Anomaly detection method and related device

Abstract

The present application discloses an anomaly detection method, applied to an anomaly detection system. The method comprises: acquiring, from a host of a computing server, operation information of a memory operation of an AI framework during running of an AI model; acquiring operation information of a memory operation of at least one heterogeneous operator from an acceleration device of the computing server; recording a mapping relationship between a framework API of the AI framework and the at least one heterogeneous operator; on the basis of the operation information of the memory operation of the AI framework and the operation information of the memory operation of the at least one heterogeneous operator, performing anomaly detection for the heterogeneous operator to obtain an anomaly detection result; and when it is indicated that an anomaly is detected, determining an anomalous API on the basis of the mapping relationship between the framework API of the AI framework and the at least one heterogeneous operator. In the method, operation information of a memory operation of an AI framework and operation information of a memory operation of a heterogeneous operator are coordinated to complete missing information on an operator side, and comprehensive anomaly detection is performed on the basis of the completed information, so that an anomaly can be localized and remediated without the cooperation of experts in multiple fields, thereby improving the detection efficiency.

Description

An anomaly detection method and related equipment

[0001] This application claims priority to Chinese Patent Application No. 202411046289.0, filed with the State Intellectual Property Office of China on July 31, 2024, entitled "An Anomaly Detection Method and Related Equipment", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of artificial intelligence (AI) technology, and in particular to an anomaly detection method, an anomaly detection system, a computing device cluster, a computer-readable storage medium, and a computer program product. Background Technology

[0003] With the continuous development of AI technology, new AI models (especially large-scale AI models) are constantly emerging. AI models, represented by large-scale AI models, are typically built using AI frameworks. An AI framework is a set of standard interfaces, feature libraries, and toolkits for designing, training, and validating AI models, integrating algorithm encapsulation, data retrieval, and the ability to utilize computing resources. To improve the performance of AI models, high-performance operators can be introduced on top of the AI ​​framework during AI model development. The AI ​​framework and operators can be deployed heterogeneously. For example, the AI ​​framework can be deployed on the host side, and the operators can be deployed on the device side, thus utilizing the computing power of the device-side chips to improve the performance of the AI ​​model.

[0004] AI frameworks and operators are typically developed and maintained by different developers or organizations. The developers of the AI ​​framework provide anomaly detection capabilities for the AI ​​framework itself, while the developers of the chips used to execute the operators provide anomaly detection capabilities for the operators. During AI model training or inference, if accuracy issues arise, the AI ​​framework can enable framework-level anomaly detection capabilities to detect anomalies within the AI ​​framework, while the device-side chips can enable operator-level anomaly detection capabilities to detect anomalies within the operators themselves.

[0005] However, anomaly detection in AI frameworks and operators is often limited to their respective domains, requiring collaboration among experts from multiple fields to locate and fix anomalies, which is inefficient and fails to meet business needs. Summary of the Invention

[0006] This application provides an anomaly detection method that fills in the gaps in information that the AI ​​framework can perceive but the operators lack by combining the memory operation information of the host-side AI framework with the memory operation information of heterogeneous operators. Based on the supplemented information, more comprehensive anomaly detection can be performed, thereby detecting more cross-domain anomalies and improving anomaly detection capabilities. Anomalies can be located and repaired without the need for collaboration among experts from multiple domains, improving anomaly detection efficiency and meeting business needs. This application also provides an anomaly detection system, computing device cluster, computer-readable storage medium, and computer program product corresponding to the above method.

[0007] Firstly, this application provides an anomaly detection method. This method is applied to an anomaly detection system. The anomaly detection system can be a software system, which can be a standalone anomaly detection tool or built into an AI framework. For example, the anomaly detection system can be a functional module of an AI framework, providing an application programming interface (API) for user invocation. The anomaly detection system is deployed in a computing device cluster. In some examples, the computing device cluster can include computing servers deploying AI models, and the anomaly detection system can be deployed separately on the host or device side of the computing server, such as on an acceleration device executing heterogeneous operators, or distributed across the host and device sides. In other examples, the anomaly detection system can also be deployed in a cloud environment, such as in a cloud computing cluster, where the cloud computing cluster can be a central cloud composed of central computing devices or an edge cloud composed of edge computing devices. Thus, the anomaly detection system can be provided to users as a cloud service. In some possible implementations, the anomaly detection system can also be a hardware system. This hardware system can be a computing device cluster with anomaly detection capabilities. The computing device cluster includes at least one computing device, and the anomaly detection method of this application is executed when the computing device cluster is running.

[0008] Specifically, the anomaly detection system obtains memory operation information of the AI ​​framework during AI model execution from the host of the computing server. The AI ​​model includes the AI ​​framework and at least one heterogeneous operator. The memory operation information of the AI ​​framework includes the original structure of the parameters of the at least one heterogeneous operator on the AI ​​framework side. The anomaly detection system also obtains memory operation information of the at least one heterogeneous operator from the acceleration device of the computing server, recording the mapping relationship between the AI ​​framework's framework application programming interface (API) and the at least one heterogeneous operator. Then, the anomaly detection system performs anomaly detection on the heterogeneous operator based on the memory operation information of the AI ​​framework and the memory operation information of the at least one heterogeneous operator, obtaining anomaly detection results. When the anomaly detection result indicates that an anomaly has been detected, the anomaly detection system determines the anomalous API based on the mapping relationship between the AI ​​framework's framework API and the at least one heterogeneous operator.

[0009] This method, by combining the memory operation information of the host-side AI framework with the memory operation information of heterogeneous operators on the device side, can fill in the gaps in information that the AI ​​framework can perceive but that is missing on the operator side. Based on this supplemented information, more comprehensive anomaly detection can be performed, thereby detecting more cross-domain anomalies and improving anomaly detection capabilities. Furthermore, by combining the mapping relationship between the framework API and heterogeneous operators, this method can identify anomalous APIs, enabling rapid anomaly localization and laying the foundation for rapid anomaly repair, thus improving the accuracy of the AI ​​model. In this method, AI model trainers do not need to have professional knowledge of the AI ​​framework to discover memory anomalies and other problems, and it supports temporary repair of such issues, thus giving AI model trainers a self-healing capability.

[0010] In some possible implementations, the anomaly detection system can obtain memory operation information of the AI ​​framework during the execution of the AI ​​model from the host computer of the computing server through stubs configured for the AI ​​framework. Stubs are program segments used to replace parts of functionality. Stubs can be software stubs or hardware stubs. Taking software stubs as an example, stubs can be used to simulate the behavior of existing programs or as a temporary replacement for code to be developed.

[0011] The anomaly detection system, by setting up stub programs, can flexibly acquire operational information about the AI ​​framework's memory operations during AI model execution, as needed. Furthermore, it can acquire this information non-intrusively, ensuring high availability.

[0012] In some possible implementations, an anomaly detection system can obtain memory operation information of the AI ​​framework during AI model execution through interface hijacking. Specifically, the AI ​​framework may include memory operation APIs, such as memory allocation APIs, memory access APIs, or memory release APIs. The anomaly detection system can obtain the memory operation information of the AI ​​framework during AI model execution from the host of the computing server by using the replacement APIs of the memory operation APIs in the AI ​​framework.

[0013] This allows for the acquisition of memory operation information from the AI ​​framework as efficiently and accurately as possible, improving the accuracy and efficiency of subsequent anomaly detection.

[0014] In some possible implementations, the anomaly detection system can obtain memory operation information of the AI ​​framework during AI model execution from the host computer of the computing server through the code block used to monitor memory operations within the AI ​​framework. This method improves the AI ​​framework by providing memory operation information on the AI ​​framework side through the framework's own capabilities, supplementing the missing information on the operator side, and improving the anomaly detection rate, especially the detection rate of cross-domain anomalies.

[0015] In some possible implementations, the memory operation information of the AI ​​framework includes the starting address and length of the memory allocated for the parameters of at least one heterogeneous operator. Alternatively, the memory operation information of the AI ​​framework includes the starting address and ending address of the memory allocated for the parameters of at least one heterogeneous operator.

[0016] By combining information representing the range of memory, such as start address and length or start address and end address, it is possible to achieve anomaly detection not only within operators but also from AI frameworks to heterogeneous operators, thereby improving the efficiency and accuracy of anomaly detection.

[0017] In some possible implementations, the execution device for the exception API includes a first acceleration device that executes at least one heterogeneous operator; for example, the first acceleration device could be a local acceleration device. Accordingly, the exception detection system can also switch the execution device of the exception API from the first acceleration device to a host or a second acceleration device. The second acceleration device can be another local acceleration device or a remote acceleration device.

[0018] This method achieves rapid exception repair by temporarily replacing the execution device of the exception API.

[0019] In some possible implementations, the anomaly detection system can also repair the code of heterogeneous operators associated with the anomaly API. This method, by repairing the code of the heterogeneous operators associated with the anomaly API, can address the anomaly at its source, preventing the recurrence of the same anomaly.

[0020] In some possible implementations, the anomaly detection system can also output the anomaly API to a log file; alternatively, it can present the anomaly API to the user; or it can provide the anomaly API to integrated applications through a results display API. This allows for the output of anomaly detection results in diverse ways, providing a reference for anomaly remediation and ensuring high availability.

[0021] In some possible implementations, the anomaly detection system can also configure the interface parameters or environment variables of the anomaly detection interface as target values ​​to enable anomaly detection capabilities. This method supports enabling or disabling anomaly detection capabilities by configuring the anomaly detection interface or environment variables, which can meet the needs of different business scenarios.

[0022] In some possible implementations, when the anomaly detection system starts the application being debugged, the system configures the interface parameters or environment variables of the anomaly detection interface to the target value to enable anomaly detection capabilities. The application being debugged is an application developed based on an AI model.

[0023] In this method, the anomaly detection system can operate independently of the application being debugged. The anomaly detection system can activate its anomaly detection capability when the application being debugged is launched, thereby achieving anomaly detection throughout the entire lifecycle.

