and the processor 210 may extract signaling from the downlink transmission (for example, by detecting and / or decoding the signaling). An example of signaling may be a reference signal transmitted by RAN node 170c and / or RAN nodes 170a,170b. In some embodiments, the processor 210 performs transmit beamforming and / or receive beamforming based on beam direction information received from RAN node 170a, such as beam angle information (BAI). In some embodiments, the processor 210 may perform operations related to network access (e.g., initial access) and / or downlink synchronization (operations related to detecting synchronization sequences, decoding and retrieving system information, etc.). In some embodiments, the processor 210 may perform channel estimation using, for example, a reference signal received from RAN node 170c and / or RAN nodes 170a,170b.

[0031] Although not shown, the processor 210 may form part of the transmitter 201 and / or part of the receiver 203. Although not shown, the memory 208 may form part of the processor 210.

[0032] The processor 210, the processing components of the transmitter 201, and the processing components of the receiver 203 may be implemented by the same one or more processors configured to execute instructions stored in memory (for example, in memory 208), or they may be implemented by one or more different processors. Alternatively, some or all of the processor 210, the processing components of the transmitter 201, and the processing components of the receiver 203 may be implemented using dedicated circuits such as programmed field-programmable gate arrays (FPGAs), graphical processing units (GPUs), or application-specific integrated circuits (ASICs).

[0033] In some implementations, RAN node 170 may be referred to by other names among various possibilities, such as base station, base transceiver station (BTS), radio base station, network node, network device, network-side device, transmit / receive node, Node B, evolved NodeB (eNodeB or eNB), home eNodeB, next-generation NodeB (gNB), transmission point (TP), terrestrial transmit / receive point (TRP), non-terrestrial transmit / receive point (NT-TRP), site controller, access point (AP), radio router, relay station, remote radio head, terrestrial node, terrestrial network device, terrestrial base station, baseband unit (BBU), remote radio unit (RRU), active antenna unit (AAU), remote radio head (RRH), central unit (CU), distribute unit (DU), positioning node, etc. Referring to Figure 3, RAN node 170a, which is a T-TRP, may also be a macro BS, pico BS, relay node, donor node, etc., or a combination thereof. RAN node 170a may refer to the above-mentioned device, or it may refer to the components of the above-mentioned device (for example, a communication module, modem, or chip).

[0034] In some embodiments, a portion of the RAN node 170 may be distributed. For example, some modules of the RAN node 170 may be located away from the equipment housing the RAN node 170's antenna 256 and may be coupled to the equipment housing the antenna 256 using a communication link (not shown) sometimes referred to as a fronthaul, such as a common public radio interface (CPRI). Thus, in some embodiments, the term RAN node may also refer to network-side modules that perform processing operations such as determining the location of the ED110, resource allocation (scheduling), message generation, and encoding / decoding, and are not necessarily part of the equipment housing the RAN node 170's antenna 256. Modules may also be coupled to other RAN nodes. In some embodiments, the RAN node 170 may comprise multiple TRPs (e.g., N-TRP and / or T-TRP) that operate together to serve the ED110, for example, by using coordinated multipoint transmission.

[0035] As shown in Figure 3, RAN node 170a includes at least one transmitter 252 and at least one receiver 254 coupled to one or more antennas 256. Only one antenna 256 is shown. Alternatively, one of the antennas 256 may be a panel, some may be panels, or all may be panels. The transmitter 252 and receiver 254 may be integrated as a transceiver. RAN node 170a further includes a processor 260 that performs operations related to preparing for transmission for downlink transmission to ED110, processing uplink transmissions received from ED110, preparing for transmission for backhaul transmission to RAN node 170c, and processing transmissions received from RAN node 170c using backhaul. Processing operations related to preparing for transmission for downlink or backhaul transmission may include operations such as encoding, modulation, precoding (e.g., multiple input multiple output (MIMO) precoding), transmit beamforming, and generating symbols used for transmission. Processing operations related to the processing of transmissions received on the uplink or backhaul may include operations such as received beamforming, demodulation of received symbols, and decoding of received symbols. The processor 260 may also perform operations related to network access (e.g., initial access) and / or downlink synchronization, such as generating the contents of a synchronous signal block (SSB) and generating system information. In some embodiments, the processor 260 also generates a beam direction indicator, such as a BAI, which may be scheduled for transmission by the scheduler 253. The processor 260 performs other network-side processing operations described herein, such as determining the location of the ED110 and determining the location to deploy the RAN node 170c. In some embodiments, the processor 260 may generate signaling for setting, for example, one or more parameters of the ED110 and / or one or more parameters of the RAN node 170c. Any signals generated by the processor 260 are sent by the transmitter 252.It should be noted that the term "signaling" as used herein is alternatively referred to as control signaling. Dynamic signaling may be transmitted on a control channel, such as a physical downlink control channel (PDCCH), and static or quasi-static higher-layer signaling may be included in packets transmitted on a data channel, such as a physical downlink shared channel (PDSCH).

[0036] The scheduler 253 may be coupled to the processor 260. The scheduler 253 may be contained within the RAN node 170a or may operate separately from the RAN node 170a. The scheduler 253 may schedule uplink transmits, downlink transmits and / or backhaul transmits, which include issuing scheduling grants and / or configuring non-scheduling ("configured grant") resources. The RAN node 170a, which is a T-TRP, further includes a memory 258 for storing information and data. The memory 258 stores instructions and data used, generated, or collected by the RAN node 170a. For example, the memory 258 can be configured to carry out some or all of the functions and / or embodiments described herein and can store software instructions and modules executed by the processor 260.

[0037] Although not shown, the processor 260 may form part of the transmitter 252 and / or part of the receiver 254. Also, although not shown, the processor 260 may perform the function of a scheduler 253. Although not shown, the memory 258 may form part of the processor 260.

[0038] The processor 260, the scheduler 253, the processing components of the transmitter 252, and the processing components of the receiver 254 may each be implemented by the same or different processors from one or more processors configured to execute instructions stored in memory, for example, memory 258. Alternatively, some or all of the processor 260, the scheduler 253, the processing components of the transmitter 252, and the processing components of the receiver 254 may be implemented using dedicated circuits such as FPGAs, GPUs, or ASICs.

[0039] In particular, while the NT-TRP RAN node 170c in Figure 3 is shown as being implemented on a drone, this is merely an example, and the RAN node 170c may be implemented on any suitable non-terrestrial device. Also, in some implementations, the NT-TRP may be referred to by other names such as non-terrestrial node, non-terrestrial network device, or non-terrestrial base station. The NT-TRP RAN node 170c includes a transmitter 272 and a receiver 274 coupled to one or more antennas 280. Only one antenna 280 is shown. Alternatively, one of the antennas may be a panel, some may be panels, or all may be panels. The transmitter 272 and receiver 274 may be integrated as a transceiver. The NT-TRP RAN node 170c further includes a processor 276 that performs operations related to preparing for transmission for downlink transmission to ED110, processing uplink transmissions received from ED110, preparing for transmission for backhaul transmission to RAN node 170a, and processing transmissions received from RAN node 170a via backhaul. Processing operations related to preparing for transmission for downlink or backhaul transmission may include operations such as encoding, modulation, precoding (e.g., MIMO precoding), transmit beamforming, and generating symbols used for transmission. Processing operations related to processing transmissions received via uplink or backhaul may include operations such as receive beamforming, demodulation of received signals, and decoding of received symbols. In some embodiments, the processor 276 performs transmit beamforming and / or receive beamforming based on beam direction information (e.g., BAI) received from RAN node 170a. In some embodiments, the processor 276 can generate signaling for setting one or more parameters of ED110, for example. In some embodiments, the RAN node 170c performs physical layer processing but does not perform higher layer functions such as those in the media access control (MAC) layer or radio link control (RLC) layer.This is just an example; more generally, RAN node 170c may perform higher-layer functions in addition to physical layer processing.

[0040] The RAN node 170c further includes a memory 278 for storing information and data. Although not shown, a processor 276 may form part of a transmitter 272 and / or part of a receiver 274. Although not shown, the memory 278 may form part of the processor 276.

[0041] The processor 276, the processing components of the transmitter 272, and the processing components of the receiver 274 may each be implemented by the same one or more processors configured to execute instructions stored in memory, for example, memory 278, or by one or more different processors. Alternatively, some or all of the processor 276, the processing components of the transmitter 272, and the processing components of the receiver 274 may be implemented using dedicated circuitry such as programmed FPGAs, GPUs, or ASICs. In some embodiments, the RAN node 170c may include multiple NT-TRPs that operate collectively to serve the ED110, for example, by using coordinated multipoint transmission.

[0042] RAN node 170, such as RAN node 170a and RAN node 170c, and / or ED110 may include other components, but these are omitted for clarity.

[0043] One or more steps of the methods for ensuring the reliability of inference requests and inference responses described herein may be performed by a part or module of ED110 or RAN node 170. Figure 4 shows a part or module of ED110 or RAN node 170. For example, a radio signal, such as a high-frequency signal, may be transmitted by a transmitter or transmitting module of ED110 or RAN node. The transmitter or transmitting module may perform source encoding and channel encoding at the media access control (MAC) layer and physical layer, as is known to those skilled in the art. The radio signal, such as a high-frequency signal, may be received by a receiver or receiving module of ED110 or RAN node 170. The radio signal may be processed by a processing unit or processing module of ED110. The receiver or receiving module may perform source decoding and channel decoding at the media access control (MAC) layer and physical layer, as is known to those skilled in the art. Other operations, including the generation of an inference job containing one or more inference requests and encoding of the input data for each inference request, may be performed by an artificial intelligence (AI) module or machine learning (ML) module of ED110. Each part or module may be implemented using hardware, one or more components or devices that execute software, or a combination thereof. For example, one or more parts or modules may be integrated circuits such as FPGAs, GPUs, or ASICs that are programmed. If a module is implemented using software for execution by a processor, for example, the entire or a part of the instruction module may be acquired by the processor as one or more instances, individually or collectively, for processing, as needed, and the module itself may contain instructions for further deployment and instantiation.

[0044] Further details regarding ED110 and RAN node 170 are known to those skilled in the art; therefore, these details are omitted herein.

[0045] Typically, a radio interface includes several components and associated parameters that collectively specify how transmissions are sent and / or received over a radio communication link between two or more communication devices (e.g., between an ED110 and one or more RAN nodes 170, between a RAN node 170 and one or more ED110s, or between ED110s). For example, a radio interface may include one or more components that define one or more waveforms, one or more frame structures, one or more multiple access schemes, one or more protocols, one or more coding schemes, and / or one or more modulation schemes for transmitting information (e.g., data) over a radio communication link. The radio communication link may be a link between a RAN node 170 (such as a T-TRP or NT-TRP) and an ED110 (e.g., a "Uu" link), and / or the radio communication link may be a link (two ED110s) (e.g., a "sidelink"), and / or the radio communication link may be a link between a non-terrestrial (NT) communication network and an ED110. The following are some examples of the above components.

[0046] Waveform components may specify the shape and form of the transmitted signal. Waveform components may include orthogonal multiple access waveforms and non-orthogonal multiple access waveforms. Examples that do not impose such limitations on waveform components include orthogonal frequency division multiplexing (OFDM) waveforms, filtered OFDM (f-OFDM) waveforms, time windowing OFDM, Filter Bank Multicarrier (FBMC) waveforms, Universal Filtered Multicarrier (UFMC) waveforms, Generalized Frequency Division Multiplexing (GFDM) waveforms, Wavelet Packet Modulation (WPM) waveforms, and Faster Than Nyquist (FTN) Peak to Average Power Ratio Waveform (low PAPR WF).

[0047] Frame structure components may specify frame settings or groups of frames. Frame structure components may also refer to one or more parameters of a frame or group of frames, such as time, frequency, pilot signature, code, etc. Details of the frame structure are described below.

[0048] Multiple access scheme components may specify multiple access technique options, including techniques that define how communication devices share a common physical channel, such as TDMA, FDMA, CDMA, SDMA, SC-FDMA, Low Density Signature Multicarrier CDMA (LDS-MC-CDMA), Non-Orthogonal Multiple Access (NOMA), Pattern Division Multiple Access (PDMA), Lattice Partition Multiple Access (LPMA), Resource Spread Multiple Access (RSMA), or Sparse Code Multiple Access (SCMA). Furthermore, multiple access technique options may include scheduled access or unscheduled access, also known as grant-free access; non-orthogonal or orthogonal multiple access; access via dedicated channel resources (e.g., not shared among multiple communication devices); shared channel resources with or without contention; or access using cognitive radio.

[0049] Hybrid Automatic Repeat Request (HARQ) protocol components may specify how transmission and / or retransmission are performed. Examples that do not impose limitations on transmission and / or retransmission mechanism options include the scheduled data pipe size, the transmission and / or retransmission signaling mechanism, and options for specifying the retransmission mechanism.

[0050] Coding and modulation components specify how transmitted information is encoded / decoded and modulated / demodulated for transmission / reception. Coding may refer to methods of error detection and forward error correction. Examples that do not impose limitations on coding options include turbo trellis codes, turbo product codes, fountain codes, low-density parity check codes, and polar codes. Modulation may simply refer to a constellation (including, for example, modulation techniques and modulation order), and in particular, to various types of advanced modulation methods such as hierarchical modulation and low PAPR modulation.

