Secure AI Model Training via Layer Segmentation and TEE
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for training artificial intelligence (AI) models on electronic devices lack secure and customizable solutions, particularly for small datasets, and often result in data privacy concerns and security vulnerabilities, with existing frameworks like TensorFlow being limited in converting various AI model formats and lacking protection against thefts.
Innovation Solution
A method and electronic device framework that determines and trains separate sets of AI model layers in secure and non-secure modes, using a protected kernel virtual machine (PKVM) for secure on-device training, enabling conversion of various AI formats like TensorFlow Lite, Keras, and PyTorch to ONNX, and ensuring AI model security through encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AI model training is performed on external cloud servers, then training can be completed with sufficient computational resources, but data privacy concerns arise and security vulnerabilities increase
Solution Approach 1:
A trusted execution environment (TEE) acts as an intermediary secure computing platform between the external cloud server and the electronic device. The TEE provides a hardware-based isolated environment that enables secure model training on encrypted data without exposing sensitive information, thus resolving the contradiction between data privacy and training efficiency by introducing a trusted mediation layer
Solution Approach 2:
The AI model is segmented into multiple components: encrypted data storage on the electronic device, secure computation operations within the TEE, and model parameter updates exchanged between device and server. This segmentation allows privacy-sensitive operations to occur locally while leveraging cloud computational resources for non-sensitive processing
2Adaptability or versatility
If TensorFlow framework is used for on-device training, then training can be performed locally, but the framework is limited to TensorFlow and compatible formats only
Solution Approach 1:
A model conversion intermediary layer is introduced that translates various AI framework formats (PyTorch, Keras, etc.) into TensorFlow-compatible formats. This intermediary converter enables multi-framework support while maintaining compatibility with TensorFlow's on-device training capabilities, resolving the contradiction between framework versatility and conversion complexity
Solution Approach 2:
The system implements a universal model interface that can accept models from multiple frameworks through standardized conversion protocols. The TEE infrastructure provides universal secure computation capabilities that work across different model formats and frameworks, enabling one system to serve multiple purposes
3Reliability
If trustzones are employed to protect AI models during training, then security against thefts and attacks is improved, but memory constraints are exacerbated
Solution Approach 1:
Security measures are applied locally only where needed: the TEE provides hardware-based cryptographic protection for sensitive model parameters and training operations, while non-sensitive data and computations remain in the standard memory space. This localized security approach maintains model security while minimizing memory overhead
Solution Approach 2:
The system dynamically adjusts security parameters and encryption key sizes based on available memory resources. The TEE enables efficient cryptographic operations that provide strong security with optimized memory footprint, adapting security levels to match device capabilities
4Reliability
If complete model training is performed in secure mode, then data privacy is maximized, but training speed and resource utilization decrease
Solution Approach 1:
The model training process is segmented into secure and non-secure portions. Sensitive operations such as gradient computation on encrypted data and model parameter updates are performed within the TEE in secure mode, while data preprocessing, non-sensitive computations, and model inference occur in the standard environment. This segmentation maintains data privacy for critical operations while enabling faster execution for non-sensitive tasks
Solution Approach 2:
Instead of encrypting and processing all data in secure mode, the system applies secure processing only to the minimum necessary portions of the training pipeline. This partial secure action approach maintains adequate data privacy protection while maximizing training speed by leaving non-critical operations in unencrypted, faster-executing modes
Data Source
AI summary
A method and an electronic device for secure training of an artificial intelligence (AI) model are provided. The method includes determining, by the electronic device, a first set of layers from a base AI model for performing training in a secure mode, and determining, by the electronic device, a second set of layers other than the first set of layers in the base AI model, simultaneously training, by the electronic device, the first set of layers in the secure mode and the second set of layers in a non-secure mode, and generating, by the electronic device, the AI model by combining the trained first set of layers and the trained second set of layers in the secure mode.