[0024] In some possible implementations, the anomaly detection system is integrated into the AI ​​framework. Accordingly, when the AI ​​framework is running, the anomaly detection system configures the interface parameters or environment variables of the anomaly detection interface to the target values ​​to enable anomaly detection capabilities.

[0025] In this method, the AI ​​framework can integrate anomaly detection capabilities, and the anomaly detection capabilities can be enabled when the AI ​​framework is running, thereby achieving anomaly detection throughout the entire lifecycle.

[0026] Secondly, this application provides an anomaly detection system. The system includes:

[0027] A unified information perception module is used to obtain operation information of the memory operation of the AI ​​framework during the operation of the AI ​​model from the host of the computing server. The AI ​​model includes the AI ​​framework and at least one heterogeneous operator. The operation information of the memory operation of the AI ​​framework includes the original structure of the parameters of the at least one heterogeneous operator on the AI ​​framework side, and the operation information of the memory operation of the at least one heterogeneous operator obtained from the acceleration device of the computing server.

[0028] The unified information perception module is also used to record the mapping relationship between the AI ​​framework's framework application programming interface (API) and the at least one heterogeneous operator.

[0029] An anomaly detection module is used to perform anomaly detection on the heterogeneous operators based on the operation information of the memory operations of the AI ​​framework and the operation information of the memory operations of the at least one heterogeneous operator, and to obtain anomaly detection results.

[0030] The anomaly detection module is further configured to determine the anomaly API based on the mapping relationship between the AI ​​framework's framework API and the at least one heterogeneous operator when the anomaly detection result indicates that an anomaly has been detected.

[0031] In some possible implementations, the unified information perception module is specifically used for:

[0032] By using stub programs set up for the AI ​​framework, operation information of memory operations of the AI ​​framework during the running of the AI ​​model is obtained from the host of the computing server.

[0033] In some possible implementations, the unified information perception module is specifically used for:

[0034] By replacing the memory operation API in the AI ​​framework, the operation information of the AI ​​framework's memory operation during the AI ​​model's execution can be obtained from the host of the computing server.

[0035] In some possible implementations, the unified information perception module is specifically used for:

[0036] The AI ​​framework obtains memory operation information from the host of the computing server during the AI ​​model's operation by using the code block in the AI ​​framework used to monitor memory operations.

[0037] In some possible implementations, the memory operation information of the AI ​​framework includes the starting address and length of the memory allocated for the parameters of the at least one heterogeneous operator. Alternatively, the memory operation information of the AI ​​framework includes the starting address and ending address of the memory allocated for the parameters of the at least one heterogeneous operator.

[0038] In some possible implementations, the execution device of the exception API includes a first acceleration device that executes at least one heterogeneous operator, and the system further includes:

[0039] An exception handling module is used to switch the execution device of the exception API from the first acceleration device to the host or the second acceleration device.

[0040] In some possible implementations, the system further includes:

[0041] An exception handling module is used to repair the code of the heterogeneous operators associated with the exception API.

[0042] In some possible implementations, the system further includes:

[0043] The results display module is used to output the abnormal API to a log file; or to present the abnormal API to the user; or to provide the abnormal API to the integrated application through the results display API.

[0044] In some possible implementations, the system further includes:

[0045] The configuration module is used to configure the interface parameters or environment variables of the anomaly detection interface to the target value in order to enable the anomaly detection capability.

[0046] In some possible implementations, the configuration module is specifically used for:

[0047] When the anomaly detection system starts the application being debugged, it configures the interface parameters or environment variables of the anomaly detection interface to the target value to enable the anomaly detection capability. The application being debugged is an application developed based on the AI ​​model.

[0048] In some possible implementations, the anomaly detection system is integrated into the AI ​​framework, and the configuration module is specifically used for:

[0049] When the AI ​​framework is running, configure the interface parameters or environment variables of the anomaly detection interface to the target value to enable the anomaly detection capability.

[0050] Thirdly, this application provides a computing device cluster. The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is used to execute instructions stored in the at least one memory to cause the computing device or the computing device cluster to perform the anomaly detection method as described in the first aspect or any implementation thereof.

[0051] Fourthly, this application provides a computer-readable storage medium storing instructions that instruct a computing device or a cluster of computing devices to execute the anomaly detection method described in the first aspect or any implementation thereof.

[0052] Fifthly, this application provides a computer program product containing instructions that, when run on a computing device or a cluster of computing devices, causes the computing device or cluster of computing devices to execute the anomaly detection method described in the first aspect or any implementation thereof.

[0053] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0054] To more clearly illustrate the technical methods of this application, the accompanying drawings used will be briefly described below.

[0055] Figure 1 is a schematic diagram of an anomaly detection performed by an AI framework in an AI model provided in this application;

[0056] Figure 2 is a schematic diagram of anomaly detection using heterogeneous operators in an AI model provided in this application;

[0057] Figure 3 is a schematic diagram of an anomaly detection method that integrates the anomaly detection capabilities of an AI framework and heterogeneous operators, as provided in this application.

[0058] Figure 4 is a schematic diagram of the architecture of an anomaly detection system provided in this application;

[0059] Figure 5 is a schematic diagram of an interface call provided in this application;

[0060] Figure 6 is a schematic diagram of an anomaly detection and repair process provided in this application;

[0061] Figure 7 is a flowchart of an anomaly detection method provided in this application;

[0062] Figure 8 is a schematic diagram of the software stack call relationship when an AI model provided in this application is running normally;

[0063] Figure 9 is a schematic diagram of an application scenario of an anomaly detection method provided in this application;

[0064] Figure 10 is a schematic diagram of an application scenario for another anomaly detection method provided in this application;

[0065] Figure 11 is a schematic diagram of an anomaly detection and repair process provided in this application;

[0066] Figure 12 is a schematic diagram of the structure of a computing device provided in this application;

[0067] Figure 13 is a schematic diagram of the structure of a computing device cluster provided in this application;

[0068] Figure 14 is a schematic diagram of another computing device cluster provided in this application;

[0069] Figure 15 is a schematic diagram of another computing device cluster provided in this application. Detailed Implementation

[0070] The terms "first" and "second" used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature.

[0071] First, some technical terms involved in the embodiments of this application will be introduced.

[0072] Artificial intelligence (AI) models are mathematical models with reasoning capabilities built using techniques such as machine learning (ML). AI models can infer output data based on input data. For example, in image processing, an AI model can be an image classification model; the input data can be the image to be classified, and the output data can be the classification result. As another example, in natural language processing (NLP), an AI model can be an intelligent question-answering model, including but not limited to large language models (LLMs); the input data can be the question text, and the output data can be the response text.

[0073] An AI framework is software that provides developers with standard interfaces, feature libraries, and toolkits for building AI models (such as neural network models). This software integrates algorithm encapsulation, data retrieval, and computing resource utilization. The standard interface can be an application programming interface (API). The APIs provided by an AI framework can also be called framework APIs. Developing AI models based on an AI framework allows developers to focus on designing the network structure of the AI ​​model. After defining the network structure, the AI ​​framework can automatically train the model, resulting in an AI model used to solve problems such as classification, regression, and model fitting.

[0074] AI frameworks provide definitions and implementations of commonly used operators (OPs). An operator is a computational unit in an AI model, representing a mapping from one function space to another. Broadly speaking, any operation performed on a function can be considered an operator. In the AI ​​field, an operator can be any computational function involved in an AI model. For example, the convolution function in a convolution layer can be considered an operator, i.e., a convolution operator. Similarly, the function used to sum the weights in a fully-connected layer (FC layer) can also be considered an operator, i.e., a fully connected operator. The definition of an operator can include its input, output, parameters, and constraints on those parameters. The implementation of an operator includes how it is implemented on a specific device, typically represented by a kernel.

[0075] To improve the performance of AI models, high-performance operators can be introduced to build and deploy AI models. These high-performance operators can include heterogeneous operators. Heterogeneous operators refer to operators executed on execution devices other than the central processing unit (CPU) in a heterogeneous computing architecture. While the CPU is Turing-complete and can run independently, accelerators, such as graphics processing units (GPUs), neural network processing units (NPUs), and tensor processing units (TPUs), typically lack Turing completeness and are difficult to run independently, usually operating with the assistance of the CPU. Therefore, a heterogeneous computing architecture can be a "CPU + xPU accelerator" architecture, where xPU refers to other non-CPU processors, such as GPUs, NPUs, or TPUs.

[0076] While using high-performance heterogeneous operators can improve the performance of AI models, it can also easily introduce functional problems, such as computational errors, leading to a decrease in the accuracy of the AI ​​model. Related data shows that over 50% of accuracy problems are caused by heterogeneous operators, and over 40% of the accuracy problems caused by heterogeneous operators are due to memory issues. Taking a Conformer network-based AI model as an example, a single training step involves nearly 7000 operator calls, encompassing 55 types of heterogeneous operators. Among these, 13 types of heterogeneous operators (accounting for 24%) exhibit memory problems.

[0077] When the accuracy of an AI model declines, anomaly detection can be performed. AI frameworks and heterogeneous operators are typically maintained by different developers; for example, AI frameworks may be maintained by software developers, while heterogeneous operators may be maintained by hardware developers (manufacturers of heterogeneous chips). Developers of AI frameworks provide anomaly detection capabilities specific to their frameworks, and developers of heterogeneous operators provide anomaly detection capabilities specific to their operators.

[0078] AI frameworks can monitor the relationship between global memory allocation and release, as well as stream synchronization, through relevant interfaces to identify any anomalies. For example, the PyTorch framework supports the `enable_cuda_sanitizer` interface, which is used to identify anomalies by monitoring the relationship between GPU global memory allocation and release, and stream synchronization.

[0079] Below is an example of anomaly detection in an AI framework. When an anomaly exists in example.py, it can be detected by executing the following command: `TORCH_CUDA_SANITIZER=1 python example_error.py`

[0080] After executing the above command, the framework detection tool can display the following: CSAN detected a possible data race on tensor with data pointer 139719969079296 Access by stream 94646435460352 during kernel:

[0081] ...