[0051] In some embodiments, the radio interface may be a "one-size-fits-all" concept. For example, this means that once the radio interface is defined, the components included in the radio interface cannot be changed or adapted. In some implementations, only a limited number of parameters or modes of the radio interface, such as the cyclic prefix (CP) length or MIMO mode, can be set. In some embodiments, the radio interface design may provide a unified or flexible framework for supporting frequencies below the 6 GHz band and frequencies above the 6 GHz band (e.g., millimeter wave band) for both licensed and unlicensed access. For example, the flexibility of a configurable radio interface provided by scalable numerology and symbol width may allow for optimization of transmission parameters when different spectral bands and services / devices are different. As another example, a unified radio interface may be self-contained in the frequency domain, and a self-contained design in the frequency domain may support more flexible RAN slicing through channel resource sharing between services that differ in both frequency and time.

[0052] A frame structure is a feature of the wireless communication physical layer that defines the time-domain signal transmission structure to enable timing synchronization by referencing the timing of the underlying time-domain transmission unit. Wireless communication between communication devices can occur over time-frequency resources governed by the frame structure. The frame structure is sometimes referred to as the wireless frame structure.

[0053] Depending on the frame structure and / or the configuration of frames in the frame structure, frequency division duplex (FDD), / or time division duplex (TDD), and / or full-duplex (FD) communication may be possible. FDD communication is when transmissions in different directions (e.g., uplink or downlink) occur in different frequency bands. TDD communication is when transmissions in different directions (e.g., uplink or downlink) occur in different time widths. FD communication is when transmission and reception occur using the same time-frequency resources, i.e., devices can transmit and receive using the same frequency resources over the same period.

[0054] An example of a frame structure is a frame structure specified for use in a known Long-Term Evolution (LTE) cellular system, in which each frame has a width of 10 ms, each frame has 10 subframes, each subframe has a width of 1 ms, each subframe contains 2 slots, each slot has a width of 0.5 ms, each slot is used to transmit 7 OFDM symbols (assuming the CP is normal), and each OFDM symbol has a symbol width and a specific bandwidth (or partial bandwidth or bandwidth partition) related to the number of subcarriers and the subcarrier spacing, and the frame structure is based on OFDM waveform parameters such as subcarrier spacing and CP length (CP has options for fixed length or limited length), and the uplink-downlink switching gap in TDD is specified as an integer time of the OFDM symbol width.

[0055] Another example of a frame structure is the one specified for use in known New Radio (NR) cellular systems. This example supports multiple subcarrier intervals, each corresponding to a different numerology, and the frame structure is numerology-dependent. In any case, the frame length is set to 10ms, each frame consists of 10 subframes, each subframe is 1ms wide, and slots are defined as 14 OFDM symbols, with slot lengths dependent on the numerology. For example, the NR frame structure for a normal CP with a 15kHz subcarrier interval ("numerology 1") differs from the NR frame structure for a normal CP with a 30kHz subcarrier interval ("numerology 2"). For a 15kHz subcarrier interval, the slot length is 1ms, while for a 30kHz subcarrier interval, the slot length is 0.5ms. The NR frame structure can offer greater flexibility than the LTE frame structure.

[0056] Another example of a frame structure is one used, for example, in 6G and later networks. In a flexible frame structure, a symbol block may be defined to have a width that is the minimum time width that can be scheduled in the flexible frame structure. A symbol block may be a unit of transmission having a redundant portion (e.g., a CP portion) and an informational portion (e.g., a data portion) which can be selected as appropriate. OFDM symbols are an example of a symbol block. Symbol blocks may also be referred to as symbols. Embodiments of a flexible frame structure include different parameters that may be configurable, such as frame length, subframe length, symbol block length, etc. In some embodiments of a flexible frame structure, possible configurable parameters include, exemplifyingly, frame length, subframe width, slot configuration, subcarrier spacing (SCS), flexible transmission width of the basic transmission unit, and flexible switch gap.

[0057] The frame length is not limited to 10ms, and may be configurable and variable over time. In some embodiments, each frame may include one or more downlink synchronous channels and / or one or more downlink broadcast channels, and each synchronous channel and / or broadcast channel may be transmitted in different directions by performing different beamforming. The frame length may be one or more feasible values ​​and may be set based on the application. For example, an autonomous vehicle may require relatively early initial access, in which case the frame length may be set to 5ms, as used in the autonomous vehicle application example. In another example, a smart meter in a house may not require early initial access, in which case the frame length may be set to 20ms, as used in the smart meter application example.

[0058] Subframes may or may not be defined in a flexible frame structure depending on the implementation. For example, a frame may be defined to include slots but not subframes. In a frame in which subframes are defined, the width of the subframe may be configurable, for example, to align in the time domain. For example, subframes may be configured to have lengths such as 0.1ms, 0.2ms, 0.5ms, 1ms, 2ms, or 5ms. In some embodiments, if a subframe is not needed in a particular situation, the subframe length may or may not be defined to be the same as the frame length.

[0059] Slots may or may not be defined in a flexible frame structure depending on the implementation. In frames where slots are defined, the method of defining the slots (e.g., the time width and / or number of symbol blocks) may be configurable. In one embodiment, the slot setting may be common to all ED110s or common to a group of ED110s. In this case, the slot setting information may be transmitted to the ED110s on a broadcast channel or one or more common control channels. In other embodiments, the slot setting may be specific to a UE, in which case the slot setting information may be transmitted on a control channel specific to the UE. In some embodiments, the slot setting signaling can be transmitted together with the frame setting signaling and / or the subframe setting signaling. In other embodiments, the slot setting may be transmitted independently of the frame setting signaling and / or the subframe setting signaling. Generally, the slot setting may be common to the system, common to a base station, common to a group of UEs, or specific to a UE.

[0060] The SCS may span from 15 kHz to 480 kHz. The SCS may vary depending on the spectral frequency and / or maximum UE speed to minimize the impact of Doppler shift and phase noise. In some examples, the transmit and receive frames are separate, and the SCS of the symbols in the receive frame structure may be set independently of the SCS of the symbols in the transmit frame structure. The SCS of the receive frame may be different from the SCS of the transmit frame. In some examples, the SCS of each transmit frame may be half the SCS of each receive frame. When the SCS of the receive and transmit frames are different, the difference does not necessarily have to be doubled, for example, when the inverse discrete Fourier transform (IDFT) is used instead of the fast fourier transform (FFT) to implement a more flexible symbol width. Other examples of frame structures can be used with various SCSs.

[0061] The basic transmission unit is a symbol block (also called a symbol), which generally includes a redundant portion (applied as a CP) and an informational portion (e.g., data). In some embodiments, the CP may be omitted from the symbol block. The CP length may be flexible and configurable. The CP length may be fixed within a frame, or it may be flexible within a frame, and in some cases the CP length may vary between a given frame and another, between a given group of frames and another, between a given subframe and another subframe, between a given slot and another slot, or dynamically between a given scheduling and another scheduling. The informational portion (e.g., data) may be flexible and configurable. Another possible parameter relating to the symbol block that can be defined is the ratio of the CP width to the informational (e.g., data) width. In some embodiments, the symbol block length may be adjusted according to channel conditions (e.g., multipath delay, Doppler) and / or latency requirements and / or available time width. As another example, the symbol block length may be adjusted to fit the available time width into the frame.

[0062] A frame may include both a downlink portion used for downlink transmission from RAN node 170 and an uplink portion used for uplink transmission from ED110. A gap may exist between each uplink and downlink portion, and this is referred to as a switching gap. The switching gap length (width) may be configurable. The switching gap width may be fixed within a frame or may be flexible within a frame, and in some cases the switching gap width may vary between a given frame and another frame, between a given group of frames and another group of frames, between a given subframe and another subframe, between a given slot and another slot, or dynamically between a given scheduling and another scheduling.

[0063] RAN nodes 170, such as base stations, may provide coverage across cells. Radio communication with devices may occur using one or more carrier frequencies. Carrier frequencies are referred to as carriers. Carriers may also be referred to as component carriers (CCs). Carriers may be characterized by their bandwidth and reference frequencies, such as the carrier's center frequency, minimum frequency, and maximum frequency. Carriers may be on the licensed spectrum or the unlicensed spectrum. Similarly or alternatively to the above, radio communication with devices may occur using one or more bandwidth parts (BWPs). For example, a carrier may have one or more BWPs. More generally, radio communication with devices may occur across a spectrum. A spectrum may have one or more carriers and / or one or more BWPs.

[0064] A cell may include one or more downlink resources and one or more optional uplink resources. A cell may include one or more uplink resources and one or more optional downlink resources. A cell may include both one or more downlink resources and one or more uplink resources. For example, a cell may include only one downlink carrier / BWP, only one uplink carrier / BWP, multiple downlink carriers / BWPs, multiple uplink carriers / BWPs, one downlink carrier / BWP and one uplink carrier / BWP, one downlink carrier / BWP and multiple uplink carriers / BWPs, multiple downlink carriers / BWPs and one uplink carrier / BWP, or multiple downlink carriers / BWPs and multiple uplink carriers / BWPs. In some embodiments, instead of or in addition to the above, a cell may include one or more sidelink resources including sidelink send and receive resources.

[0065] A BWP can be a set of consecutive or non-consecutive frequency subcarriers on a carrier, a set of consecutive or non-consecutive frequency subcarriers on multiple carriers, or a set of non-consecutive frequency subcarriers that may have one or more carriers.

[0066] In some embodiments, a carrier may have one or more BWPs, for example, a carrier with a bandwidth of 20 MHz and consisting of one BWP, or a carrier with a bandwidth of 80 MHz and consisting of two adjacent and consecutive BWPs. In other embodiments, a BWP may have one or more carriers, for example, a BWP may consist of two adjacent and consecutive carriers with a bandwidth of 40 MHz, each having a bandwidth of 20 MHz. In some embodiments, a BWP may comprise a plurality of non-contiguous spectral resources consisting of a plurality of non-contiguous carriers, the first of which may be in the mmW band, the second in the low band (e.g., the 2 GHz band), the third in the THz band (if any), and the fourth in the visible light band (if any). Resources in one carrier belonging to a BWP may be consecutive or non-contiguous. In some embodiments, a BWP has non-contiguous spectral resources on a single carrier.

[0067] Wireless communication may occur across the occupied bandwidth. The occupied bandwidth can be defined as the width of a frequency band such that, below the lower frequency and above the upper frequency, each average power emitted is equal to a specified proportion β / 2 of the total average transmitted power (for example, the value of β / 2 is 0.5%).

[0068] The carrier, BWP, or occupied bandwidth may be dynamically signaled by a network device (e.g., RAN node 170) with physical layer control signaling, such as a known downlink control channel (DCI), or quasi-statically signaled with radio resource control (RRC) signaling or media access control (MAC) layer signaling, for example, or may be predetermined based on the application, or determined by ED110 as a function of other parameters known by ED110, or fixed by a standard, for example.

[0069] In cellular communication networks, ED110 location information (hereinafter referred to as ED location information) is frequently used to improve various network performance metrics. Such performance metrics include, for example, capacity, agility, and efficiency. Such improvements may be achieved when network elements utilize the location, behavior, mobility patterns, etc., of the ED110, in situations where the wireless environment in which the ED110 operates is described by prior information.

[0070] A sensing system may be used to help collect ED attitude information, including the ED110's location in the global coordinate system, its velocity and direction of movement in the global coordinate system, orientation information, and information about the radio environment. "Location" is also referred to as "position," and these two terms may be used interchangeably in this specification. Examples of well-known sensing systems include RADAR (Radio Detection and Ranging) sensing systems and LIDAR (Light Detection and Ranging) sensing systems. While sensing systems can be separate from communication systems, it can be effective to collect information using an integrated system, which reduces not only the hardware (and cost) of the integrated system but also the time, frequency, and spatial resources required to perform both functions. However, using communication system hardware to perform sensing of ED attitude and environmental information is extremely difficult and remains an unresolved problem. The difficulty of this problem is related to factors such as the limited resolution of communication systems, the dynamism of the environment, and the enormous number of objects whose electromagnetic properties and positions are estimated.

[0071] Therefore, integrated sensing and communication (also referred to as integrated communication and sensing) is a desired function in both existing and future communication systems.

[0072] ED110 and RAN node 170, or all of them, may be sensing nodes in system 100. A sensing node is a network entity that performs sensing by transmitting and receiving sensing signals. A sensing node is a communication device that performs both communication and sensing. On the other hand, some sensing nodes may not perform communication and may be dedicated to sensing, unlike the above. Sensing agent 174 is an example of a sensing node dedicated to sensing. Unlike ED110 and BS170, sensing agent 174 does not transmit or receive communication signals. However, sensing agent 174 may communicate configuration information, sensing information, signaling information, and other information within the communication system 100. Sensing agent 174 may communicate with the core network 130 and communicate with the rest of the communication system 100 to convey information. For example, sensing agent 174 may determine the location of ED110a and transmit this information to base station 170a via the core network 130. Although only one sensing agent 174 is shown in Figure 2, any number of sensing agents may be implemented in the communication system 100. In some embodiments, one or more sensing agents may be implemented in one or more RANs 120.

[0073] A sensing node may combine sensing techniques with reference signal techniques to enhance the determination of the UE's attitude. This type of sensing node may also be referred to as a sensing management function (SMF). In some networks, the SMF may also be referred to as a location management function (LMF). The SMF may be implemented as a physically independent entity located in a core network 130 connected to multiple RAN nodes 170. In other aspects of this application, the SMF may be implemented as a logical entity coexisting within the RAN nodes 170 through logic performed by a processor 260.

