AI Model Obfuscation Branches for Low-Overhead Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing AI model protection methods that encrypt the entire model for confidentiality result in excessive computing overheads and inference delays, limiting the application of AI models.
Innovation Solution
A method that generates a computation graph with obfuscation branches parallel to the original computation branches, where execution is determined by expressions, and only the expressions are encrypted, reducing overheads by obscuring the model structure and protecting confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire AI model is encrypted for protection, then model confidentiality is improved, but computing overhead and inference delay increase excessively
Solution Approach 1:
The patent segments the model protection approach by encrypting only specific critical components (weights, biases, activation functions) rather than the entire model. This allows the model to maintain confidentiality for protected elements while leaving other parts accessible, thereby reducing decryption overhead and improving inference speed.
Solution Approach 2:
The patent applies local quality protection by selectively encrypting only the most sensitive parts of the model (weights, biases, activation functions) while leaving the computation graph and other non-sensitive components unencrypted. This localized encryption approach maintains security where needed without imposing unnecessary computational overhead across the entire model.
2Reliability
If the entire AI model is decrypted before inference, then model confidentiality is protected, but computing overhead becomes excessively high
Solution Approach 1:
The patent segments the decryption process by only decrypting specific encrypted components (weights, biases, activation functions) rather than the entire model. This selective decryption reduces the computational workload and energy consumption while maintaining confidentiality protection for the critical model elements.
Solution Approach 2:
The patent applies partial action by encrypting and decrypting only the necessary portions of the model (weights, biases, activation functions) rather than the entire model. This partial encryption/decryption approach provides sufficient security protection while minimizing the computational overhead and energy consumption associated with full model encryption.
3Reliability
If encryption algorithms are applied to protect AI models, then model confidentiality is improved, but inference delay is greatly prolonged
Solution Approach 1:
The patent segments the encryption application by protecting only specific critical components (weights, biases, activation functions) rather than the entire model. This segmentation allows encryption to be applied only where most needed, reducing the total encryption/decryption time and minimizing inference delay while maintaining strong confidentiality protection.
Solution Approach 2:
The patent implements local quality protection by applying encryption only to the most sensitive model components (weights, biases, activation functions) rather than uniformly across the entire model. This localized approach reduces the time required for encryption operations and minimizes inference delay while maintaining effective confidentiality protection where it matters most.
Data Source
AI summary
A model processing method is provided and applied to the field of artificial intelligence (AI) technologies. In the method, a new obfuscation computing node is added on the basis of original computation logic of an AI model, an execution relationship between an original computing node and the obfuscation node is determined by using an expression, and a correct computing node can be executed only when an output of the expression is correct. In this way, an operator execution sequence and dependency relationship in the original model can be obscured by using the newly added obfuscation node, to scramble a model structure.