[0082] For anomaly detection in heterogeneous operators, the operator detection tools (such as compute-sanitizer) provided by the developers of heterogeneous chips such as GPUs can detect memory problems in heterogeneous operators and output the problematic lines of code.

[0083] Below is an example of anomaly detection for heterogeneous operators. Specifically, the following command is used during compilation: `$nvcc -lineinfo example.cu -o example.exe`

[0084] When using the compute sanitizer tool, a problem can be found in example.exe, as shown in the following example: $compute-sanitizer--tool memcheck . / example.exe ========COMPUTE-SANITIZER Before:Array 0,1..N-1:1.000000 1.000000 1.000000 ========Invalid__global__read of size 4bytes =========at 0x70 in example.cu:8:scaleArray(float*,float) =========by thread(255,0,0)in block(3,0,0) =========Address 0x7f3aae000ffc is out of bounds =========and is 1 byte after the nearest allocation at 0x7f3aae000000of size 4092bytes

[0085] As shown above, the AI ​​model's software stack has integrated the anomaly detection capabilities of the AI ​​framework and heterogeneous operators, but these anomaly detection capabilities are not coordinated. The following explanation is based on the accompanying figures. Figures 1, 2, and 3 simplify the AI ​​model structure to a sequential structure. In practical applications, the AI ​​model structure can be more complex. The circles in the figures represent nodes in the AI ​​model, and each node corresponds to an operator (e.g., a heterogeneous operator). The directed line segments in the figures represent the inputs and outputs of the nodes (e.g., the inputs and outputs of operators).

[0086] As shown in Figure 1, the AI ​​framework can only detect whether there are memory anomalies or memory contention in the input and output of each node. Memory anomalies include two nodes using the same memory simultaneously, or overlapping memory usage; memory contention refers to the possibility that the same memory may be used in different computations, but the order of read / write, write / write, or write / read cannot be guaranteed, leading to randomness in results at different time intervals. In other words, the AI ​​framework cannot detect memory anomalies within a node, but can only detect whether there are anomalies in the memory allocated to heterogeneous operators. As shown in Figure 2, for heterogeneous operators, the operator detection tool can only detect whether there are anomalies within that heterogeneous operator, and cannot detect the allocation of global memory by the business logic. In Figures 1, 2, and 3, dashed lines represent the perceptible parts, and solid lines represent the imperceptible parts.

[0087] When heterogeneous operators are invoked, AI frameworks can monitor memory allocation and deallocation interfaces to perceive the available memory space during execution. However, AI frameworks typically manage memory uniformly, for example, converting memory allocated for multiple heterogeneous operators into starting addresses and computational specifications (e.g., n-round for loops). This prevents heterogeneous operators from perceiving the range of memory used. Operator detection tools only detect anomalies within the heterogeneous operator itself (such as exceptions within the operator's code). When AI model training or inference encounters issues like accuracy degradation, even if users discover problems with heterogeneous operators, it's difficult to determine how to quickly locate or fix them within the AI ​​framework. Often, collaboration among experts from multiple domains is required to locate and fix the problem, resulting in low efficiency and failing to meet business needs.

[0088] In view of this, this application provides an anomaly detection method. This method is a heterogeneous platform detection method that integrates the anomaly detection capabilities of an AI framework and heterogeneous operators. This method can be executed by an anomaly detection system. The anomaly detection system is used to detect anomalies in heterogeneously deployed AI models, wherein the heterogeneously deployed AI models can be models developed based on an AI framework, which includes the AI ​​framework and at least one heterogeneous operator. The AI ​​framework is deployed on the host of a computing server, and at least one heterogeneous operator is deployed on the acceleration device of the computing server. The computing server can be a server used for computation, including but not limited to training servers and inference servers. The anomaly detection system can be a software system, which can be a standalone anomaly detection tool or built into the AI ​​framework. For example, the anomaly detection system can be a functional module of the AI ​​framework, providing an application programming interface (API) for user invocation. The anomaly detection system is deployed in a cluster of computing devices. In some examples, the computing device cluster may include computing servers deploying AI models. The anomaly detection system can be deployed separately on the host or device side of the computing server, for example, separately on an acceleration device executing heterogeneous operators, or the anomaly detection system can be distributed across the host and device sides. In other examples, the anomaly detection system may be deployed in a cloud environment, such as in a cloud computing cluster, where the cloud computing cluster can be a central cloud composed of central computing devices or an edge cloud composed of edge computing devices. Thus, the anomaly detection system can be provided to users as a cloud service. In some possible implementations, the anomaly detection system may also be a hardware system. This hardware system can be a computing device cluster with anomaly detection capabilities. The computing device cluster includes at least one computing device, and the computing device cluster executes the anomaly detection method of this application when it runs.

[0089] Specifically, the anomaly detection system can obtain memory operation information of the AI ​​framework during the execution of the AI ​​model from the host of the computing server. The AI ​​model includes the AI ​​framework and at least one heterogeneous operator. The memory operation information of the AI ​​framework includes the original structure of the parameters (e.g., input and output parameters) of the at least one heterogeneous operator on the AI ​​framework side. This original structure can include the range of memory allocated or requested for each parameter, which can be represented by a starting address and a length. For example, if the heterogeneous operator includes 100 parameters, and the range of memory allocated or requested for each parameter is represented by a starting address and a length, then the original structure can be represented by a matrix of length 2 and width 100, denoted as [2, 100]. The anomaly detection system also records the mapping relationship between the AI ​​framework's application programming interface (API) and the at least one heterogeneous operator. The anomaly detection system also obtains memory operation information of the at least one heterogeneous operator from the acceleration device of the computing server. Then, based on the memory operation information of the AI ​​framework and the memory operation information of the at least one heterogeneous operator, the anomaly detection system performs anomaly detection for the heterogeneous operator and obtains the anomaly detection result. When the anomaly detection result indicates that an anomaly has been detected, the anomaly detection system can determine the anomaly API based on the mapping relationship between the AI ​​framework's framework API and at least one heterogeneous operator.

[0090] This method, by combining the memory operation information of the host-side AI framework with the memory operation information of heterogeneous operators on the device side, can fill in the gaps in information that the AI ​​framework can perceive but that is missing on the operator side. Based on this supplemented information, more comprehensive anomaly detection can be performed, thereby detecting more cross-domain anomalies and improving anomaly detection capabilities. Furthermore, by combining the mapping relationship between the framework API and heterogeneous operators, this method can identify anomalous APIs, enabling rapid anomaly localization and laying the foundation for rapid anomaly repair, thus improving the accuracy of the AI ​​model. In this method, AI model trainers do not need to have professional knowledge of the AI ​​framework to discover memory anomalies and other problems, and it supports temporary repair of such issues, thus giving AI model trainers a self-healing capability.

[0091] As shown in Figure 3, the memory usage within heterogeneous operators and between heterogeneous operators in the AI ​​model are monitored and used for anomaly detection. This can bridge the perception gap between the AI ​​framework and the heterogeneous operators, integrate the anomaly detection capabilities of the AI ​​framework and the heterogeneous operators, and thus achieve end-to-end anomaly detection to meet business needs.

[0092] To make the anomaly detection system of this application clearer and easier to understand, the system architecture of the anomaly detection system will be described below with reference to the accompanying drawings.

[0093] Referring to Figure 4, which illustrates the architecture of an anomaly detection system 400, the anomaly detection system 400 includes a unified information perception module 402 and an anomaly detection module 404. Further, the anomaly detection system 400 may also include a result display module 406. The modules of the anomaly detection system 400 can be centrally deployed on the host side of a computing server, or deployed on the device side of the computing server, such as in acceleration devices like GPUs or NPUs. In some examples, the modules of the anomaly detection system 400 can be distributed and deployed on both the host and device sides. In other examples, the anomaly detection system 400 can also be deployed independently of the AI ​​model, for example, on a remote cloud computing cluster. Figure 4 illustrates an example of the anomaly detection system 400 being deployed independently of the AI ​​model.

[0094] The functions of each module of the anomaly detection system 400 are described in detail below.

[0095] The unified information perception module 402 is used to obtain operation information of the AI ​​framework's memory operations during the AI ​​model's execution from the host of the computing server. The AI ​​model includes an AI framework and at least one heterogeneous operator. The operation information of the AI ​​framework's memory operations may include the original structure of the heterogeneous operator's parameters on the AI ​​framework side. This original structure can be converted into a structure suitable for processing on the device side. For example, when the heterogeneous operator includes 100 parameters, the original structure can be represented by a matrix of [2, 100], where each row of the matrix represents the starting address and length of a parameter. The original structure can be converted at runtime to obtain the converted structure. The converted structure may include the starting address of the memory allocated for the parameters and the computation specification. The computation specification may be the number of computation rounds or the number of iterations. For example, the computation specification may be 10 rounds of for loops, with each round of for loops counting 10 times. The unified information perception module 402 is also used to record the mapping relationship between the AI ​​framework's API and at least one heterogeneous operator. The unified information perception module 402 is also used to obtain operation information of the memory operations of at least one heterogeneous operator from the acceleration device of the computing server. The operation information for memory operations of at least one heterogeneous operator may include the structure of the heterogeneous operator's parameters after runtime transformation, such as the starting address and calculation specifications of the parameters.

[0096] In this system, the AI ​​framework code runs on the host side, while the heterogeneous operator code runs on the device side. The device memory of the heterogeneous computing device (also known as a heterogeneous platform, which can be a heterogeneous computing server) can be allocated and released by the AI ​​framework code and used by the heterogeneous operator code. Therefore, stubs can be set in both the AI ​​framework code and the heterogeneous operator code to monitor memory operation information (memory usage, etc.) on both sides, thereby enabling anomaly detection. A stub, or simply a "stub," is a program segment used to replace a part of the functionality. Stubs can be used to simulate the behavior of existing programs or as a temporary replacement for code to be developed. Stubs can include software stubs or hardware stubs; Figure 4 illustrates this with an example of a software stub.