[0074] As shown in Figure 5, when the SMF176 is implemented as a physically independent entity, it includes at least one processor 290, at least one transmitter 282, at least one receiver 284, one or more antennas 286, and at least one memory 288. Transceivers not shown may be used instead of the transmitter 282 and receiver 284. A scheduler 283 may be coupled to the processor 290. The scheduler 283 may be included within the SMF176 or may operate separately from the SMF176. The processor 290 performs various processing operations of the SMF176, such as signal coding, data processing, power control, input / output processing, and other functions. The processor 290 may also be configured to perform some or all of the functions and / or embodiments described in more detail above. Each processor 290 includes any suitable processing or computing device configured to perform one or more operations. Each processor 290 may include, for example, a microprocessor, microcontroller, digital signal processor, field-programmable gate array, or application-specific integrated circuit.

[0075] Attitude determination techniques using reference signals belong to the fundamental concept of "active" attitude estimation. In the fundamental concept of active attitude estimation, the source querying attitude information (e.g., ED110) participates in the process of determining the attitude of the query source. The query source may transmit or receive (or both) signals specific to the attitude determination process. Positioning techniques based on known Global Navigation Satellite Systems (GNSS), such as GPS, are other examples of the fundamental concept of active attitude estimation.

[0076] In contrast, radar-based sensing techniques, for example, can sometimes be considered to belong to the basic concept of "passive" attitude determination. In the basic concept of passive attitude determination, the target is unaware of the attitude determination process.

[0077] Integrating sensing and communication into a single system eliminates the need for the system to operate according to only one basic concept. Therefore, combining sensing techniques with reference signal techniques can enhance attitude determination.

[0078] Enhanced attitude determination may include, for example, acquiring UE channel subspace information, which is particularly useful for reconstructing UE channels at sensing nodes, and especially for beam-based operation and communication. The UE channel subspace is a subset of the entire algebraic space defined over the spatial domain in which the entire channel from TP to UE resides. Thus, the UE channel subspace defines the channel from TP to UE with very high accuracy. When signals are transmitted over other subspaces, their effect on the UE channel becomes negligible. Knowledge of the UE channel subspace helps reduce the effort required for channel measurement at the UE and channel reconstruction on the network side. Therefore, combining sensing techniques with reference signal techniques can enable UE channel reconstruction with much less overhead than conventional methods. Subspace information can also facilitate sensing using subspaces, reducing sensing complexity and improving sensing accuracy.

[0079] In some embodiments of integrated sensing and communication, the same radio access technology (RAT) is used for both sensing and communication. This avoids the need to multiplex two different RATs when a single carrier spectrum is used, or the requirement for two different carrier spectra for two different RATs.

[0080] In embodiments where sensing and communication are integrated using a single RAT, a first set of channels may be used to transmit sensing signals, and a second set of channels may be used to transmit communication signals. In some embodiments, each channel in the first set of channels and each channel in the second set of channels may be a logical channel, a transport channel, or a physical channel.

[0081] Communication and sensing may be performed at the physical layer via separate physical channels. For example, a first physical downlink shared channel PDSCH-C may be defined for data communication, and a second physical downlink shared channel PDSCH-S may be defined for sensing. Similarly, separate physical uplink shared channels (PUSCH) PUSCH-C and PUSCH-S may be defined for uplink communication and sensing.

[0082] In another example, the same PDSCH and PUSCH may be used for both communication and sensing, with separate logical layer channels and / or transport layer channels defined for communication and sensing. It should also be noted that one or more control channels and one or more data channels for sensing may have the same channel structure (format) or different channel structures (formats), and may occupy the same frequency band or bandwidth part or different frequency bands or bandwidth parts.

[0083] In yet another example, a common physical downlink control channel (PDCCH) and a common physical uplink control channel (PUCCH) may be used to carry control information for both sensing and communication. Alternatively, separate physical layer control channels may be used to carry separate control information for communication and sensing. For example, PUCCH-S and PUCCH-C may be used for uplink control of sensing and communication, respectively, and PDCCH-S and PDCCH-C may be used for downlink control of sensing and communication, respectively.

[0084] Different combinations of shared and dedicated channels for sensing and communication are possible at each of the physical, transport, and logical layers.

[0085] Terrestrial communication systems are also called land-based or ground-based communication systems, but similarly or alternatively, terrestrial communication systems can be implemented on or underwater. Non-terrestrial communication systems may fill gaps in coverage in underserved areas by extending the coverage of cellular networks through the use of non-terrestrial nodes. This is key to establishing global and seamless coverage and providing mobile broadband services to areas that are not served or are underserved. Currently, it is almost impossible to implement terrestrial access point / base station infrastructure in areas such as oceans, mountains, forests, and remote areas.

[0086] Terrestrial communication networks may be wireless communication networks using 5G technology and / or later generations of wireless technology (e.g., 6G and beyond). In some examples, terrestrial communication networks can also accommodate conventional wireless technologies (e.g., 3G and 4G wireless technologies). Non-terrestrial communication networks are communication networks using satellite constellations such as conventional geostationary (GEO) satellites, which utilize broadcast public / general content to local servers. Non-terrestrial communication networks may also be communication systems using low Earth orbit (LEO) satellites, which are known to establish a good balance between large coverage area and propagation path loss / delay. Non-terrestrial communication networks may also be communication networks using satellites stabilized with very low Earth orbit (VLEO) technology, which significantly reduces the cost of launching satellites into low Earth orbit. Non-terrestrial communication networks may also be communication networks using high-altitude platforms (HAPs), which are known to provide low-path-loss radio interfaces to users with limited power budgets. Non-terrestrial communication networks may also be communication systems using unmanned aerial vehicles (UAVs) (or unmanned aerial systems (UAS)) such as airborne aircraft, balloons, quadcopters, and drones, which can achieve high-density deployment because their coverage can be limited to local areas. In some examples, geostationary satellites, low-altitude satellites, UAVs, high-altitude access points (HAPs), and very low-altitude satellites (VLEOs) may be horizontal and two-dimensional. In some examples, UAVs, HAPs, and VLEOs may be combined to integrate satellite communications into a cellular network. Emerging 3D vertical networks consist of numerous mobile entities (other than geostationary satellites) and high-altitude access points such as UAVs, HAPs, and VLEOs.

[0087] MIMO technology allows a single signal transmission and reception to be performed using an antenna array of multiple antennas to meet the requirements for high transmission speeds. ED110 and RAN node 170, which are T-TRP and / or NT-TRP, may use MIMO to communicate using radio resource blocks. MIMO transmits radio resource blocks using parallel radio signals with multiple antennas at the transmitter. Therefore, multiple antennas may be used at the receiver. MIMO may perform beamforming on the parallel radio signals for reliable multipath transmission of radio resource blocks. MIMO may increase the data rate of radio resource blocks by concatenating parallel radio signals carrying different data.

[0088] In recent years, MIMO (Large-Scale MIMO) wireless communication networks with RAN nodes 170 that are T-TRP and / or NT-TRP, configured using a large number of antennas, have attracted widespread attention from academia and industry. In large-scale MIMO systems, RAN nodes 170 that are T-TRP and / or NT-TRP typically consist of more than 10 antenna units (see antennas 256 and 280 in Figure 3). Typically, RAN nodes 170 that are T-TRP and / or NT-TRP can operate to serve tens (e.g., 40) ED110s. The large number of antenna units in RAN nodes 170 that are T-TRP and / or NT-TRP significantly increases the spatial degrees of freedom in wireless communication, greatly improving transmission speed, spectral efficiency and power efficiency, and greatly reducing interference between cells. Increasing the number of antennas allows for a reduction in the size of each antenna unit while keeping costs down. By utilizing the spatial degrees of freedom provided by the large-scale antenna unit, each cell's T-TRP RAN node 170 and NT-TRP RAN node 170 can communicate simultaneously with numerous ED110s within the cell using the same time-frequency resources, significantly increasing spectral efficiency. The presence of numerous antenna units for T-TRP RAN node 170 and / or NT-TRP RAN node 170 also allows for increased spatial directivity of each user's uplink and downlink transmissions, thereby reducing the transmit power of T-TRP RAN node 170 and / or NT-TRP RAN node 170 and ED110s, and consequently increasing power efficiency. If the number of antennas for RAN node 170 which is T-TRP and / or RAN node 170 which is NT-TRP is sufficiently large, the random channels between each ED110 and RAN node 170 which is T-TRP and / or RAN node 170 which is NT-TRP can approach an orthogonal state in which interference and noise effects between the cell and the user can be reduced.Due to the various effects described above, large-scale MIMO has great potential for applications.

[0089] A MIMO system may include a receiver connected to a receiving (Rx) antenna, a transmitter connected to a transmitting (Tx) antenna, and a signal processor connected to both the transmitter and receiver. Each of the Rx and Tx antennas may include multiple antennas. For example, the Rx antenna may have a uniform linear array (ULA) antenna in which multiple antennas are arranged in a line at equal intervals. When a radio frequency (RF) signal is transmitted through the Tx antenna, the Rx antenna may receive the signal reflected back from a target in front of it.

[0090] Possible parts or possible configurable parameters or those present in some embodiments of the MIMO system include panels and beams.

[0091] A panel is a portion of an antenna group, antenna array, or antenna sub-array, and this portion can individually control the Tx beam or Rx beam.

[0092] A beam may be formed by performing amplitude and / or phase weighting on data transmitted or received by at least one antenna port. The beam may be formed by other means, for example, by adjusting the relevant parameters of the antenna unit. The beam may include a Tx beam and / or an Rx beam. The transmit beam refers to the distribution of signal intensity formed in various directions in space after the signal has been transmitted through the antenna. The receive beam is the signal intensity of the radio signal received from the antenna, and refers to the distribution of signal intensity in different directions in space. The beam information may include a beam identifier, one or more antenna port identifiers, a channel state information reference signal (CSI-RS) resource identifier, an SSB resource identifier, a sounding reference signal (SRS) resource identifier, and other reference signal resource identifiers.

[0093] A DNN trained to perform various tasks such as computer vision tasks, natural language processing tasks, and speech recognition tasks may be hosted on a remote computing system, such as a cloud computing system. ED110 may communicate with such a remote computing system via a next-generation communication system, such as the communication system 100 shown in Figures 1 and 2, to access the DNN hosted on the remote computing system. In a typical scenario shown in Figure 6, an application working on ED110 generates a request to a DNN 650 hosted on computing system 600, and ED110 sends a radio transmission 601 to the DNN 650 hosted on computing system 600 (i.e., deployed and working on computing system 600), requesting it to perform inference on the input data included in the request. The DNN 650 is configured to perform a specific task (for example, it is trained to perform a specific task such as a computer vision task, a speech signal processing task, or a natural language processing task). If the request specifies that the DNN 650 should perform inference on the input data included in the request, the request sent by ED110 may be referred to as an "inference request". An inference request may include input data. When RAN node 170 receives a radio transmission 601 containing the inference request using the radio / radio interface 630, RAN node 170 transmits another transmission 602 containing the inference request to the computing system 600 hosting the DNN 650. RAN node 170 may transmit this other transmission 602 directly to the computing system 600 via the core network 130, or it may transmit it to the core network 130 and then transmit it via the internet 150, which then forwards the other transmission 602 to the computing system 600. As shown in Figures 1 and 2, the core network 130 may be connected to the computing system 600 via the internet 150.

[0094] Figure 6 shows how DNN650 is hosted on a computing system 600 that is directly connected to the core network 130 (or indirectly via the Internet 150); however, in the communication system 100, DNN650 may be hosted on other types of computing systems. For example, DNN650 may be hosted on one or more edge nodes, in which case one or more edge nodes would be located near and connected to the RAN node 170. Alternatively, DNN650 may be hosted on the computing system of the RAN node 170 (i.e., deployed and operating on the computing system of the RAN node 170).

[0095] Although only one DNN650 is shown in Figure 6, the computing system 600 may host multiple DNNs, in which case each DNN may be configured (i.e., trained) to perform a different task.

[0096] When another transmission 602 containing the inference request is received by the computing system 600 hosting the DNN650, the input data included in the inference request may be queued by the DNN650. The DNN650 then makes the inference request (i.e., performs inference using the input data included in the inference request). Once the DNN650 completes the inference, the DNN650 outputs the inference data. The inference data may include predicted values ​​generated by the DNN650 based on the input data. The computing system 600 sends a backbone transmission 603 containing the inference response to the RAN node 170 associated with the requesting ED110 via the core network 130 (or via a combination of the internet 150 and the core network 130). The RAN node 170 then sends a radio transmission 604 containing the inference response to the ED110 using radio waves 630.

[0097] It can be seen that the typical scenario described above has at least one flaw in that the reliability of the inference response contained in the wireless transmission 604 received by ED110 from RAN node 170, or the inference response contained in the backbone transmission 603 received by RAN node 170 from computing system 600 hosting DNN650, is not guaranteed.

[0098] Conventional communication systems are known to establish secure, reliable, and even trustworthy transmissions using radio waves 630 and transmissions within the core network 130. Such known secure and reliable transmissions do not help to ensure the reliability of the input data included in the inference request and the inference data received in the inference response generated and output by the DNN650.

[0099] As can be seen in Figure 6, it is noteworthy that inference requests originating from ED110 and destined for DNN650 are vulnerable to two main types of malicious attacks. A Type I malicious attack can be defined as one relating to malicious operation of DNN650 or to the tampering of either transmission 601 or 602 containing the inference request, while a Type II malicious attack can be defined as one relating to the tampering of either transmission 603 or 604 containing the inference response. To protect against both Type I and Type II malicious attacks, this specification proposes establishing a method for ensuring the reliability of inference requests and inference responses in the communication system connecting ED110, RAN node 170 (edge ​​compute node), and computing system 600 hosting DNN650. In one embodiment, the method for ensuring reliability involves establishing a level of confidence that the input data received by DNN650 is the same as the input data transmitted by ED110. In another embodiment, a method for ensuring reliability involves establishing a confidence level that the inference data received by ED110 is the same as the inference data generated by DNN650.

[0100] Unfortunately, the reliability of the inference data contained in the inference responses received wirelessly from RAN node 170 has received little attention. By default, the computing system 600 hosting DNN650 requires an unconditional grant of confidence in the inference responses. That is, it is expected that the end user will be confident that the inference data indirectly received from the computing system 600 hosting DNN650 is the result of DNN650 performing inference on specific input data provided to DNN650 by the end user. Such an unconditional grant of confidence poses a significant potential security problem in the future wireless society. In the near future, it is expected that high-density IoT-UEs, such as autonomous vehicles and components of industrial automation plants connected to the RAN 120 of communication system 100, will permeate various industries. It is quite foreseeable that a malicious attack on DNN650 could cause widespread disruption. Of course, there is no guarantee that the computing system 600 hosting DNN650 will not act rashly for economic gain, and therefore, it will have an effect similar to a malicious attack. Such simplistic behavior involves, for example, a malicious provider of a cloud computing system that offers access to the DNN650 as a service, arranging for the DNN650 to generate and output a corresponding inference response that includes inference data unrelated to the received input data.

[0101] In addition to reliability and privacy protection issues from the perspective of ED110, there are similar issues from the perspective of DNN650. If a third party intercepts a sufficient number of pairs of inference requests contained in transmission 602 sent to the computing system 600 hosting DNN650 and inference responses contained in transmission 603 sent by the computing system 600 hosting DNN650, the third party can use the input data contained in the inference requests and the inference data contained in the inference responses to construct (i.e., train) their own DNN to be similar to DNN650.

[0102] In general, aspects of this application relate to reliability assurance methods. Reliability assurance methods include evaluating the reliability of inference responses received from a computing system 600 hosting a DNN 650 via transmission in a communication system. Usefully, aspects of this application relate to preventing the theft of inference requests contained in transmissions 601, 602 and inference responses contained in transmissions 603, 604, and to preventing malicious attacks against these inference responses.

[0103] In the case of an inference job, the requesting ED110 sends one or more inference requests to the DNN650 via the RAN node 170 to the computing system 600 hosting the DNN650, the DNN650 generates an inference response corresponding to each inference request, and the inference responses are sent back to the ED110 by the computing system 600 via the core network 130 and the RAN node 170 (or the Internet 150, the core network 130 and the RAN node 170). It can be understood that the inference request includes both a control header and input data, and other information as appropriate. The inference request may be sent over one or more uplink transmission intervals. For example, if the inference request includes high-definition video, the video frames may be sent over multiple source blocks using multiple codewords, which may be sent over multiple uplink transmission intervals. As another example, if the inference request includes simple text, the inference request may be sent over one source block using one codeword during one uplink transmission interval.

[0104] There are privacy concerns regarding inference requests and inference responses. These inference requests and responses are contained within wireless transmissions 601 and 604, respectively, transmitted between ED110 and RAN node 170 using radio waves 630. They are also contained within transmissions 602 and 603, respectively, transmitted between RAN node 170 and computing system 600 hosting DNN650 via the core network 130 or via the core network 130 and the internet 150. Therefore, malicious attacks, including hacking, eavesdropping, tampering, substitution, and blocking, could potentially target wireless transmissions 601, 604 or transmissions 602, 603.

[0105] There are also concerns about the theft of raw data, i.e., input data included in inference requests. For example, if the ED110 is an autonomous vehicle, the video data generated by the digital camera mounted on the autonomous vehicle forms the basis of the input data used for pedestrian detection inference. The video data generated by the camera may contain personal data. In such cases, it may be undesirable for the video data to be obtained by a third party. This is a particular concern if a third party can also access the predicted values ​​(e.g., inference data) included in the inference response generated and output by the DNN650 in response to the inference request. If a third party can access the input data provided to the DNN650 and the inference data output by the DNN650 on numerous occasions, a third party may at some point think that a sufficient number of pairs of inference requests and inference responses have been accumulated to form a new training dataset with training data samples, each training data sample containing the input data and inference data of the inference request and inference response pair. It is clear that the accumulated pairs are not the same pairs that formed the training dataset used to train the cloud-based DNN650. On the other hand, there is a risk that a third party could train a malicious DNN using a new training dataset and a machine learning algorithm so that it has the same parameters and performance as DNN650.

[0106] Theoretically, ED110 can store multiple pairs of inference requests and inference responses. However, it is considered rare and difficult for ED110 to successfully store a sufficient number of inference request-response pairs from a targeted DNN, such as DNN650, with a reasonable amount of diversity, in order to train a DNN that successfully mimics the targeted DNN. Since RAN node 170 can communicate with a large number of different ED110s and computing system 600 hosting DNN650, it is considered that the number and diversity of inference request-response pairs that can be stored at RAN node 170 may be sufficient to successfully train a malicious DNN substantially similar to DNN650.

[0107] Aspects of this application relate to the use of reliability assurance methods to address the concerns described above. However, the reliability assurance methods of this disclosure may result in the performance of some extraneous computations on inference responses transmitted using the communication system 100. The computing resources of ED110, in particular, of ED110 ("IOT-UE") which is an IoT device, may be limited. Therefore, in some embodiments of this application, an edge computing system (for example, a computing system including a large amount of computing resources (e.g., memory and processing resources), or a RAN node 170 equipped with a computing system including a large amount of computing resources connected to the RAN node 170) may perform the reliability assurance methods of this disclosure.

[0108] Consider an example where ED110 communicates with a computing system 600 hosting DNN650 via a communication system 100. ED110 sends a radio transmission 601 containing an inference request for DNN650 to a RAN node 170. The inference request for DNN650 includes input data X and information that enables the identification of DNN650 at the RAN node 170. The inference request may include more than just input data X and information that enables the identification of DNN650. Naturally, the inference request will include one or more control headers, and in some cases, other parts related to DNN650, such as the current precision of the input if dynamic precision is allowed, support for early termination if early termination is allowed, and latency priority. The RAN node 170 receives radio transmission 601, retrieves the inference request from radio transmission 601, and sends another transmission 602 containing the inference request to the computing system 600 hosting DNN650 via the core network 130 and / or the internet 150. Another transmission 602 containing the inference request may be transmitted, for example, across several backbone connections within the core network 130 and several connections within the internet 150. Upon receiving yet another transmission 602, the computing system 600 hosting the DNN650 may add the inference request to the DNN650's service queue. After the DNN650 has served the inference request (i.e., after the DNN650 has completed the inference on the input data X contained in the inference request and generated the inference data Y), the DNN650 generates and outputs an inference response to the inference request. The inference response contains the inference data Y. The DNN650 provides the inference response to the computing system 600, and the computing system 600 transmits the inference response to the ED110. The inference response is sent to ED110 in two transmissions: the first transmission is a backbone transmission 603 from the computing system 600 hosting DNN650 to the RAN node 170 via the core network 130 and / or the internet 150; and the second transmission is a radio transmission 604 from the RAN node 170 to ED110.It is obvious that the inference response will contain more than just the inference data Y generated by the DNN650 based on the input data X. It is also obvious that the inference response will contain one or more control headers, and possibly other parts that point to the ED110 to which the inference response is to be sent.

[0109] Referring again to Figure 6, malicious attacks may occur against transmissions 601 and 602 containing inference requests that include input data X, transmissions 603 and 604 containing inference responses that include inference data Y, and DNN650. A malicious attack against transmissions 601 and 602 containing inference requests that include input data X could delete, alter, poison, eavesdrop on, or replace the input data X contained in the inference requests. Similarly, a malicious attack against transmissions 603 and 604 containing inference responses that include inference data Y could delete, alter, poison, eavesdrop on, or even replace the inference data Y. Another malicious attack may be attempted by establishing an illegitimate DNN in place of the legitimate DNN650, thereby allowing access to the illegitimate DNN, or by attempting phishing attacks against individuals in administrative roles related to the computing system 600 hosting DNN650. A malicious attack on DNN650 might appear to generate and output an inference response based on input data X, but in reality, DNN650 might generate and output random noise instead of appropriate inference data Y for input data X. Alternatively, a malicious attack on DNN650 could result in its compromise, causing it to multicast a single inference response to several ED110s that had sent inference requests to DNN650 containing separate input data X. One economic and competitive motive for a DNN650 provider (e.g., a provider of the computing system hosting DNN650) to carry out such a malicious attack is related to the fact that DNN650 may require a large amount of computational resources (e.g., memory and processing resources) for inference (i.e., to perform the operations of DNN650), and therefore the computing system 600 hosting DNN650 may consume a large amount of energy when performing inference.All of the above possible malicious attacks will result in a malicious reasoning response.

[0110] Future communication networks have the potential to provide reliable services, namely DNNs that perform specific tasks as a service, to a large number of IoT EDs (also known as "IoT devices"). It is easy to understand that malicious attacks can exacerbate security risks, potentially causing significant social and economic damage.

[0111] The IOT ED is expected to be a low-power, low-cost device that lacks the hardware and power to constantly run complex assurance algorithms to counter malicious attacks. Therefore, the IOT ED may be configured to rely on the RAN node 170 not only to filter out malicious inference responses but also as a last resort to protect the privacy of inference requests and corresponding inference responses. Conveniently, future RAN nodes 170 are expected to have the computational and memory resources suitable for a typical RAN node 170 to function as an edge computing system. However, future RAN nodes 170 are not expected to have the computational resources to compute DNNs or the memory resources suitable for storing DNNs that may have billions or even trillions of parameters.

[0112] As described above, a potential concern for a computing system (e.g., computing system 600) hosting a DNN (e.g., DNN650) and providing access to it as a service is theft of the DNN. If a third party succeeds in eavesdropping on a transmission containing an inference request and a transmission containing an inference response containing inference data generated by the DNN (e.g., DNN650) in response to the inference request, the third party can accumulate enough training data samples to enable them to engage in DNN theft by recreating or training a new DNN similar to the DNN (e.g., DNN650).

[0113] The reliability of an ED (e.g., ED110) accessing a DNN (e.g., DNN650) hosted on a computing system (e.g., computing system 600) involves three entities: ED110, RAN node 170, and the DNN on the computing system (e.g., DNN650 hosted on computing system 600). RAN node 170 may be equipped with sufficiently powerful computing resources and may be referred to as an "edge computing node." It can be shown that ED110 is low energy and low cost, yet benefits from reliability assurance against malicious attacks and privacy protection against eavesdropping and interception of communications related to inference jobs (e.g., transmits 601, 602). It can be shown that a computing system (e.g., computing system 600) hosting the DNN (e.g., DNN650) and providing access to it as a service benefits from preventing the theft of the DNN through interception of transmits related to DNN training.

[0114] Aspects of this application relate to using coding theory to provide a reliability assurance method for ensuring both that the input data X included in an inference request transmitted from ED110 to a computing system hosting DNN650 is reliable, and that the inference data Y included in an inference response transmitted from the computing system hosting DNN650 to ED110 is reliable.

[0115] Figure 7A shows ED110, a component that is partially responsible for processing inference requests 700 using code theory to ensure that the input data X(704) contained in the inference request 700 sent to the computing system 600 by ED110 is trustworthy. The inference request to DNN650 is generated by an application working in ED110 that requests inference on the input data X(704). The inference request 700 to DNN650 is shown as including an inference request control header 702 and the input data X(704), and including other information 706 as appropriate. The input data X(704) may be an integer or a floating-point number. As shown in Figure 7A, the media access control (MAC) layer 710 of ED110 includes a reshaper 712, a trust-specific encoder 714, and a source encoder 720. The physical (PHY) layer 720 of ED110 includes a source encoder 722 and a channel encoder 724.

[0116] The input data X(704) included in the inference request 700 to DNN650 is provided to the reshaper 712, and the reshaper 712 processes the input data X(704) to create the input data vector X * (742) is generated. In Figure 7A, the input data vector X * (742) is shown as the output of the reshaper 712. If the input data X (704) is an integer or floating point, the input data vector X * (742) is also expected to be an integer or a floating-point number.

[0117] In addition to the input data X(704) being an integer or floating-point number, the input data X(704) may also be multidimensional. For example, the input data X(704) is image data corresponding to an image. In this case, the example of input data X(704) is two-dimensional, where each pixel of the image is represented by an integer value. Another example of input data X(704) is text-based (for example, one-hot encoding of words in a sentence). In this case, the example of input data X(704) is a one-dimensional vector, where each word in the one-dimensional vector is one-hot encoded.

[0118] Figure 7A shows the encoded input vector 744 as the output of the reliability-specific encoder 714. Input data vector X * If (742) is an integer or a floating-point number, then the encoded input data vector (744) is also expected to be an integer or a floating-point number.

[0119] The reliability-specific encoder 714 may add some coding redundancy to the encoded input vector 744, in which case the input data vector X by the reliability-specific encoder 714 * It can be shown that the processing in (742) improves the robustness of transmission.

[0120] After the reliability-specific encoder 714 generates an encoded input vector 744, the MAC layer 710 of ED100 reconstructs an encoded inference request 708 containing a control header 702, the encoded input vector (744), and other information 706. The encoded inference request 708 is passed to the source encoder 722, which processes the encoded inference request 708. The output of the source encoder 722 is a source block 746. The source encoder 722 may apply quantization and add compression to the inference request. Therefore, the source block 746 is expected to be binary. The source encoder 722 may also divide the inference request into multiple binary source blocks 746. That is, the output of the source encoder 722 may be multiple source blocks 746.