[0097] The anomaly detection module 404 is used to perform anomaly detection on heterogeneous operators based on the operation information of memory operations of the AI ​​framework and the operation information of memory operations of at least one heterogeneous operator, and obtain anomaly detection results. For example, the anomaly detection module 404 summarizes the operation information of memory operations of the AI ​​framework and the operation information of memory operations of heterogeneous operators, inputs the summarized memory operation information into an operator detection tool for detection, and obtains anomaly detection results. Furthermore, the anomaly detection module 404 is also used to perform anomaly detection on the AI ​​framework based on the operation information of memory operations of the AI ​​framework, and obtain anomaly detection results. The anomaly detection module 404 can call at least one detection algorithm; for example, the anomaly detection module 404 can call a memory out-of-bounds detection algorithm and a contention detection algorithm to detect memory out-of-bounds anomalies and memory contention problems.

[0098] The results display module 406 is used to display anomaly detection results. This module supports multiple display methods. One method is to output the anomaly API to a log file; another is to present the anomaly API to the user (this method can also be called screen display); and yet another method is to provide the anomaly API to the integrated application (or upper-level integrated module) via the results display API.

[0099] In some possible implementations, the anomaly detection system 400 may further include an operation reconstruction module 403. The operation reconstruction module 403 is used to extract key information from the information obtained from the unified information perception module 402 and reconstruct the operation based on the extracted key information. Specifically, the operation reconstruction module 403 can process or reduce the data obtained from the unified information perception module 402 for different detection tasks to obtain key information. The key information may be related to the detection task or the anomaly detection algorithm; different detection tasks or different anomaly detection algorithms may require different information. For example, memory detection only concerns memory; therefore, the operation reconstruction module 403 can extract the memory allocated to the operator and then reconstruct the operation information of the memory operation based on the memory allocated to the operator. The reconstructed operation information of the memory operation can be used for anomaly detection, for example, as input to an operator detection tool to perform anomaly detection for heterogeneous operators, thereby identifying anomalies in the process from the AI ​​framework to the heterogeneous operator kernel or anomalies within the heterogeneous operator kernel itself.

[0100] In the example shown in Figure 4, the anomaly detection system 400 achieves collaborative anomaly detection by uniformly aggregating and processing the operation information of memory operations on the AI ​​framework side and the heterogeneous operator side. Further, referring to an interface call diagram shown in Figure 5, the AI ​​framework can call the result display API provided by the result display module 406 of the anomaly detection system 400, thereby achieving a unified display of anomaly detection results for both the AI ​​framework and heterogeneous operators on the AI ​​framework side. Moreover, the AI ​​framework's code includes framework APIs (such as the PyTorch API), operator APIs, and operator kernel APIs. By establishing mapping relationships between the framework APIs, operator APIs, and operator kernel APIs, when an anomaly is detected, the user only needs to process the outermost framework API to repair or avoid the anomaly.

[0101] In this system, the user can handle the outermost framework API by replacing it. As shown in Figure 6, the user can trigger the startup of an AI model. The anomaly detection system 400 starts the AI ​​model, and the AI ​​framework of the AI ​​model can call the result display API of the anomaly detection system 400 to display the abnormal API of the AI ​​framework. This abnormal API may be a framework API with an anomaly outside the AI ​​framework. The operator kernel API called by this framework API has a memory anomaly. The user can trigger the replacement of the framework API with an anomaly outside the AI ​​framework. In response to the user-triggered replacement operation, the anomaly detection system 400 replaces the framework API, for example, by replacing the current framework API with a framework API that calls the operator kernel API executed on other execution devices, in order to fix the above-mentioned anomaly. The other execution devices may include, but are not limited to, the CPU on the host side, other local acceleration devices, and remote acceleration devices. Specifically, the anomaly detection system 400 may also include an anomaly handling module (not shown in Figure 4). The execution device of the abnormal API includes a first acceleration device that executes at least one heterogeneous operator. The anomaly handling module is used to switch the execution device of the abnormal API from the first acceleration device to the host or a second acceleration device. In some possible implementations, the exception handling module can also be used to repair the code of heterogeneous operators associated with the exception API. Once all exception APIs are repaired, the exception detection system 400 can determine that the AI ​​model has no memory exceptions.

[0102] Based on the anomaly detection system 400 in Figure 4, this application also provides an anomaly detection method. The anomaly detection method of this application will be described in detail below with reference to embodiments.

[0103] Referring to Figure 7, a flowchart of an anomaly detection method is shown. The method includes the following steps:

[0104] S702, the anomaly detection system 400 obtains the memory operation information of the AI ​​framework during the AI ​​model's operation from the host of the computing server.

[0105] AI models include models built on AI frameworks, and each AI model may include the AI ​​framework and at least one heterogeneous operator. Accordingly, AI models can be deployed heterogeneously on computing servers. Specifically, the AI ​​framework of the AI ​​model is deployed on the host of the computing server, and at least one heterogeneous operator of the AI ​​model is deployed on the acceleration device of the computing server.

[0106] The operational information for memory operations within the AI ​​framework can include the original structure of the heterogeneous operator's parameters on the AI ​​framework side. The heterogeneous operator's parameters include its input and output parameters. The original structure records the range of memory requested or allocated for the heterogeneous operator's parameters. This memory range can be represented by a start address and length, or by a start address and an end address. Therefore, the original structure of the heterogeneous operator's parameters on the AI ​​framework side can include the start address and length of the memory requested for the heterogeneous operator's parameters, or it can include the start address and end address of the memory requested for the heterogeneous operator's parameters. The original structure can be represented in matrix form; for example, the original structure of the heterogeneous operator's parameters on the AI ​​framework side can be a matrix [m, n], where m represents the matrix length and n represents the matrix width. The m elements in each row of the matrix indicate the memory range of one of the heterogeneous operator's parameters; for example, m can be 2, and n can be equal to the number of heterogeneous operator's parameters.

[0107] Specifically, referring to Figure 8, which illustrates the calling relationship of the software stack during the normal operation of an AI model, the AI ​​model is deployed on heterogeneous computing devices, such as heterogeneous computing servers. The host side of the computing server includes the AI ​​framework and runtime of the AI ​​model, while the device side includes the operator kernels of heterogeneous operators. The AI ​​framework calls heterogeneous operators and requests device memory based on the runtime, and a memory management module exists within the AI ​​framework to improve memory utilization. The computational logic of each operator kernel is determined by its input parameters. To reduce the computational load on the device side, preparation work for operator execution can generally be completed on the AI ​​framework side, such as filling the input parameters of the operator kernel according to the format required by the operator kernel.

[0108] Taking the heterogeneous operator y = x + b as an example, x is the input parameter (i.e., input parameter), and y is the output parameter (i.e., output parameter). The original structure of the parameters x and y of the heterogeneous operator on the AI ​​framework side is a matrix, while on the operator kernel side it can be a starting address and computational specifications. The computational specifications can be obtained through runtime transformations. To accurately determine the actual usable memory range of the heterogeneous operator, the anomaly detection system can obtain the aforementioned original structure from the host computer of the computing server. For example, it can obtain the original structure from the AI ​​framework or runtime on the host side, thereby obtaining operational information about the memory operations of the AI ​​framework during the AI ​​model's execution.

[0109] The unified information perception module 402 of the anomaly detection system 400 can obtain the memory operation information of the AI ​​framework during the AI ​​model's operation through various methods. Figure 8 illustrates how the anomaly detection system 400 obtains the memory operation information of the AI ​​framework during the AI ​​model's operation by setting software stubs for the AI ​​framework. Software stubs are merely one specific implementation of the stub program; in practical applications, hardware stubs can also be set for the AI ​​framework, and the anomaly detection system 400 can obtain the memory operation information of the AI ​​framework during the AI ​​model's operation from the hardware stubs. It should be noted that the anomaly detection system 400 can use static or dynamic instrumentation to set software stubs in the AI ​​framework's code, or set corresponding hardware stubs on the host side. Considering that the original structure can be transformed at runtime, software stubs can also be set at runtime to obtain the memory operation information of the AI ​​framework during the AI ​​model's operation from the software stubs set at runtime.

[0110] In some possible implementations, the unified information perception module 402 of the anomaly detection system 400 can also obtain the memory operation information of the AI ​​framework during the AI ​​model's execution through interface hijacking. Specifically, the AI ​​framework may include memory operation APIs, such as memory allocation APIs, memory access APIs, or memory release APIs. Replacement APIs for these memory operation APIs are used to implement interface hijacking and obtain the memory operation information of the AI ​​framework during the AI ​​model's execution. The unified information perception module 402 of the anomaly detection system 400 can then obtain the memory operation information of the AI ​​framework during the AI ​​model's execution through these replacement APIs.

[0111] Using the `malloc` function as an example of the memory allocation API, developers can define custom functions with the same functionality as `malloc`. These custom functions can be compiled into dynamic libraries, which have higher loading priority than external libraries. The dynamic library's API can also output memory operation information of the AI ​​framework. When the AI ​​framework needs to call the `malloc` function to allocate memory, it can load the dynamic library corresponding to the custom function through the environment variable `LD_PRELOAD`, instead of loading the external library's `malloc` function. Correspondingly, the unified information perception module 402 of the anomaly detection system 400 can obtain memory operation information of the AI ​​framework during AI model execution through the dynamic library's API, such as the range of memory allocated for heterogeneous operators.

[0112] In other possible implementations, code can also be added to the AI ​​framework, such as code blocks for monitoring memory operations. The unified information perception module 402 of the anomaly detection system 400 can obtain the operation information of the AI ​​framework's memory operations during the AI ​​model's operation through the code blocks.

[0113] S704, the anomaly detection system 400 acquires the operation information of memory operations of at least one heterogeneous operator.

[0114] Similar to the AI ​​framework, software stubs can also be set for heterogeneous operators. Referring again to Figure 8, software stubs 1 to N are set for the operator kernel of the heterogeneous operator. The unified information perception module 402 of the anomaly detection system 400 can obtain the operation information of at least one heterogeneous operator's memory operations from the software stubs set for the operator kernel of the heterogeneous operator. Figure 8 is merely a specific implementation of obtaining the operation information of at least one heterogeneous operator's memory operations from the stub program set for at least one heterogeneous operator. In practical applications, hardware stubs can also be set on the device side, and the anomaly detection system 400 can obtain the operation information of at least one heterogeneous operator's memory operations from the hardware stubs set for at least one heterogeneous operator.