[0121] Subsequently, source block 726 is passed to channel encoder 724 in PHY layer 720. Channel encoder 720 processes each source block 746 to protect each source block 746 from adversarial radio channels or adversarial wired channels. The output of channel encoder 724 is (binary) codeword 748, which is transmitted by ED110 as radio transmission 901 (see Figure 9).

[0122] In some aspects of this disclosure, the reliability encoder 714 may be implemented in the MAC layer of the RAN node 170. In such aspects of this disclosure, an inference request 700 is provided to the source encoder 722, which generates a source block as described above. The source block 746 is provided to the channel encoder, which generates a codeword 748 as described above. The RAN node 170 receives the codeword 748, decodes the codeword 748 using a channel decoder (not shown) to obtain the source block 746, and decodes the source block 746 to obtain the input data vector 742. The RAN node 170 may store the input data vector 742 in memory. The input data vector 742 is then received by the reliability encoder 714 implemented in the MAC layer of the RAN node 170 to generate an encoded input data vector 744. Subsequently, the RAN node 170 regenerates the encoded inference request 708, which includes the control header 702, the encoded input data vector 744, and other information 706, and sends the encoded inference request 708 to the computing system 600 via transmit 902 (see Figure 9).

[0123] Figure 8A shows the components of the computing system 600 and RAN node 170, which are partially responsible for processing the inference response 800 generated and output by the DNN650. The illustrated inference response 800 includes a response control header 802 and inference data Y(804) generated by the DNN650, and may also include other information 806 as appropriate. The inference data Y(804) may be an integer or a floating-point number. The reshaper 812 and reliability-specific encoder 814 shown in Figure 8A are implemented in the computing system 600 hosting the DNN650. The MAC layer 810 and PHY layer 820 are implemented in the RAN node 170. The MAC layer 810 implemented in the RAN node 170 includes a source encoder 822. The PHY layer 820 implemented in the RAN node 170 includes a channel encoder 824.

[0124] In Figure 8A, the inference data vector Y is shown as the output of the reshaper 812. * (842) is shown. If the inference data Y(804) is an integer or floating point, the inference data vector Y * (842) is also expected to be an integer or a floating-point number.

[0125] Figure 8A shows the encoded inference data vector W(844) as the output of the reliability-specific encoder 814. Inference data vector Y * If (842) is an integer or a floating-point number, then the encoded inference data vector W(844) is also expected to be an integer or a floating-point number.

[0126] As described later, the purpose of the trust-specific encoder 814 includes enabling ED110 or RAN node 170 to detect malicious inference responses and protecting user privacy.

[0127] The encoded inference data vector W(844) is processed by the source encoder 822 on RAN node 170. After processing, the output of the source encoder 822 is source block 846. The source encoder 822 may also operate to apply quantization and add compression to the inference response containing the encoded output vector 844. Therefore, the source block 846 is expected to be binary. The source encoder 822 may also operate to split the encoded output vector W(844) into multiple binary source blocks 846. That is, the output of the source encoder 822 may be multiple source blocks 846.

[0128] A channel encoder 824 in the PHY layer 820 of the RAN node processes each source block 846 to protect the source block 846 from a hostile wireless channel or a hostile wired channel. The output of the channel encoder 824 is a (binary) codeword 848. This is the codeword 848 that is transmitted 904 (see FIG. 9) as a transmission to the ED 110 by the computing system 600 that hosts the DNN 650, as will be described in more detail later.

[0129] Referring to FIG. 7B, components of the ED 110 that are partly responsible for processing the encoded inference response 800 are shown. As shown in FIG. 7B, the ED 110 receives the codeword 848 and decodes it using the channel decoder 750 of the PHY layer 710 to generate one or more source blocks 846. The channel decoder 750 performs an operation inverse to that of the channel encoder 824 to generate one or more source blocks 846. The channel decoder 750 outputs one or more source blocks 846, and the one or more source blocks 846 are provided to the source decoder 752 of the MAC layer 710 of the ED 110. The source decoder 752 of the MAC layer 710 of the ED 110 performs an operation inverse to that of the source encoder 822 to generate the encoded inference data vector W(844), outputs the encoded inference data vector W(844), and the encoded inference data vector W(844) is provided to the reliability-specific decoder 754 of the MAC layer 710 of the ED 110. The reliability-specific decoder 754 of the MAC layer 710 of the ED 110 performs an operation inverse to that of the reliability-specific encoder 814 to generate the inference data vector Y * (842), and outputs the inference data vector Y * (842). Thereafter, the inference data vector is provided to the reshaper 756 of the MAC layer 710 of the ED 110. The reshaper 756 of the MAC layer 710 of the ED 110 performs an operation inverse to that of the reshaper 812 to reshape the inference data vector Y * (8-byte) into the inference data Y(804). The inference data Y(804) is passed to the application of the ED 110 that generated the inference request 700.

[0130] Referring to Figure 8B, the components of the computing system 600 are partially responsible for processing the encoded inference request 708 as illustrated. As shown in Figure 8B, the computing system 600 receives the encoded inference request 708. The computing system 600 includes a reliability-specific decoder 850 that performs the inverse operation of the reliability-specific encoder 714. The reliability-specific decoder 850 receives an encoded input data vector Z(744) and, based on the input data vector Z(744), generates an input data vector X * (744) is generated, and the input data vector X * Output (744). The computing system 600 also includes a reshaper 852 that performs the reverse operation of reshaper 712. Reshaper 852 processes the input data vector X * (744) is received, input data vector X * Based on (744), input data X(704) is generated and input data X(704) is output. The computing system then uses the control header 702 and the encoded inference request 708 and other information from input data X(704) to form an inference request 700. The inference request 700 is then provided to the DNN650 for inference.

[0131] In particular, as mentioned above, a given malicious attack can be classified into one of two types: a Type I malicious attack or a Type II malicious attack. A reliability assurance method may include both Type I and Type II assurances. A Type I assurance may be understood to include verifying that the inference data Y(804) is derived from the input data X(704). A Type II assurance may be understood to include verifying the integrity of the inference data Y(804).

[0132] Aspects of this application relate to the application of a linear block code by the ED110's trust-specific encoder 714 to the input data vector 742, and by the application of a linear block code by the DNN650's trust-specific encoder 814 to the inference data vector (842). The linear block code not only supports reliability assurance against Type I and Type II malicious attacks, but also protects the privacy of the input data X, the inference data Y, and the output from the DNN650.

[0133] It can be shown that, given sufficient redundancy injected by the linear block coding implemented by the reliability-specific encoders 714 / 814 and the implementation of a more strongly desired decoding algorithm, the coding gain allows for a certain degree of channel erasure rate across the transmission medium, such as the radio / wave interface 630 or the core network 130, per transmission.

[0134] Type I malicious attacks have been defined above as relating to malicious operation of DNN650. DNN650 may also be defined as a deep neural network approximating a nonlinear function F(·) (hereinafter referred to as DNN650(F(·))). Type I malicious attacks have also been defined above as relating to tampering with one of the transmissions 601, 602 that contain an inference request containing input data X(704). A typical malicious attack on input data X(704) occurs against transmissions 601, 602 (see Figure 6) that contain an inference request 700. Transmissions 601, 602 that contain an inference request 700 include a wireless transmission 601 by ED110 to RAN node 170 and a wired transmission by RAN node 170 through the core network 130 to DNN650, or in particular, the computing system hosting DNN650 (including, in some cases, a transmission through the Internet 150).

[0135] Wireless transmissions containing inference request 700, which includes input data X(704), may be subjected to eavesdropping, poisoning, tampering, or substitution. A malicious attack on DNN650 can be said to be the generation of a malicious DNN650. For several economic reasons, a malicious DNN may not properly handle accepted inference requests by either returning random noise as an inference response or generating a single valid inference response and returning that single valid inference response in response to multiple inference requests received from separate ED110s.

[0136] To provide assurance against Type I malicious attacks, ED110 and RAN node 170 may be configured to determine whether inference data Y(804) is correct, where Y=F(X) for given input data X(704). The assurance may involve, for example, determining a confidence score for inference data Y(804) given input data X(704).

[0137] Type II malicious attacks have been defined above as those relating to malicious attacks against inference data Y(804). Typical malicious attacks against inference data Y(804) occur in the inference response transmission path. For example, the inference response transmission path may include transmission 603 using the core network 130 (possibly including the Internet 150) from the computing system hosting DNN650 to RAN node 170 associated with ED110, which sent the inference request to DNN650. In another example, the transmission path may include wireless transmission 604 using radio waves 630 from RAN node 170 to ED110. Hackers may eavesdrop on, poison, or tamper with transmissions 603, 604, which contain the inference response 800 containing the inference data Y(804). That is, a Type II malicious attack may involve a hacker altering a portion of the inference data Y(804).

[0138] To provide assurance against Type II malicious attacks, ED110 and RAN node 170 may operate to determine the reliability (i.e., integrity) of the inference data Y(804). The assurance may involve, for example, determining a reliability (i.e., integrity) score for the inference data Y(804). Note that determining the integrity score of the inference data Y(804) is independent of determining the inference data Y as a result of the input data X, for this reason that determining the inference data Y as a result of the input data X, as explained above, is the basis for assurance against Type I malicious attacks. Alternatively, assurance against Type II malicious attacks may involve assurance against tricks made by a malicious DNN that multicasts one valid inference response for each of several other inference requests. In particular, the reliability assurance against Type II malicious attacks is expected to allow valid inference data Y(804) to achieve a good score even if the inference data Y(804) fails the reliability assurance against Type I malicious attacks.

[0139] In addition to preventing two types of malicious attacks, data protection may be involved in achieving bidirectional trust. In aspects of this application, ED110 may be configured to expect that inference requests transmitted by ED110 and inference responses received by ED110 are coded to resist interception and eavesdropping. In aspects of this application, the computing system hosting the DNN may be configured to expect that all accepted inference requests and outgoing inference responses are also coded to resist interception and eavesdropping. From the perspective of ED110, such coding may be understood to relate to privacy protection, while from the perspective of DNN650, such coding may be understood to relate to the protection of DNN650 and the training dataset used to train DNN650.

[0140] In practice, it is unlikely that Type I reliability assurance, Type II reliability assurance, and protection of input data X(704) and inference data Y(804) will always be required together. Some measures may be taken to guarantee against Type I malicious attacks only, some measures may be taken to guarantee against Type I malicious attacks on inference requests only, some measures may be taken to guarantee against Type II malicious attacks only, and some measures may not consider data protection at all. In the following description, each reliability protocol will first be described separately. Then, various ways in which the protocols cooperate to provide a bidirectional reliability protocol will be described.

[0141] Reliability involves three entities: ED110, RAN node 170, and DNN650. A radio interface 630 connects ED110 and RAN node 170. A core network 130 connects RAN node 170 to the computing system 600 hosting the DNN, and the core network 130 may include connectivity via the Internet 150.

[0142] In aspects of this application, the reliability assurance method may operate in one of three modes: RAN node mode, ED / RAN node mode, and ED / RAN node / cloud mode. In RAN node mode, most of the assurance-related calculations are performed on RAN node 170. In ED / RAN node mode, assurance-related calculations are performed by both RAN node 170 and ED110, and transmissions between RAN node 170 and ED110 are coded. In ED / RAN node / cloud mode, assurance-related calculations are performed by ED110, RAN node 170, and DNN650, and all transmissions in ED / RAN node / cloud mode are coded. In aspects of this application, the reliability assurance protocol is sufficiently flexible to satisfy various reliability expectations and hardware conditions among the three entities.

[0143] Considering Figure 9 and the method of ensuring protection against a Type I malicious attack in RAN node mode, it is conceivable that ED110m sends an inference request to DNN650 to RAN node 170 for transmission to computing system 600 hosting DNN650. DNN650 is understood to be a trained DNN that approximates the nonlinear function F(·)(DNN650(F(·)). DNN650 is understood to perform its operation using the computing resources (e.g., infrastructure) of computing system 600. DNN650 is understood to be provided to ED110 as a service by computing system 600. The inference request, which includes the encoded input data vector 744, is transmitted via radio transmission (uplink) 901 and core network transmission 902 to computing system hosting DNN650. Provided to 600. RAN node 170 receives a radio transmission (uplink) 901 (e.g., codeword 748), decodes the received codeword 748 using a channel decoder (not shown) to obtain one or more source blocks 746, and then decodes the source blocks 746 using a source decoder (not shown) to obtain an inference request containing an encoded input data vector 744. RAN node 170 then transmits the inference request in core network transmission 902 to the computing system via the core network 130 and the internet 150.

[0144] The computing system 600 receives the core network transmission 902 containing the encoded inference request 708, processes the encoded inference request 708, and obtains the encoded input vector (744). The computing system 600 then decodes the encoded input data vector Z(744) using the reliability-specific decoder 850, which performs the reverse operation of the reliability encoder 714 described above (e.g., liner decoding) to obtain the input data vector

number

number

[0145] Input data X m After (704) is obtained by the computing system 600, the computing system 600 calls the DNN 650 and input data 704 (i.e., input data X m ) to inference data Y m (804) is provided to the DNN650, where Y m =F(X m )) is input data X m Based on (704). The computing system 600 hosting the DNN650 receives the control header 802 and the inference data vector generated by the reshaper 812.

number

[0146] In one aspect of this application, the first assurance protocol is that the inference data Y mThis concerns verifying whether the input is random noise or not. From classical information theory, a nonlinear function F(·) can be considered a nonlinear channel where the input is a random variable X and the output is another random variable Y. As a channel, a DNN650, which is thought to be trained to approximate the nonlinear function F(·), may be configured to provide a predetermined mutual information between the two random variables X and Y. The mutual information takes the form of channel capacitance and can be expressed as I(X;Y|F(·)). By recognizing the channel capacitance, the entity can detect that random noise was returned in response to a non-random noise input. That is, it is expected that there is a predetermined mutual information between the valid inference data Y(804) and the input data X(704).

[0147] Aspects of this application relate to determining a reliability score for inference data Y(804) received in an inference response generated by a DNN650 based on specific input data X(704). The score can be considered to relate to the range of mutual information found in the inference data Y(804), which indicates whether the inference data Y was randomly generated (low score) or appropriately generated by the DNN650 in response to receiving specific input data X (high score). An entity receiving the inference data Y(804) may measure the mutual information and compare the measured mutual information with a predetermined threshold. When the entity determines that the measured mutual information exceeds the threshold, it may consider the inference data Y(804) to be reliable.

[0148] However, DNN650 approximates the nonlinear function F(·) and the dimension l of the input data X(704) X And the dimension l of the inference data Y(804) Y and are usually different from each other (i.e., l X ≠l YTherefore, the nonlinear function F(·) is irreversible. Given this irreversibility, it can be seen that it is useful to construct an "inverse guaranteed DNN". A function G(·;θ) may be used to represent the inverse guaranteed DNN. The inverse guaranteed DNN may be constructed to enable the determination of a vector X', where X'=G(Y;θ)=G(F(X);θ), and θ represents the parameters of the inverse guaranteed DNN. It is preferable that the inverse guaranteed DNN (referred to herein as inverse guaranteed DNN G(·;θ)) is trained using the same dataset used to train DNN650 (referred to herein as DNN650(F(·))), but the training target θ * This relates to minimizing the squared error between X and X'. Training target θ * This can be determined from the following:

number

[0149] If the original training dataset is unavailable, an inverse-guaranteed DNN G(·;θ) can be trained using a training dataset artificially generated by a previously trained DNN F(·). It is expected that computing system 600, which hosts DNN650 and provides access to DNN650 as a service, will provide the parameters θ for the inverse-guaranteed DNN G(·;θ) corresponding to DNN650 that approximates the nonlinear function F(·). It should be noted that G(·;θ) is expected to be much smaller than F(·) because it is designed to measure the mutual information between X and Y. It is obvious that mutual information is a conceptual metric. In practice, the Euclidean distance may be used as the metric.

[0150] X m X represents the input data for the inference request to the DNN650 generated by ED110m, and Y is the input data X. mWe consider the inference data generated and output by the DNN650 based on (704) to be represented. Figure 12 shows an example of the steps for ensuring the reliability of the inference response from the perspective of the RAN node 170. The RAN node 170 receives a transmission 903 from the computing system 600 hosting the DNN650, which contains the inference response including the inference data vector 842 (step 1202). The RAN node 170 uses a reshaper 852 that performs the reverse operation of reshaper 812 to reshape the inference data vector Y * Input data X from (842) m Obtain inference data Y(804) for (704). Input data X is not randomly generated data for which inference data Y(804) is obtained. m To ensure whether or not the data is appropriate for (704) 、 RAN node 170 processes the acquired inference data Y(704) into an inverse-guaranteed DNN.

number

number

number

number

number

Number

Number

[0151] Even if the inverse guaranteed DNN G(·;θ) is much smaller than the DNN650(F(·)), it has been shown that this method may succeed in distinguishing between randomly generated data and the inference data Y (804) generated and output by the DNN650. As can be expected, it has been shown that there may be false negatives in the guarantee of the inference data Y (804), and the inference data Y * (842) obtained from is the appropriate inference data Y m but is not guaranteed as such. Similarly, as can be expected, it has been shown that there may be false positives in the guarantee of the inference data Y (804) obtained from the inference data vector Y * (842), and the obtained inference data Y (804) is not the appropriate inference data Y m but is guaranteed as such. The rates of false positives and false negatives may be adjusted by appropriately adjusting the threshold T1.

[0152] In particular, by operating to determine the architecture and parameters of the inverse guaranteed DNN(G(·;θ)), it can be shown that information regarding DNN650(F(·)) is not disclosed. This non-disclosure is considered important for the computing system 600 that hosts DNN650 and provides access to DNN650 as a service, as the information regarding DNN650(F(·)) may be considered intellectual property of the entity that owns the computing system hosting DNN650.

[0153] Nevertheless, it can be shown that using an inverse-guaranteed DNN (G(·;θ)) as described above may not work well if DNN650 is a so-called malicious DNN. Such a malicious DNN may multicast a single valid inference response when it receives multiple inference requests from multiple ED110s. For example, a malicious DNN may send an inference response to ED110m that actually contains inference data Y(704) belonging to another ED110n (Y=Y n and Y n =F(X n )). Incorrect inference data Y n Since the data is not randomly generated, invalid inference data may pass the guarantee check using an inverse-guaranteed DNN (G(·;θ)).

[0154] As a solution to this, a reliability-specific encoder 714 (see Figure 7A) may be introduced. In particular, the reliability-specific encoder 714 is sometimes referred to as a "transformer". The reliability-specific encoder 714 has dimension l Z ×l X The name is "U user An encoding matrix U may also be used. user The input data vector X user (742)l X The encoded input vector Z (a vector of ×1) userIt may be used to encode to (744), where Z user =U user ·X user (Z user The dimension is l Z (A vector that is ×1) Z ≧l X By establishing X user From Z user Information loss during encoding may be avoided. For a given ED110, a linear block encoding matrix U specific to the ED may be used. user A guarantee DNN specific to the ED may be established for the same ED100.

number

number

number

[0155] In particular, pairs

number

number

number

number

number

[0156] A pair unique to the user

number

[0157] ED110m sends a request to computing system 600 to request the DNN 650 hosted on the computing system 600 to perform inference (see step 1002, FIG. 10). In response to receiving a request for the DNN 650 to perform inference, RAN node 170 requests a user token from the DNN 650 (see step 1102, FIG. 11). The DNN 650 assigns a user token, e.g., token m, to ED110m, and the computing system 600 hosting the DNN 650 sends a pair

Number

Number

Number

Number

Number

[0158] ED110m sends an inference request to DNN650 to RAN node 170 (step 1004). The inference request is sent via radio transmission 901. The inference request to DNN650 is input data X m The input data vector generated by the ED110m reshaper 712 based on (704)

number

number

number

number

number

[0159] When the computing system 600 receives transmission 902 from RAN node 170 (step 1202, see Figure 12), it obtains an encoded inference request 708 to DNN650 from transmission 902 and uses the reliability-specific decoder 850, which performs the inverse operation of the reliability encoder 714 as described above, to encode the input vector Z m Decode (744), and here

number

number

number

number

number

number

number

number

number

number

[0160] When it is determined that the squared error exceeds a predetermined threshold (step 1208), that is,

number

[0161] Separately from the above, RAN node 170 may bypass the step of comparing the squared error with the threshold (step 1208). Instead, RAN node 170 will bypass the inference data vector Y * The received inference response, including (842), may be sent to ED110m (step 1210). The squared error value is part of the transmission of the inference response (step 1210).

number

number

[0162] The reliability assurance methods described with reference to Figures 8, 11, and 12 involve only the RAN node 170 and the computing system 600 hosting the DNN650. It should be noted that transmission 901 between ED110m and RAN node 170 (see Figure 9) may be vulnerable to malicious attacks if performed as a wireless transmission. For example, if an inference request is transmitted wirelessly from ED110m to the computing system 600 hosting the DNN650 via RAN node 170 using the radio interface 930, the radio interface 930 may be susceptible to eavesdropping or interception. Furthermore, even if the Type I assurance protocol is performed by RAN node 170, input data X m (Input data vector generated from 704 by reshaper 712)

number

[0163] As an example, an input data vector representing an image used for object detection by a DNN650 trained to perform object detection on an image.

number

number

number

number

number

number

number

number

number

[0164] Figure 13 shows an example of the steps for obtaining a guaranteed inference response from the perspective of ED110m. Figure 14 shows an example of the steps for handling an inference request from the perspective of RAN node 170.

[0165] To protect against malicious attacks (eavesdropping and / or tampering) on ​​inference requests contained in wireless transmissions 601 using the radio interface 630, aspects of this application include a reliability-specific encoder 714 of ED110 that uses the linear block encoding matrix U defined above. user Using linear block encoding matrices such as the above, input data vector

number

Number

[0166] As an operation preparation, ED110m sends a request for inference on the DNN650 (step 1302) to the computing system 600 hosting the DNN650 (see FIG. 13). In response to sending the inference request, the linear block encoding matrix U m is received by ED110m from the computing system 600 hosting the DNN650 (step 1304). In response to the inference request of the DNN650 from ED110m, the inverse-guaranteed DNN parameters

Number

[0167] Instead of ED110m sending the input data vector

Number

Number

Number

[0168] When the RAN node 170 receives the encoded inference request (step 1404), it creates a local copy of the encoded input vector Z m (744), and decodes the encoded input vector Z m (744) (step 1406) to obtain the input data vector

Number

Number

Number

[0169] As described above, RAN node 170 sends an inference request 602 to the computing system hosting DNN650 F(·) (step 1408). The inference request is input data vector 742 (i.e.)

number

[0170] When the RAN node 170 receives transmission 903 from the computing system 600 hosting the DNN650, which contains an inference response including an encoded inference data vector W(844) (see step 1202, Figure 12), the encoded inference data vector W(844) is decoded using the reliability decoder xxx, and the inference data vector Y * (842) is obtained. RAN node 170 is the inference data vector Y * (842) Inverse guaranteed DNN

number

number

number

number

number

[0171] When it is determined that the squared error exceeds a predetermined threshold (step 1208), that is,

number

[0172] l Z >l X In this case, the generalized linear block encoding matrix U user This is similar to the well-known linear block code known as "LDPC," an abbreviation for Low Dense Parity Check, which deals with binary vectors. In contrast, the linear block encoding matrix U user X is a non-binary input data vector. m Processing or binary input data vector X m It processes the linear block encoding matrix U. user is l Z -l X This represents a check parity matrix with redundancy. The non-binary input data vector X m Nevertheless, the LDPC code theory is still maintained.

[0173] l Zand l X (code length l) X and sign rate l X / l Z Given that ), LDPC has a large number of check matrices. This means that a computing system hosting DNN650 has a linear block encoding matrix U user This means there are no shortcomings when choosing this option.

[0174] The LDPC inspection matrix can be generated by several rules. The computing system 600 hosting the DNN650 is complete. Z ×l X Instead of sending a matrix, generate a user token and dimensional (l X and l Z All that is needed is to send information about some rules regarding ) to ED110 and RAN node 170, thereby the linear block encoding matrix U user It can be demonstrated that this not only significantly reduces the amount of information transmitted but also improves security.

[0175] Encoded input vector Z user The check matrix may be designed to be robust against adversarial radio channels (e.g., randomly erased and noisy). Encoded input vector Z user Even if some elements of the input vector Z are lost (i.e., attacked), RAN node 170 can still encode the input vector Z. user Decode (step 1406) the input data vector

number

[0176] Encoded input vector Z user When receiving across adversarial radio channels, the slowest decoding algorithm described above

number

[0177] In any appropriately selectable aspect of this application, as long as ED110m has sufficient computing power, ED110m is an inverse guaranteed DNN

number

number

number

number

number

[0178] Empirically speaking, if DNN650(F(·)) has billions of neurons, then the corresponding inverse guaranteed DNN

number

number

number

number

[0179] In the Type I guaranteed protocol described above, the input data vector within the core network 130

number

[0180] Therefore, RAN node 170 is each input data vector

number

number

number

[0181] To prevent this type of attack, an aspect of this application provides a linear block encoding matrix U to the RAN node 170. m Regarding the failure to notify. Linear block encoding matrix U m If this is not recognized, RAN node 170 will not be able to perform step 1406 of the method in Figure 14. That is, RAN node 170 will not be able to perform step 1406 of the method in Figure 14 based on the encoded inference request it receives. m (742) will no longer be obtainable. ED110m is the encoded input vector Z m The coded inference request, including the input data vector, is sent to RAN node 170 (step 1308 in Figure 13). RAN node 170 simply relays the coded inference request to DNN650.

number

number

number

[0182] The operation of ED110m in this scheme is consistent with the operation of ED110m in the above scheme shown in Figure 13. In preparation for operation, ED110m sends a request to the computing system hosting DNN650 so that DNN650 can perform inference (step 1302). In response to initialization, ED110m receives the linear block encoding matrix U from the computing system hosting DNN650. m Receive (Step 1304).

[0183] ED110m uses an input data vector in the inference request.

number

number

[0184] Figure 15 shows the linear block encoding matrix Um This shows an example of how to handle inference requests from the perspective of RAN node 170, which is not provided with access to the inverse guaranteed DNN. In response to the initialization of the inference service by ED110m (step 1302), RAN node 170 will be able to access the inverse guaranteed DNN.

number

[0185] As described above, the computing system 600 extracts the input data vector 742 (i.e., from the encoded input data vector ()

number

[0186] When RAN node 170 receives transmission 903 from computing system 600 hosting DNN650, which contains an inference response including the inference data vector 842 (i.e.), (see step 1202, Figure 12), the inference data vector 842(Y) is inversely guaranteed by DNN

number

number

number

number

number

[0187] When it is determined that the squared error exceeds a predetermined threshold (step 1208), that is,

number

[0188] From the above, it can be shown that the described assurance protocol works to verify the returned inference response against Type I malicious attacks and to protect the transmission of inference response vectors over both wireless and core network (Internet) connections. On the other hand, no assurance method has been established for the inference response vector. This is addressed as follows.