[0115] In some possible implementations, the anomaly detection system 400 can also obtain the operation information of memory operations of at least one heterogeneous operator among multiple heterogeneous operators through the memory operation API of the heterogeneous operators. For example, the unified information perception module 402 of the anomaly detection system 400 can call the memory operation API of the heterogeneous operators and obtain the return value of the memory operation API, thereby obtaining the operation information of the memory operations of the heterogeneous operators. As another example, the unified information perception module 402 of the anomaly detection system 400 can obtain the operation information of the memory operations of the heterogeneous operators by hijacking the interface of the memory operation API of the heterogeneous operators.

[0116] S706, Anomaly Detection System 400 records the mapping relationship between the AI ​​framework's framework API and at least one heterogeneous operator.

[0117] Specifically, the anomaly detection system 400 can record the mapping relationship between the AI ​​framework's framework API and at least one heterogeneous operator during AI model runtime. The anomaly detection system 400 can determine the mapping relationship between the framework API and at least one heterogeneous operator based on the input and output of the framework API and the input and output of at least one heterogeneous operator.

[0118] S708, the anomaly detection system 400 performs anomaly detection for the AI ​​framework based on the operation information of the AI ​​framework's memory operations.

[0119] Specifically, the anomaly detection system 400 can perform anomaly detection for the AI ​​framework based on the memory operation information of the AI ​​framework and through the anomaly detection capabilities of the AI ​​framework. For example, the anomaly detection system 400 can use the memory operation information of the AI ​​framework as the interface parameter of the AI ​​framework's monitoring interface (such as enable_cuda_sanitizer), and monitor the relationship between the AI ​​framework's allocation and release of global memory on the device side and stream synchronization through the monitoring interface, thereby realizing anomaly detection for the AI ​​framework.

[0120] The anomaly detection system 400 can perform anomaly detection on the framework APIs of the AI ​​framework during operation. For example, during AI model runtime, there are non-maskable communication operations. These non-maskable communication operations are those that do not overlap with computation time and typically require waiting for computation to complete. When the AI ​​model uses a parallel training approach, it can generate a large number of non-maskable communication operations. To avoid wasting computational resources during the execution of these non-maskable communication operations, the anomaly detection system 400 can perform anomaly detection on some framework APIs.

[0121] Furthermore, when the anomaly detection system 400 is deployed in a multi-machine, multi-GPU computing device cluster, the anomaly detection system 400 can detect different framework APIs on different hosts and devices, thereby achieving comprehensive detection of framework APIs.

[0122] It should be noted that S708 is an optional step in the embodiments of this application, and the anomaly detection method of this application may not need to execute S708.

[0123] S710, the anomaly detection system 400 performs anomaly detection for heterogeneous operators based on the operation information of the memory operations of the AI ​​framework and the operation information of the memory operations of at least one heterogeneous operator.

[0124] The AI ​​framework's memory operations can include memory allocation. The AI ​​framework can allocate memory for heterogeneous operators, and correspondingly, the heterogeneous operators can use the allocated memory for computation. To improve computational performance, the runtime can also optimize the heterogeneous operators to be executed, such as splitting or merging them, and optimizing their data arrangement format. Based on this, the runtime can convert the original structure of the heterogeneous operator parameters on the AI ​​framework side into starting addresses and computational specifications, allowing the heterogeneous operators to perform computations according to these specifications.

[0125] The memory operation information of heterogeneous operators can include the starting address and the computational specifications obtained after runtime transformation. By aggregating the memory operation information of the AI ​​framework and the memory operation information of heterogeneous operators, the anomaly detection system 400 can fill in the missing information on the device side and avoid the perception gap between the host side and the device side.

[0126] The anomaly detection system 400 can perform anomaly detection for heterogeneous operators based on the summarized operation information and its heterogeneous operator anomaly detection capabilities. Since the summarized operation information includes memory operation information obtained from the AI ​​framework side, such as the range of memory allocated for heterogeneous operators, the anomaly detection system 400 can identify not only heterogeneous operator kernel anomalies but also anomalies from the AI ​​framework to the heterogeneous operator kernel during the heterogeneous operator kernel's runtime. For example, for operator kernels of concurrently executing heterogeneous operators, the anomaly detection system 400 can compare the range of memory allocated for the operator kernel parameters to check for overlap, thereby determining whether memory anomalies exist. Furthermore, the anomaly detection system 400 can also identify anomalies from the AI ​​framework to the heterogeneous operator kernel based on the range of memory allocated by the AI ​​framework for the heterogeneous operator and the actual memory addresses accessed by the heterogeneous operator kernel.

[0127] The anomaly detection system 400 can typically perform anomaly detection against AI frameworks and / or heterogeneous operators after anomaly detection capabilities are enabled. This application provides multiple methods for enabling anomaly detection capabilities, which are described below.

[0128] In some possible implementations, the anomaly detection system 400 can enable anomaly detection capabilities by configuring interface parameters of an anomaly detection interface (such as an API used to enable or disable anomaly detection capabilities) or environment variables as target values. For example, the anomaly detection system 400 can assign the target value to an environment variable used to enable anomaly detection capabilities, thereby enabling the anomaly detection capabilities.

[0129] In other possible implementations, the anomaly detection system 400 can configure the interface parameters or environment variables of the anomaly detection interface to target values ​​when the application under debugging is started, thereby enabling anomaly detection capabilities. Here, the application under debugging is an application developed based on an AI model. When the anomaly detection system 400 is a standalone detection tool, it can start the application under debugging and record the range of memory allocated by the AI ​​framework to the heterogeneous operator. This information, combined with the anomaly detection capabilities of the heterogeneous operator, can identify whether there are anomalies in the heterogeneous operator and whether there are anomalies between the AI ​​framework and that heterogeneous operator.

[0130] The anomaly detection system 400 can also be integrated into an AI framework, for example, as a functional module of the AI ​​framework. The anomaly detection system 400 can be configured with target values ​​for interface parameters or environment variables of the anomaly detection interface during AI framework runtime to enable anomaly detection capabilities.

[0131] To improve detection efficiency, the anomaly detection system 400 can enable anomaly detection capabilities within a localized area. For example, during the operation of an AI model, the anomaly detection system 400 can record summary information of the framework APIs used by the AI ​​framework, construct API use cases based on this summary information, and then perform anomaly detection on the running framework APIs based on these API use cases.

[0132] It should be noted that in S708 and S710, the anomaly detection system 400 can invoke at least one anomaly detection algorithm during anomaly detection. Specifically, the anomaly detection system 400 can determine the type of anomaly to be detected based on the current detection task or the currently effective anomaly detection strategy, and then invoke the corresponding anomaly detection algorithm. For example, if the current detection task includes a memory anomaly detection task, the anomaly detection algorithm can include a shadow memory algorithm. Specifically, the process's memory space can be divided into two main categories: application memory (Mem) and shadow memory (Shadow). Mem belongs to the application process and is used by the application process, while Shadow is used to store shadow values. Shadow values ​​are the markers (poison states) of each byte in Mem, where bytes that the process cannot access are marked as "poisoned". Before accessing the address (address, addr), the poison state of addr is first checked in shadow memory. If the poison state is "poisoned", then an illegal access can be determined.

[0133] S712. When the anomaly detection result indicates that an anomaly has been detected, the anomaly detection system 400 determines the anomaly API based on the mapping relationship between the AI ​​framework's framework API and at least one heterogeneous operator.

[0134] Specifically, when the anomaly detection result for a heterogeneous operator indicates that an anomaly has been detected, the anomaly detection system 400 can query the mapping relationship between the framework API and at least one heterogeneous operator based on the heterogeneous operator to determine the anomalous API. The anomalous API can be the framework API that called the aforementioned heterogeneous operator that caused the anomaly.

[0135] Based on this, the anomaly detection system 400 can switch the execution device of the abnormal API to repair it. The execution device of the abnormal API may include a first acceleration device that executes at least one heterogeneous operator. The anomaly detection system 400 can switch the execution device of the abnormal API from the first acceleration device to the host or a second acceleration device. The second acceleration device may include, but is not limited to, other local acceleration devices or remote acceleration devices. For example, switching the execution device of the abnormal API to the host can be achieved by switching the operator kernel of the heterogeneous operator called in the abnormal API to an operator kernel executed on the host-side CPU. Alternatively, the anomaly detection system 400 can repair the code of the heterogeneous operator associated with the abnormal API. Considering repair efficiency, in some cases, the anomaly detection system 400 can use hot patches for specific operators from previous versions to achieve timely anomaly repair. Furthermore, the anomaly detection system 400 can also use its awareness of memory operations during runtime to optimize memory allocation algorithms and improve overall operating efficiency.

[0136] In some possible implementations, the anomaly detection system 400 can also display the anomaly API. For example, the anomaly detection system 400 can directly present the anomaly API to the user, output the anomaly API to a log file, or provide the anomaly API to an integrated application through a result display API. The integrated application can be an application that integrates the anomaly detection system 400, such as a maintenance platform. By reporting the anomaly API to the maintenance platform, the anomaly detection system 400 can promptly notify the user of the existence of anomalies.

[0137] Based on the above description, this application provides an anomaly detection method. This method obtains memory operation information of the AI ​​framework during AI model execution from the host of the computing server, and memory operation information of at least one heterogeneous operator from the acceleration device of the computing server. It fills in the gaps in memory operation information that is perceptible on the AI ​​framework side but missing on the operator side. Based on this supplemented information, more comprehensive anomaly detection can be performed, thereby detecting more cross-domain anomalies and improving anomaly detection capabilities. Furthermore, by combining the mapping relationship between the framework API and heterogeneous operators, this method can identify anomalous APIs, thereby enabling rapid localization of anomalies and laying the foundation for rapid anomaly repair, thus improving the accuracy of the AI ​​model.