[0189] A theoretical hacker may attack the inference response contained in transmission 903 (see Figure 9) from the computing system hosting DNN650 to RAN node 170 in the following manner:

[0190] In one embodiment, a theoretical hacker may intercept the inference response vector and replace the intercepted inference response vector with a falsified inference response vector. This embodiment can be classified as a Type I malicious attack. Therefore, the Type I assurance protocol described above can be used to check for a falsified output data vector in terms of the mutual information between the input data vector and the output data vector.

[0191] In another embodiment, a theoretical hacker can modify the inference data vector Y such that a small (but key) portion of the inference data vector 842 is altered. * (842) may be tampered with. The tampered inference data vector may pass the Type I assurance test at RAN node 170. Thus the inference data vector Y contained in the inference response included in transmission 903 sent by computing system 600 hosting DNN650 * A Type II assurance method may be employed to detect the integrity of (842).

[0192] Besides information theory, DNNs can also be interpreted using topology theory. According to topology theory, there are several dominant topological patterns in the output of each layer of a DNN, including the output of the last layer. Such dominant, hidden, and persistent topological patterns are compared to fingerprints and the inference data vector Y * This may be used when considering the completeness of (842).

[0193] Aspects of this application relate to a Type II assurance method based on a topology pattern. The proposed Type II assurance method is intended to prevent a Type II malicious attack, that is, the method is intended to detect that a given output data vector has been tampered with. Similar to Type I assurance, according to aspects of this application, RAN node 170 has an inference data vector Y * (842) is configured to provide a Type II guarantee. The computing system 600 hosting the DNN650 recognizes the persistent topology pattern in the DNN650, and the entity that owns the computing system 600 hosting the DNN650 (also referred to as the "provider" of the computing system) provides a linear encoding matrix V(l W ×l Y ,l W >l Y It is expected that a linear encoding matrix V can be designed, and the inference data vector Y * (842) may be encoded to provide the encoded inference data vector W(844), where W = V·Y * The computing system 600 hosting the DNN650 provides a RAN node 170 of the linear encoding matrix V along with several Type II assurance rules.

[0194] Rules and procedures, WThis involves selecting specific dimensions of an encoded inference data vector W(844), which is a 1x vector, and grouping them into several groups. For example, the first group may contain the selected elements [w1, w3, w7], the second group may contain the selected elements [w3, w5], and the third group may contain the selected elements [w2, w9].

[0195] The rules and procedures include performing intra-group consistency checks to determine whether there is a strong correlation of consistency between elements within a group. For example, if the value of w1 is large, then the values ​​of w1 and w7 within the first group must also be large. If all groups pass the intra-group consistency checks, RAN node 170 will perform inter-group consistency checks.

[0196] Rules and procedures include performing intergroup consistency checks to determine whether the distribution of mean values ​​of elements in different groups is consistent with a known persistent pattern. For example, given a known persistent pattern, if the mean values ​​of elements in the second group are large, it is expected that the mean values ​​of elements in the third group will be small. Any inconsistency with the known persistent pattern will result in a failure of the intergroup consistency check.

[0197] Inference data vector Y * If (842) passes both the intragroup consistency check and the intergroup consistency check, then the inference data vector Y * RAN node 170 may determine that (842) passes the Type II guarantee. Note that passing the Type II guarantee is independent of passing the Type I guarantee. For example, a valid inference data vector determined by computing system 600 hosting DNN650 based on an inference request received from ED110n.

number

number

number

[0198] In some aspects of this application, a RAN node 170, combined with a computing system 600 hosting the ED110m and, if necessary, the DNN650, may implement only the Type I warranty described above. In other aspects of this application, the RAN node 170 may implement only the Type II warranty as described above. In a preferred aspect of this application, the RAN node 170 may implement both the Type I and Type II warranties.

[0199] The RAN node 170 may perform the two types of guarantees in parallel or sequentially. From a latency viewpoint, the parallel approach is preferred. From an energy saving viewpoint, the sequential approach is preferred. In a preferred embodiment of this application, the RAN node 170 performs the type II guarantee before performing the type I guarantee. In the type I guarantee, the inference data vector 842 (i.e., Y * ) inverse guaranteed DNN

number

[0200] The set of Type II guarantee rules is the encoding matrix V c The first rule related to this is W=V c • Y may be included. The second rule above applies to grouping table G c This relates to the grouping table, which points to the dimensions of the selected encoded inference data vector W(844) and the groups to which the selected dimensions are grouped.

[0201] The third rule above relates to the within-group reference distribution, correlation method, and threshold. The reference distribution of the i-th group is R i It may be written as follows: The distribution received by the i-th group is r i It may be written as follows: The received distribution r i and the reference distribution R i Similarity γ between i =corr i (r i ,R i ) as a measure of group correlation function corr i (r i ,R i ) may be used. Group correlation function corr i (r i ,R i There are various options for the threshold, such as the dot product or cosine distance. The threshold for the i-th group is T i It may be written as follows:

[0202] The fourth rule above relates to the intergroup reference distribution, correlation method, and threshold. The reference distribution of the mean for all groups is R g It may be written as follows. If there are L groups, the mean and reference distribution may be determined as a vector of length L, as shown below. R g =[avg(R1),avg(R2),…,avg(R L )]

[0203] The received distribution of the mean for all groups is r gIt may be written as follows. If there are L groups, the mean, the received distribution may be determined as a vector of length L, as follows: r g =[avg(r1),avg(r2),…,avg(r L )]

[0204] The received distribution r g and the reference distribution R g Similarity γ between g =corr g (r g ,R g The intergroup correlation function corr is used as a measure of ) g (r g ,R g ) may be used. Intergroup correlation function corr g (r g ,R g There are various options for the group threshold, such as the dot product or cosine distance. g It may be written as follows:

[0205] Inference data vector Y * A set of Type II assurance rules may be provided to RAN node 170 from the perspective of class (842). In practice, the computing system hosting DNN650 will inform RAN node 170 of several Type II assurance rules. Inference data vector Y * An inference type indicator may be provided to RAN node 170 in combination with provisioning (842). RAN node 170 may select a set of type II assurance rules based on the indicator, and then use the selected set of type II assurance rules to generate an inference data vector Y * (842) may be guaranteed.

[0206] An overview of the assurance is shown in Figure 16 as an example of the steps of the method. The assurance begins with RAN node 170 receiving multiple sets of Type II assurance rules from computing system 600 hosting DNN650 (step 1602). Naturally, each set of Type II assurance rules may be associated with result class c. Alternatively, the computing system hosting 650 may provide only one set of Type-II assurance rules. Inference data vector Y at RAN node 170 * The reception of (842) (step 1604) is associated with the reception of a result class c indicator from the computing system hosting the DNN650. Subsequently, the RAN node 170 may perform the type I assurance in one of the many ways described above (step 1606).

[0207] Next, RAN node 170 may perform the Type II assurance according to the example steps of the method for performing the Type II assurance protocol shown in Figure 17 (step 1608).

[0208] Based on the Class C indicator, RAN node 170 receives the inference data vector Y in step 1604 from RAN node memory 258 (see Figure 3). * A set of type II assurance rules to be used in (842) can be selected (step 1702). In particular, if the RAN node has received only a single set of type II assurance rules (step 1602), this selection (step 1702) may be skipped. Subsequently, the RAN node 170 obtains the encoding matrix V from the selected set of type II assurance rules. c Using the inference data vector Y * (842) can be encoded into the encoded output vector W(844) (step 1704), where W=V c ·Y. Subsequently, RAN node 170 obtains a grouping table G from a selected set of Type II assurance rules. cUsing this, groups can be formed from the encoded output vector W(844) (step 1706). Subsequently, RAN node 170 may perform an intragroup consistency check (Figure 18) (step 1708) and an intergroup consistency check (Figure 19) (step 1712).

[0209] Figure 18 shows an example of the steps for performing an intragroup consistency check (step 1708). The intragroup consistency check involves determining whether the values ​​of the intragroup correlation function, which is determined for each group, exceed the corresponding intragroup threshold for all groups.

[0210] In Figure 18, RAN node 170 selects group i (step 1802), and the value of the intragroup correlation function γ for the selected group is shown. i =corr i (r i ,R i ) is determined (step 1804). RAN node 170 determines the value of the intragroup correlation function γ. i and an appropriate threshold T i The RAN node 170 compares the following (step 1806). When the RAN node 170 determines that the value of the intragroup correlation function is above a threshold (step 1806), it determines whether all groups were selected or not (step 1808). When it determines that not all groups were selected (step 1808), the RAN node 170 selects yet another group (step 1802), and the process of determining (step 1804) and comparing (step 1806) for that yet another group is repeated. When it determines that the value of the intragroup correlation function is below a threshold (step 1806), the inference data vector Y * RAN node 170 may indicate that (842) failed the intragroup consistency check and therefore failed to meet the Type II guarantee.

[0211] When determining that the value of the intragroup correlation function exceeds the corresponding threshold for all groups (step 1806), the inference data vector Y *RAN node 170 may indicate that (842) has passed the intragroup consistency check.

[0212] Returning to Figure 17, the inference data vector Y * When (842) determines that the intragroup consistency check has failed (step 1710), the inference data vector Y * RAN node 170 may indicate that (842) failed the consistency check (step 1718). Inference data vector Y * When (842) determines that it has passed the intragroup consistency check (step 1710), RAN node 170 may then perform an intergroup consistency check (step 1712).

[0213] Figure 19 shows an example of the steps for performing the intergroup consistency check (step 1712). The intergroup consistency check involves determining whether the value of the intergroup correlation function exceeds a threshold.

[0214] In Figure 19, RAN node 170 is the value of the intergroup correlation function γ. g =corr g (r g ,R g ) is determined (step 1904). Then, RAN node 170 determines the value of the intergroup correlation function γ g and the intergroup threshold T g Compare the following (Step 1906). Value of the intergroup correlation function γ g The intergroup threshold T g When determining that it is less than (step 1906), the inference data vector Y * RAN node 170 may indicate that (842) failed the intergroup consistency check and therefore failed to meet the Type II guarantee. The value of the intergroup correlation function γ for all groups. g The inter-group threshold T g When determining that it exceeds (step 1906), the inference data vector Y * RAN node 170 may indicate that (842) has passed the intergroup consistency check.

[0215] Returning to Figure 17, the inference data vector Y * When (842) determines that the intergroup consistency check has failed (step 1714), the inference data vector Y * RAN node 170 may indicate that (842) failed the consistency check (step 1718). Inference data vector Y * When (842) determines that it has passed the intergroup consistency check (step 1714), the inference data vector Y * RAN node 170 may indicate that (842) has passed both consistency checks (step 1716).

[0216] Returning to Figure 16, the inference data vector Y * (842) is determined to have passed both the intragroup consistency check and the intergroup consistency check (step 1610), and the inference data vector Y * When (842) determines that it has passed the Type I guarantee (step 1612), the inference data vector Y * (842) indicates that the inference data vector Y has passed two types of guarantees. * (842) can be transmitted from RAN node 170 to ED110m (step 1614). Inference data vector Y * When (842) determines that the consistency check has failed (step 1610), the inference data vector Y * RAN node 170 may transmit something indicating that (842) could not be guaranteed (step 1616). Inference data vector Y * When (842) determines that the guarantee of type I has failed (step 1612), the inference data vector Y * RAN node 170 may send something indicating that it was not possible to guarantee (842) (step 1616).

[0217] In this embodiment of the application, the RAN node 170 does not compare the correlation value with the corresponding threshold (steps 1806, 1906), but instead generates L different intragroup correlation values ​​(γ1, γ2, ..., γ L Determine the (step 1804) and the group correlation value γ g Alternatively, the RAN node 170 may determine the correlation value and the corresponding threshold, leaving the task of comparing the correlation value and the corresponding threshold to ED110m. * (842) may also be transmitted to ED110m (step 1614).

[0218] In particular, Figure 17 shows that the intra-group consistency check (step 1708) occurs before the inter-group consistency check (step 1712). It will be obvious to those skilled in the art that the order of these two checks is not important to the results. Naturally, it can be shown that performing these two checks in parallel is superior in practice. It can be understood that such a parallel approach is suitable for implementation in computing systems that include one or more processors with multiple cores, such as GPUs.

[0219] The inference data vector Y included in transmission 903 (see Figure 9) from computing system 600 hosting DNN650 to RAN node 170. * As explained above, (842) could be vulnerable to a theoretical hacker attack. Similarly, the inference data vector Y contained in transmission 904 from RAN node 170 to ED110m (see Figure 9) * It is assumed that a theoretical hacker could potentially attack (842). Naturally, the inference data vector Y received from the computing system 600 hosting DNN650 * Even after the Type II guarantee of (842) is confirmed at RAN node 170, the inference data vector Y included in transmission 904 (see Figure 9) transmitted from RAN node 170 to ED110m using radio interface 630 is still valid. *(842) could be tampered with or otherwise altered by a theoretical hacker.

[0220] In operation, as part of the Type II assurance method described in relation to Figure 17, the RAN node 170 selects (step 1702) an encoding matrix V obtained from the set of Type II assurance rules. c Using this, the inference data vector Y received in step 1604 (Figure 16) * (842) is encoded as the inference data vector W(844), where W=V c It is explained that it may be encoded as Y (step 1704).