[0138] Next, the anomaly detection method of this application will be introduced in conjunction with specific application scenarios.

[0139] Referring to Figure 9, which illustrates an application scenario of an anomaly detection method, in this scenario, the anomaly detection system 400 can be deployed independently of the application being debugged. The application being debugged is an application developed based on an AI model. The anomaly detection system 400 can perform the following steps to detect anomalies:

[0140] S902, Anomaly Detection System 400 starts the application being debugged.

[0141] S904, Anomaly Detection System 400 activates anomaly detection capability according to the anomaly detection strategy.

[0142] The anomaly detection strategy can be a user-configured strategy for the application being debugged, indicating the types of anomalies to be detected in the application. For example, the anomaly detection strategy may indicate whether the application being debugged is experiencing memory anomalies, race conditions, or other similar anomalies.

[0143] In some possible implementations, anomaly detection capabilities can be enabled on demand. The anomaly detection system 400 can enable its anomaly detection capabilities when triggering conditions are met. These triggering conditions can be set according to business requirements. For example, when the anomaly detection system 400 starts the application being debugged, it can enable its anomaly detection capabilities. Furthermore, the anomaly detection capabilities can also be enabled in stages. For example, the anomaly detection system 400 can enable partial detection capabilities in the initial stage (such as the stage starting with the application being debugged) to detect certain anomaly types, and then enable full detection capabilities in subsequent stages to detect all anomaly types supported by the anomaly detection system 400.

[0144] The anomaly detection system 400 can enable its anomaly detection capability in several ways. One way is to configure the interface parameters of the anomaly detection interface of the anomaly detection system 400 as the target value to enable the anomaly detection capability. Another way is to configure the environment variable of the anomaly detection system 400 as the target value to enable the anomaly detection capability.

[0145] S906, the anomaly detection system 400 determines whether there are still operators to be executed. If yes, then executes S908, S910, and S912. If no, then executes S924.

[0146] S908, the anomaly detection system 400 obtains the memory operation information of the AI ​​framework from the host of the computing server. Then it executes S914.

[0147] Memory operations within the AI ​​framework can include runtime-based memory allocation for heterogeneous operators. This allocated memory can be used to pass input parameters to the heterogeneous operators. Based on this, the operational information of this memory operation can include the original structure of the heterogeneous operator's input parameters on the AI ​​framework side. Specifically, the original structure of the heterogeneous operator's input parameters on the AI ​​framework side can be used to determine the range of memory allocated to the heterogeneous operators.

[0148] The S910 anomaly detection system 400 obtains operation information of memory operations of heterogeneous operators from the acceleration devices of the computing server.

[0149] The operation information for heterogeneous operator memory operations can include addresses in device memory. Furthermore, the operation information for heterogeneous operator memory operations can also include computation specifications. These computation specifications can be obtained through runtime conversion on the host side.

[0150] S912, the mapping relationship between the anomaly detection system 400 record framework API and at least one heterogeneous operator.

[0151] S914, the anomaly detection system 400 performs anomaly detection for the AI ​​framework based on the operation information of the AI ​​framework's memory operations.

[0152] S916, the anomaly detection system 400 performs anomaly detection for heterogeneous operators based on the operation information of memory operations in the AI ​​framework and the operation information of memory operations in heterogeneous operators.

[0153] The memory operation information of the AI ​​framework can supplement the missing information on the heterogeneous operator side. The anomaly detection system 400 summarizes the memory operation information of the AI ​​framework and the memory operation information of the heterogeneous operator, and then uses the summarized operation information as input to call the anomaly detection capability of the heterogeneous operator for anomaly detection.

[0154] S918, the anomaly detection system 400 determines whether the anomaly detection for the current heterogeneous operator is complete. If yes, it returns to S906; otherwise, it waits for S912 to S916 to complete.

[0155] The anomaly detection system 400 can determine whether anomaly detection for the current heterogeneous operator is complete by reading the anomaly detection results. When anomaly detection for the current heterogeneous operator is complete, the anomaly detection system 400 returns to S906 to determine whether there is a next heterogeneous operator to be executed. If there is, the anomaly detection system 400 can perform anomaly detection for the next heterogeneous operator to be executed. If anomaly detection for the current heterogeneous operator is not complete, it can wait for the anomaly detection to complete before returning to S906.

[0156] S920. When the anomaly detection result indicates that an anomaly has occurred, the anomaly detection system 400 can determine the anomaly API based on the mapping relationship between the framework API and at least one heterogeneous operator.

[0157] S922, Anomaly Detection System 400 can update anomaly detection strategies.

[0158] Specifically, when an anomaly is detected, the anomaly detection system 400 can update its anomaly detection strategy to full detection. Accordingly, the anomaly detection system 400 can execute full detection tasks during subsequent anomaly detection. Full detection tasks are the detection tasks corresponding to various anomaly types that the anomaly detection system 400 supports detecting, such as memory anomaly detection tasks, memory contention detection tasks, and other types of anomaly detection tasks.

[0159] S924, Anomaly Detection System 400 terminates anomaly detection process.

[0160] This method initiates the debugged application via an anomaly detection system 400. During the execution of the AI ​​model in the debugged application, operational information from the memory operations of the AI ​​framework and heterogeneous operators is aggregated. This allows for the completion of missing information on the heterogeneous operator side. Anomaly detection based on this completed information improves the anomaly detection rate. Furthermore, when an anomaly occurs, the recorded mapping relationship between the framework API and heterogeneous operators allows for backtracking of the anomaly API, enabling rapid anomaly localization. Users can quickly fix anomalies by temporarily replacing the execution device of the anomaly API.

[0161] Referring to Figure 10, which illustrates another application scenario of an anomaly detection method, in this scenario, the anomaly detection system 400 can be built into an AI framework, and the anomaly detection system 400 can perform the following steps to detect anomalies:

[0162] S1002. When the AI ​​framework is running, the anomaly detection system 400 enables anomaly detection capabilities according to the anomaly detection strategy.

[0163] To improve detection efficiency, the anomaly detection system 400 can initially enable some anomaly detection capabilities. Then, as the AI ​​model runs, the anomaly detection system 400 can update its anomaly detection strategy, thereby adjusting the enabled anomaly detection capabilities.

[0164] Specifically, the anomaly detection system 400 can enable anomaly detection capabilities by configuring the interface parameters of the anomaly detection interface as target values; or the anomaly detection system 400 can enable anomaly detection capabilities by configuring environment variables as target values. It should be noted that S1002 is only one way for the anomaly detection system 400 to enable its anomaly detection capabilities; the anomaly detection system 400 can also enable its anomaly detection capabilities when other triggering conditions are met.

[0165] S1004, the anomaly detection system 400 determines whether there are still operators to be executed. If yes, then execute S1006, S1008, and S1010. If no, then execute S1022.

[0166] S1006, The anomaly detection system 400 obtains the memory operation information of the AI ​​framework from the host of the computing server. Then it executes S1012.

[0167] S1008, the anomaly detection system 400 obtains operation information of memory operations of at least one heterogeneous operator from the acceleration device of the computing server.

[0168] The mapping relationship between S1010, the anomaly detection system 400 record framework API, and at least one heterogeneous operator.

[0169] S1012, the anomaly detection system 400 performs anomaly detection for the AI ​​framework based on the memory operation information of the AI ​​framework.

[0170] S1014, the anomaly detection system 400 performs anomaly detection for heterogeneous operators based on the operation information of memory operations in the AI ​​framework and the operation information of memory operations in heterogeneous operators.

[0171] S1016, The anomaly detection system 400 checks whether the anomaly detection for the current heterogeneous operator is complete. If yes, it returns to S1004; otherwise, it waits for S1010 to S1014 to complete.

[0172] S1018. When the anomaly detection result indicates that an anomaly has occurred, the anomaly detection system 400 can determine the anomaly API based on the mapping relationship between the framework API and at least one heterogeneous operator.

[0173] S1020 and Anomaly Detection System 400 can update anomaly detection strategies.

[0174] S1022, Anomaly Detection System 400: End of Anomaly Detection Process.

[0175] The specific implementation of S1004 to S1022 can be found in the description of the relevant content of the embodiment shown in Figure 9, and will not be repeated here.

[0176] Furthermore, considering that the AI ​​framework can provide implementations of the same API on different devices—for example, for the addition operator, the AI ​​framework can provide an implementation of the addition operator on a GPU or on a CPU—the AI ​​framework can also quickly fix exceptions by switching the execution device of the exception API when an exception API is identified.

[0177] Referring to Figure 11, a flowchart illustrating anomaly detection and repair is provided. Figure 11 demonstrates an example of anomaly detection during AI model training using an anomaly detection system 400 integrated into an AI framework. The anomaly detection capability of the AI ​​framework can be combined with its repair capability to achieve anomaly detection and repair. The method specifically includes the following steps:

[0178] S1102. When the AI ​​framework is running, enable anomaly detection capabilities.

[0179] S1104, The AI ​​framework executes a training step. During execution, steps S1106, S1108, and S1110 are performed.

[0180] S1106, The AI ​​framework obtains the memory operation information of the AI ​​framework from the host of the computing server. Then it executes S1112.

[0181] S1108, the AI ​​framework obtains operation information of memory operations of at least one heterogeneous operator from the acceleration device of the computing server.

[0182] S1110, the mapping relationship between the AI ​​framework record framework API and at least one heterogeneous operator.

[0183] S1112. The AI ​​framework performs anomaly detection based on the memory operation information of the AI ​​framework.

[0184] S1114. The AI ​​framework performs anomaly detection for heterogeneous operators based on the operation information of the AI ​​framework's memory operations and the operation information of the heterogeneous operators' memory operations.

[0185] S1116. Did the AI ​​framework detect any anomalies during this training step? If yes, proceed to S1118. If no, jump to the next training step and execute S1104.

[0186] S1118. The AI ​​framework determines abnormal APIs based on the mapping relationship.

[0187] S1120, The AI ​​framework updates the implementation of the exception API. Then, it returns to S1104.

[0188] Specifically, in AI model training scenarios, AI frameworks can perform anomaly detection at the training step (step) level. When an anomaly is detected, the AI ​​framework can discard the execution result of that step, identify the anomalous API, and update its implementation to match that of an API implemented on another device. For example, the AI ​​framework can update the implementation of the anomalous API using local CPU capabilities or other local acceleration device capabilities; alternatively, it can use remote acceleration device capabilities to update the implementation of the anomalous API.

[0189] After updating the implementation of the exception API, the AI ​​framework can return S1104 and re-execute the training step based on the updated implementation of the exception API.

[0190] As described above, the anomaly detection capability of the AI ​​framework can be combined with its repair capability. When an anomaly is detected in a heterogeneous operator corresponding to the AI ​​framework, the implementation of the heterogeneous operator can be replaced in the anomaly API, thereby quickly fixing the anomaly. In this way, automatic repair of the AI ​​model training process can be achieved without affecting the continuous high-performance operation of the AI ​​model.

[0191] Based on the aforementioned method embodiments, this application also provides an anomaly detection system 400. The anomaly detection system 400 will be described below from a functional modular perspective with reference to the accompanying drawings.

[0192] Referring to Figure 4, which shows a schematic diagram of an anomaly detection system, the anomaly detection system 400 includes:

[0193] The unified information perception module 402 is used to obtain the operation information of the memory operation of the AI ​​framework during the operation of the AI ​​model from the host of the computing server. The AI ​​model includes the AI ​​framework and at least one heterogeneous operator. The operation information of the memory operation of the AI ​​framework includes the original structure of the parameters of the at least one heterogeneous operator on the AI ​​framework side, and the operation information of the memory operation of the at least one heterogeneous operator obtained from the acceleration device of the computing server.

[0194] The unified information perception module 402 is also used to record the mapping relationship between the AI ​​framework's framework application programming interface (API) and the at least one heterogeneous operator.

[0195] Anomaly detection module 404 is used to perform anomaly detection on the heterogeneous operator based on the operation information of the memory operation of the AI ​​framework and the operation information of the memory operation of the at least one heterogeneous operator, and obtain anomaly detection results;

[0196] The anomaly detection module 404 is further configured to determine the anomaly API based on the mapping relationship between the framework API of the AI ​​framework and the at least one heterogeneous operator when the anomaly detection result indicates that an anomaly has been detected.

[0197] For example, the unified information perception module 402 and the anomaly detection module 404 described above can be implemented in hardware or in software.

[0198] When implemented through software, the unified information perception module 402 and the anomaly detection module 404 can be applications running on computing devices, such as computing engines. These applications can also be virtualized and provided to users as virtualization services. Virtualization services can include virtual machine (VM) services, bare metal server (BMS) services, or container services. Specifically, a VM service can be a service that uses virtualization technology to create a pool of virtual machine (VM) resources on multiple physical hosts, providing VMs for users to use on demand. A BMS service is a service that uses virtualization technology to create a pool of BMS resources on multiple physical hosts, providing BMS for users to use on demand. A container service is a service that uses virtualization technology to create a pool of container resources on multiple physical hosts, providing containers for users to use on demand. A VM is a simulated virtual computer, that is, a logical computer. A BMS is a scalable, high-performance computing service with computing performance indistinguishable from traditional physical machines, featuring secure physical isolation. A container is a kernel virtualization technology that provides lightweight virtualization to isolate user space, processes, and resources. It should be understood that the VM service, BMS service, and container service mentioned above are merely specific examples. In practical applications, virtualization services can also include other lightweight or heavyweight virtualization services, which are not specifically limited here.

[0199] When implemented in hardware, the unified information sensing module 402 and the anomaly detection module 404 may include at least one computing device, such as a server. Alternatively, the unified information sensing module 402 and the anomaly detection module 404 may also be devices implemented using application-specific integrated circuits (ASICs) or programmable logic devices (PLDs). The aforementioned PLD may be implemented using complex programmable logical devices (CPLDs), field-programmable gate arrays (FPGAs), generic array logic (GALs), or any combination thereof.

[0200] In some possible implementations, the unified information perception module 402 is specifically used for:

[0201] By using stub programs set up for the AI ​​framework, operation information of memory operations of the AI ​​framework during the running of the AI ​​model is obtained from the host of the computing server.

[0202] In some possible implementations, the unified information perception module 402 is specifically used for:

[0203] By replacing the memory operation API in the AI ​​framework, the operation information of the AI ​​framework's memory operation during the AI ​​model's execution can be obtained from the host of the computing server.

[0204] In some possible implementations, the unified information perception module 402 is specifically used for:

[0205] The AI ​​framework obtains memory operation information from the host of the computing server during the AI ​​model's operation by using the code block in the AI ​​framework used to monitor memory operations.

[0206] In some possible implementations, the memory operation information of the AI ​​framework includes the starting address and length of the memory allocated for the parameters of the at least one heterogeneous operator. Alternatively, the memory operation information of the AI ​​framework includes the starting address and ending address of the memory allocated for the parameters of the at least one heterogeneous operator.

[0207] In some possible implementations, the anomaly detection system 400 may also include an operation reconstruction module 403. The operation reconstruction module 403 is used to extract key information from the operation information obtained from the unified information perception module 402 and reconstruct the operation based on the extracted key information. The reconstructed memory operation information can be used for anomaly detection, for example, as input to an operator detection tool to perform anomaly detection for heterogeneous operators, thereby identifying anomalies in the process from the AI ​​framework to the heterogeneous operator kernel or anomalies within the heterogeneous operator kernel itself.

[0208] The operation reconstruction module 403 can be implemented in hardware or software. When implemented in software, the operation reconstruction module 403 can be an application running on a computing device; further, this application can be a virtualization service such as a VM service, BMS service, or container service. When implemented in hardware, the operation reconstruction module 403 can include at least one computing device, such as a server. Alternatively, the operation reconstruction module 403 can also be a device implemented using an ASIC or a PLD.

[0209] In some possible implementations, the execution device of the exception API includes a first acceleration device that executes at least one heterogeneous operator, and the system 400 further includes:

[0210] An exception handling module (not shown in Figure 4) is used to switch the execution device of the exception API from the first acceleration device to the host or the second acceleration device.

[0211] Similar to the unified information perception module 402 and the anomaly detection module 404, the anomaly handling module can be implemented in hardware or software. When implemented in software, the anomaly handling module can be an application running on a computing device, such as a computing engine. Furthermore, the anomaly handling module can also be provided to users as a virtualization service, such as a VM service, BMS service, or container service. When implemented in hardware, the anomaly handling module can include at least one computing device, such as a server. Alternatively, the anomaly handling module can also be a device implemented using an ASIC or a PLD.

[0212] In some possible implementations, the system 400 further includes:

[0213] An exception handling module (not shown in Figure 4) is used to repair the code of the heterogeneous operators associated with the exception API.

[0214] In some possible implementations, the system 400 further includes:

[0215] The result display module 406 is used to output the abnormal API to a log file; or to present the abnormal API to the user; or to provide the abnormal API to the integrated application through the result display API.

[0216] The results display module 406 can be implemented in hardware or software. When implemented in software, the results display module 406 can be an application running on a computing device, such as a computing engine. Furthermore, the results display module 406 can also be provided to users as a virtualization service, such as a VM service, BMS service, or container service. When implemented in hardware, the results display module 406 can include at least one computing device, such as a server. Alternatively, the results display module 406 can also be a device implemented using an ASIC or a PLD.

[0217] In some possible implementations, the system 400 further includes:

[0218] The configuration module (not shown in Figure 4) is used to configure the interface parameters or environment variables of the anomaly detection interface to the target value in order to enable the anomaly detection capability.

[0219] Configuration modules can be implemented in hardware or software. When implemented in software, a configuration module can be an application running on a computing device, such as a computing engine. Furthermore, the configuration module can also be provided to users as a virtualization service, such as a VM service, BMS service, or container service. When implemented in hardware, a configuration module can include at least one computing device, such as a server. Alternatively, the configuration module can also be a device implemented using an ASIC or a PLD.

[0220] In some possible implementations, the configuration module is specifically used for:

[0221] When the anomaly detection system 400 starts the application being debugged, it configures the interface parameters or environment variables of the anomaly detection interface to the target value to enable the anomaly detection capability. The application being debugged is an application developed based on the AI ​​model.

[0222] In some possible implementations, the anomaly detection system 400 is integrated into the AI ​​framework, and the configuration module is specifically used for:

[0223] When the AI ​​framework is running, configure the interface parameters or environment variables of the anomaly detection interface to the target value to enable the anomaly detection capability.

[0224] This application also provides a computing device 1200. As shown in FIG12, the computing device 1200 includes: a bus 1202, a processor 1204, a memory 1206, and a communication interface 1208. The processor 1204, the memory 1206, and the communication interface 1208 communicate with each other via the bus 1202. The computing device 1200 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 1200.

[0225] Bus 1202 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 12, but this does not imply that there is only one bus or one type of bus. Bus 1202 can include pathways for transmitting information between various components of computing device 1200 (e.g., memory 1206, processor 1204, communication interface 1208).

[0226] Processor 1204 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a neural network processing unit (NPU), and a tensor processing unit (TPU). Computing device 1200 may include one or more processors. In some examples, computing device 1200 may include a CPU; in other examples, computing device 1200 may include at least one CPU and at least one xPU, where the xPU may be an acceleration device such as a GPU, NPU, or TPU for accelerating training or inference.

[0227] The memory 1206 may include volatile memory, such as random access memory (RAM). The memory 1206 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid-state drive (SSD). The memory 1206 stores executable program code, which the processor 1204 executes to implement the aforementioned anomaly detection method. Specifically, the memory 1206 stores instructions for the anomaly detection system 400 to execute the anomaly detection method.

[0228] The communication interface 1208 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 1200 and other devices or communication networks.