[0221] In accordance with the aspects of this application, when determining that the received inference data vector 842 is guaranteed (both type I and type II) (steps 1610 and 1612), the encoded inference vector W(844), where,

number

number

[0222] In Figure 16, the inference data vector Y * (842) indicates that the inference data vector Y has passed two types of guarantees. * (842) is sent from RAN node 170 to ED110m (step 1614). Guaranteed inference data vector.

number

[0223] Figure 20 shows the guaranteed encoded inference vector.

number

[0224] The method in Figure 20 begins with ED110m receiving multiple sets of Type II assurance rules from DNN650 (step 2002). Subsequently, ED110m receives the guaranteed encoded output vector W from RAN node 170. m It may receive something that points to result class c (step 2004). ED110m may select a set of type II guarantee rules based on result class c (step 2006). As described above, there may be only one set, in which case the selection step is eliminated. ED110m then receives the decoded guaranteed inference data vector.

number

number

number

number

number

[0225] In some aspects of this application, if the ED110m has sufficient computing power, the ED110m may take an example of the steps of the Type II assurance method shown in Figures 17, 18, and 19 when it receives the encoded inference vector (844) and result class c (step 2004) and decodes the inference data vector (842).

[0226] The output data vector 842(Y) is encoded into output vector 844, W=V c Unlike the method described in step 1704, which encodes Y into Y, an aspect of this application describes how the output data vector 842, Y m The encoded output vector 844, W m =V c ·Y m、 This concerns the encoding process performed by the DNN650. Subsequently, the DNN650 outputs the encoded output vector 844(W m It is expected that this will be sent to RAN node 170.

[0227] RAN node 170 encoded inference vector W m When (844) is received, the encoded inference vector W m Alternatively, we can decode (844) to obtain the inference data vector (844), where,

number

[0228] When determining that the inference data vector (842) is guaranteed, the RAN node 170 determines that the inference data vector Y m (842) may be sent to ED110m. Alternatively, the RAN node 170 may encode the inference data vector W as it was received by the RAN node 170 from DNN650. m You may send (844).

[0229] Encoding matrix V c Since this is a linear block encoding matrix, the decoding matrix is ​​at RAN node 170.

number

number

[0230] Encoding matrix V in RAN node 170 c If equipped, the inference data vector Y m Administrators of the computing system 600 hosting the DNN650 may be concerned about whether RAN node 170 has the ability to obtain (842). This configuration allows RAN node 170 to perform the Type I assurance method described herein above. Theoretically, encoding matrix V c (l W ×l Y ) is linear expansion (l W ≧l Y Therefore, it can be expected that no information about the inference data Y will be lost and / or distorted. Thus, in type I guarantees, the inference data vector 842 (i.e., the inference data vector Y) is inversely guaranteed by the RAN node 170 in the DNN.

number

number

number

number

number

number

[0231] Figure 21 shows an example of the steps of the method related to the encoded input vector 744 and the encoded output vector 844.

[0232] ED110m sends a request to the computing system 600 hosting DNN650 to request DNN650 to perform inference (see step 2102, Figure 21). In the request, ED110m may specify a single result class c or multiple result classes. In response to the request, the computing system 600 hosting DNN650 sends the encoding matrix U specific to ED. m and the encoding matrix V specific to the class c ED110m receives (step 2104). Computing system 600 hosting DNN650 encodes the encoding matrix V for each result class specified in the request. c You may provide it.

[0233] In response to receiving requests to perform inference, a class-specific inverse-guaranteed DNN

number

[0234] The computing system 600 hosting DNN650 may also provide the RAN node 170 with a set of Type II assurance rules. The Type II assurance rules are grouped into table G. c , within-group reference distribution R i L number of groups, L group correlation function corr i (·,R i ), L group thresholds T i , intergroup reference distribution R g , intergroup correlation function corr g (·,R g ) and intergroup threshold T g Note that this includes

[0235] During operation, the ED110m's reliable intrinsic encoder 714 uses an input data vector

number

number

[0236] The RAN node 170 may simply relay the inference request to the computing system 600 hosting the DNN650. The RAN node 170 then receives the encoded input vector Z. m (744) may be saved to memory 258 of RAN node 170. A reliability decoder (not shown) of computing system 600 (i.e., DNN650) here,

number

number

[0237] DNN650 input vector X m Based on (704), inference is performed to generate inference data 804. Subsequently, the DNN650 generates an inference response containing the inference data 804 and outputs the inference data. Then, the computing system 600 reshapes it using a reshaper and outputs the inference data vector Y m (842) Encoded inference data vector W m Encoded to (844), here, W m =V c ·Y m Therefore, the encoded output vector 844 (i.e., W m The computing system 600 hosting the DNN650 may send a transmission 904 to the RAN node 170 that includes an inference response that specifically includes ).

[0238] Encoded inference vector 844 (i.e., W m When receiving transmission 903 which includes an inference response containing ), the encoded input vector Z m (744) has been previously received and remembered, and the class-specific reverser guaranteed DNN

number

[0239] Encoded inference data vector W m When determining that (844) is guaranteed, refer to step 1614 of Figure 16, the encoded inference data vector 844 (i.e., the inference data vector W) is used. m RAN node 170 may send an inference response including ) to ED110m.

[0240] ED110m is encoded guaranteed vector 844(W m Upon receiving (step 2110), the guaranteed inference data vector 842(Y) is obtained as described above. m ) can be obtained (step 2112), here,

number

[0241] A useful aspect of this latter method is that it completely protects inference requests to DNN650. Firstly, all transmitted signals 901, 902, 903, 904 (Figure 9) are encoded. Secondly, the RAN node 170 is configured to ensure that the encoded inference data vector 844 is included in the inference response received from the computing system 600 hosting DNN650. Thirdly, there is no theoretical way for a hacker to accumulate input data vectors 742 (or input data 704) and their corresponding inference data vectors 842 (or inference data 804), which could be used to train a malicious DNN or a new DNN.

[0242] A theoretical hacker could hack into RAN node 170 and obtain the encoded input data vector 744 (i.e., Z m) and encoded output inference data vector 844 (i.e., W m ) and can be stored. Theoretically, the stored encoded input data vector 744 (i.e., Z m ) and encoded inference data vector 844 (i.e., W m In some cases, a sham DNN may even be trained using ) . On the other hand, from the above, the encoded input data vector 744 (i.e., Z m The encoded inference data vector 844 (i.e., W m ) and the encoding matrix U m and V c It should be noted that it is generated based on the encoding matrix U. m and V c You may change this. It is obvious that such a change will immediately invalidate the false DNN.

[0243] It is understood that one or more steps of the methods of the embodiments provided herein may be performed by corresponding parts or modules. For example, data may be transmitted by a transmitting unit or by a transmitting module. Data may be received by a receiving unit or by a receiving module. Data may be processed by a processing unit or by a processing module. Each part / module may be hardware, software, or a combination thereof. For example, one or more parts / modules may be integrated circuits such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). If a module is software, it is understood that, as needed, the whole or a part of the module may be acquired by the processor as one or more instances, individually or collectively, for processing, and the module itself may contain instructions for further deployment and instantiation.

[0244] While the illustrated embodiments show combinations of features, not all of these combinations are necessary to realize the benefits of the various embodiments of this disclosure. In other words, a system or method designed according to the embodiments of this disclosure does not necessarily include all of the features shown in any one of the figures, nor all of the parts schematically shown in the figures. Furthermore, certain features of one embodiment may be combined with certain features of other embodiments.

[0245] While this disclosure is described with reference to the embodiments shown, this description is not intended to be constrained. Various modifications and combinations of the embodiments shown, as well as other embodiments of this disclosure, will be apparent to those skilled in the art by reference to the description. Therefore, any such modifications or embodiments are intended to be included in the appended claims. [Explanation of Symbols]

[0246] 100 ED 100 Communication Systems 110 ED 120 RAN 130 Core Network 140 Public Switched Telephone Network (PSTN) 160 Networks 170 RANNode 172 RANNodes 174 Sensing Agent 176 SMF 190 Radio Wave Interface 201 Transmitter 203 Receiver 204 Antenna 208 memory 210 processors 252 Transmitters 253 Scheduler 254 Receiver 256 Antenna 258 memory 260 processors 272 Transmitters 274 Receiver 276 processors 278 memory 280 antennas 282 Transmitters 283 Scheduler 284 Receiver 286 Antenna 288 memory 290 processors 600 Computing Systems 601 Send 602 Send 603 Send 604 Wireless transmission 630 Radio Wave Interface 650 DNN 700 inference requests 702 Control Header 704 Input Data 706 Information 708 inference requests 710 MAC layer 712 Reshaper 714 Reliability-Specific Encoder 720 PHY layer 722 Source Encoders 724-channel encoder 726 source blocks 742 Input data vectors 746 source blocks 748 Codewords 750-channel decoder 752 Source Decoder 754 Reliability-Specific Decoder 756 Reshaper 800 Inference Response 802 Control Header 804 Inference Data 806 Information 808 Inference Response 810 MAC layer 812 Reshaper 814 Reliability-Specific Encoder 820 PHY layer 822 Source Encoder 824-channel encoder 842 Inference Data Vectors 844 inference data vectors 846 source blocks 848 Codewords 850 Reliability-Specific Decoder 852 Reshaper 901 Send 902 Send 903 Send 904 Send 905 Wireless transmission 930 Radio Interface

Claims

1. A method performed by an electronic device, wherein the method is A step of generating an inference request for a deep neural network (DNN), wherein the inference request comprises input data for the DNN. The steps include sending a request to request the initialization of coded transmissions for inference, To generate an encoded input vector, the input data vector obtained based on the input data is encoded using a linear block encoder. A step of sending the inference request to a computing system hosting the DNN, wherein the inference request includes the encoded input vector, A step of receiving an inference response from the computing system hosting the DNN, wherein the inference response comprises an inference data vector included in the inference response, which is guaranteed to have been generated by the DNN based on the input data obtained from the input data vector. A method that includes this.

2. The method according to claim 1, further comprising the step of receiving a linear block encoding matrix in response to the transmission of the request to initialize coded inference.

3. The method according to claim 1, further comprising the step of receiving an inferred data vector decoding matrix in response to the transmission of the request to initialize the coded inference.

4. The method according to claim 3, wherein the inference response includes an encoded output data vector, and the method further includes the step of decoding the encoded output data vector using an output data vector decoding matrix to obtain a decoded output data vector.

5. The method according to any one of claims 1 to 3, wherein the inference response includes an output data vector, and the method further includes the step of receiving a confidence score representing a comparison between an encoded input vector estimated based on the output data vector and an actual encoded input vector, and relating it to the output data vector.

6. The method according to claim 5, wherein the reliability score comprises the squared difference between the estimated encoded input vector and the actual encoded input vector.

7. A method performed by a radio access network (RAN) node, the method is: A step of receiving an inference request to a DNN from an electronic device, wherein the inference request includes an input data vector, The steps include sending the inference request to a computing system hosting the DNN, To obtain the actual encoded input vector, the input data vector is encoded using a linear block encoder, A step of receiving an inference response from the computing system, wherein the inference response includes an output data vector generated by the DNN based on the input data vector. The steps include obtaining an estimated encoded input vector based on the output data vector, A step of obtaining a reliability score representing a comparison between the estimated encoded input vector and the actual encoded input vector, The steps include: transmitting the output data vector to the electronic device in response to determining that the reliability score exceeds a threshold; Methods that include...

8. The method according to claim 7, wherein the reliability score comprises the squared difference between the estimated encoded input vector and the actual encoded input vector.

9. The method according to claim 7, wherein the step of transmitting the inference request includes the step of transmitting the inference request to an inference neural network, the inference neural network being configured to approximate a nonlinear function.

10. The method according to claim 9, wherein the step of obtaining the estimated encoded input vector includes the step of providing the output data vector to a guaranteed neural network, the guaranteed neural network being trained to output the estimated encoded input vector in response to receiving the output data vector as the output of the nonlinear function.

11. The method according to claim 10, further comprising the step of receiving a linear block encoding matrix from a provider of the inference neural network.

12. The method according to any one of claims 7 to 11, wherein the output data vector comprises an encoded output data vector, and the step of obtaining the estimated encoded input vector includes the step of using the encoded output vector.

13. The method according to any one of claims 7 to 12, further comprising the step of receiving a plurality of assurance rules relating to grouping specific dimensions of the encoded output vector.

14. The method according to claim 13, wherein the assurance rule includes a grouping table that indicates a selected dimension of the encoded output vector and one of a plurality of groups into which the selected dimension is grouped.

15. The method according to claim 14, wherein the assurance rule relates to a step of performing an intragroup consistency check.

16. The method according to claim 15, wherein the step of performing the intragroup consistency check includes the step of determining the correlation between the distribution of values ​​of the elements in the group and an element value distribution reference.

17. The method according to claim 16, further comprising the step of transmitting something indicating the correlation together with the output data vector.

18. The method according to claim 14, wherein the assurance rule relates to a step of performing intergroup consistency checks.

19. The method according to claim 18, wherein the step of performing the intergroup consistency check includes determining the correlation between the group mean of the element distribution and the element mean distribution reference.

20. The method according to claim 19, further comprising the step of transmitting something indicating the correlation together with the output data vector.

21. An apparatus comprising means for carrying out the method described in any one of claims 1 to 6.

22. An apparatus comprising means for carrying out the method described in any one of claims 7 to 20.

23. A non-temporary computer-readable medium that stores instructions, wherein when the instructions are executed by the computer, the computer causes the computer to perform the method according to any one of claims 1 to 11.

Images