[0229] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0230] As shown in Figure 13, the computing device cluster includes at least one computing device 1200. The memory 1206 of one or more computing devices 1200 in the computing device cluster may store instructions for the same anomaly detection system 400 to execute anomaly detection methods.

[0231] In some possible implementations, one or more computing devices 1200 in the computing device cluster can also be used to execute some of the instructions of the anomaly detection system 400 for executing anomaly detection methods. In other words, a combination of one or more computing devices 1200 can jointly execute the instructions of the anomaly detection system 400 for executing anomaly detection methods.

[0232] It should be noted that the memory 1206 in different computing devices 1200 in the computing device cluster can store different instructions for executing some functions of the anomaly detection system 400.

[0233] Figure 14 illustrates one possible implementation. As shown in Figure 14, two computing devices 1200A and 1200B are connected via a communication interface 1208. The memory in computing device 1200A stores instructions for executing the functions of the unified information perception module 402. The memory in computing device 1200B stores instructions for executing the functions of the anomaly detection module 404. Furthermore, the memory in computing device 1200A also stores instructions for executing the functions of the operation reconstruction module 403 and the configuration module. The memory in computing device 1200B also stores instructions for executing the functions of the result display module 406 and the anomaly handling module. In other words, the memory 1206 of computing devices 1200A and 1200B jointly stores the instructions used by the anomaly detection system 400 to execute the anomaly detection method.

[0234] The connection method between the computing device clusters shown in Figure 14 can be considered because the anomaly detection method provided in this application requires a lot of computing resources for anomaly detection. Therefore, it is considered that the functions implemented by the anomaly detection module 404 are performed by independent computing devices, such as computing device 1200B.

[0235] It should be understood that the functions of computing device 1200A shown in Figure 14 can also be performed by multiple computing devices 1200. Similarly, the functions of computing device 1200B can also be performed by multiple computing devices 1200.

[0236] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 15 illustrates one possible implementation. As shown in Figure 15, two computing devices 1200C and 1200D are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this type of possible implementation, the memory 1206 in computing device 1200C stores instructions for executing the functions of the unified information awareness module 402. Simultaneously, the memory 1206 in computing device 1200D stores instructions for executing the functions of the anomaly detection module 404.

[0237] The connection method between the computing device clusters shown in Figure 15 can be considered because the anomaly detection method provided in this application requires a large amount of resources for anomaly detection. Therefore, the functions implemented by the unified information perception module 402 and the anomaly detection module 404 are considered to be executed by different computing devices. Specifically, the functions implemented by the unified information perception module 402 are executed by computing device 1200C, and the functions implemented by the anomaly detection module 404 are executed by computing device 1200D.

[0238] It should be understood that the functions of computing device 1200C shown in Figure 15 can also be performed by multiple computing devices 1200. Similarly, the functions of computing device 1200D can also be performed by multiple computing devices 1200.

[0239] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-described anomaly detection method applied to the anomaly detection system 400.

[0240] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform the above-described anomaly detection method.

[0241] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. An anomaly detection method characterized by, The method is applied to an anomaly detection system, and the method comprises: obtaining operation information of memory operation of an AI framework in an AI model running process from a host of a computing server, wherein the AI model comprises the AI framework and at least one heterogeneous operator, and the operation information of the memory operation of the AI framework comprises an original structure of parameters of the at least one heterogeneous operator on the AI framework side; obtaining operation information of memory operation of the at least one heterogeneous operator from an acceleration device of the computing server; recording a mapping relationship between a framework application programming interface API of the AI framework and the at least one heterogeneous operator; performing anomaly detection for the heterogeneous operator according to the operation information of the memory operation of the AI framework and the operation information of the memory operation of the at least one heterogeneous operator, and obtaining an anomaly detection result; when the anomaly detection result indicates that an anomaly is detected, determining an anomaly API according to the mapping relationship between the framework API of the AI framework and the at least one heterogeneous operator.

2. The method of claim 1, wherein, The operation information of the memory operation of the AI framework in the AI model running process obtained from the host of the computing server comprises: obtaining the operation information of the memory operation of the AI framework in the AI model running process from the host of the computing server through a stub program set for the AI framework.

3. The method of claim 1, wherein, The operation information of the memory operation of the AI framework in the AI model running process obtained from the host of the computing server comprises: obtaining the operation information of the memory operation of the AI framework in the AI model running process from the host of the computing server through a replacement API of a memory operation API in the AI framework.

4. The method of claim 1, wherein, The operation information of the memory operation of the AI framework in the AI model running process obtained from the host of the computing server comprises: obtaining the operation information of the memory operation of the AI framework in the AI model running process from the host of the computing server through a code block for monitoring memory operation in the AI framework.

5. The method according to any one of claims 1 to 4, characterized in that, The operation information of the memory operation of the AI framework comprises a start address and a length of memory applied for parameters of the at least one heterogeneous operator, or the operation information of the memory operation of the AI framework comprises a start address and a termination address of memory applied for the parameters of the at least one heterogeneous operator.

6. The method according to any one of claims 1 to 5, characterized in that, The execution device of the anomaly API comprises a first acceleration device for executing the at least one heterogeneous operator, and the method further comprises: switching the execution device of the anomaly API from the first acceleration device to the host or a second acceleration device.

7. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: repairing code of the heterogeneous operator associated with the anomaly API.

8. The method according to any one of claims 1 to 7, characterized in that, The method further comprises: outputting the anomaly API to a log file; or presenting the anomaly API to a user; or providing the anomaly API to an integrated application through a result display API.

9. The method according to any one of claims 1 to 8, characterized in that, The method further comprises: configuring an interface parameter or an environment variable of an anomaly detection interface to a target value to start an anomaly detection capability.

10. The method of claim 9, wherein, The configuration of the interface parameter or the environment variable of the anomaly detection interface to the target value to start the anomaly detection capability comprises: When the abnormality detection system starts the debugged application, an interface parameter or an environment variable of an abnormality detection interface is configured as a target value to start an abnormality detection capability, and the debugged application is an application developed based on the AI model.

11. The method of claim 9, wherein, The abnormality detection system is integrated in the AI framework, and the interface parameter or the environment variable of the abnormality detection interface is configured as the target value to start the abnormality detection capability, including: When the AI framework is running, the interface parameter or the environment variable of the abnormality detection interface is configured as the target value to start the abnormality detection capability.

12. An anomaly detection system, characterized by, The system comprises: a unified information perception module configured to obtain operation information of memory operations of an AI framework in an AI model running process from a host of a computing server, wherein the AI model comprises the AI framework and at least one heterogeneous operator, and the operation information of the memory operations of the AI framework comprises an original structure of parameters of the at least one heterogeneous operator on a side of the AI framework, and the unified information perception module is further configured to obtain operation information of memory operations of the at least one heterogeneous operator from an acceleration device of the computing server; the unified information perception module is further configured to record a mapping relationship between a framework application programming interface API of the AI framework and the at least one heterogeneous operator; an abnormality detection module configured to perform abnormality detection on the at least one heterogeneous operator according to the operation information of the memory operations of the AI framework and the operation information of the memory operations of the at least one heterogeneous operator, and obtain an abnormality detection result; the abnormality detection module is further configured to determine an abnormality API according to the mapping relationship between the framework API of the AI framework and the at least one heterogeneous operator when the abnormality detection result indicates that an abnormality is detected.

13. The system of claim 12, wherein, The unified information perception module is specifically configured to: obtain the operation information of the memory operations of the AI framework in the AI model running process from the host of the computing server through a stub program set for the AI framework.

14. The system of claim 12, wherein, The unified information perception module is specifically configured to: obtain the operation information of the memory operations of the AI framework in the AI model running process from the host of the computing server through a replacement API of a memory operation API in the AI framework.

15. The system of claim 12, wherein, The unified information perception module is specifically configured to: obtain the operation information of the memory operations of the AI framework in the AI model running process from the host of the computing server through a code block for monitoring memory operations in the AI framework.

16. The system of any one of claims 12 to 15, wherein, The operation information of the memory operations of the AI framework comprises a start address and a length of memory applied for parameters of the at least one heterogeneous operator, or the operation information of the memory operations of the AI framework comprises a start address and a termination address of memory applied for the parameters of the at least one heterogeneous operator.

17. The system of any one of claims 12 to 16, wherein, The execution device of the abnormality API comprises a first acceleration device that executes the at least one heterogeneous operator, and the system further comprises: an abnormality processing module configured to switch the execution device of the abnormality API from the first acceleration device to the host or a second acceleration device.

18. The system of any one of claims 12 to 16, wherein, The system further comprises: an abnormality processing module configured to repair code of a heterogeneous operator associated with the abnormality API.

19. The system of any one of claims 12 to 18, wherein, The system further comprises: The result display module is configured to output the abnormal API to a log file, or present the abnormal API to a user, or provide the abnormal API to an integrated application through a result display API.

20. The system of any one of claims 12 to 19, wherein, The system further comprises: The configuration module is configured to configure an interface parameter or an environment variable of the exception detection interface to a target value to enable the exception detection capability.

21. The system of claim 20, wherein, The configuration module is specifically configured to: When the exception detection system starts the application to be debugged, the configuration module is configured to configure the interface parameter or the environment variable of the exception detection interface to the target value to enable the exception detection capability, and the application to be debugged is an application developed based on the AI model.

22. The system of claim 20, wherein, The exception detection system is integrated in the AI framework, and the configuration module is specifically configured to: When the AI framework is running, the configuration module is configured to configure the interface parameter or the environment variable of the exception detection interface to the target value to enable the exception detection capability.

23. A cluster of computing devices, characterized in that, The computing device cluster comprises at least one computing device, and the at least one computing device comprises at least one processor and at least one memory, and the at least one memory stores computer readable instructions; the at least one processor executes the computer readable instructions, so that the computing device cluster executes the exception detection method in any one of claims 1 to 11.

24. A computer-readable storage medium, characterized in that, The computer readable instructions are used to implement the exception detection method in any one of claims 1 to 11.

25. A computer program product, characterised in that, The computer readable instructions are used to implement the exception detection method in any one of claims 1 to 11.

Images