Deep Learning Model Protection via Reversible Input Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep learning model protection methods, particularly for DNNs in audio processing, rely on passive approaches like watermarking, which are not effective in actively preventing unauthorized usage, and require additional encoders and decoders that only secure input data, lacking comprehensive protection mechanisms.
Innovation Solution
The proposed solution involves an apparatus and method that includes an input reconstruction unit and an output modification unit, using reversible scrambling and obfuscation techniques to protect both input and output data of DNN models, ensuring that the model cannot function without proper unscrambling, thus preventing unauthorized usage without altering the training process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If passive watermarking methods are used to detect unauthorized usage, then detection capability is improved, but prevention effectiveness deteriorates
Solution Approach 1:
Instead of passively watermarking the model to detect unauthorized use, the patent inverts the approach by actively obfuscating the input data before it reaches the model. The input reconstruction unit applies reversible obfuscation transformations that render the input unintelligible without the proper decoding key, thereby actively preventing unauthorized usage while maintaining detection capability through the reversible nature of the transformation.
Solution Approach 2:
The patent introduces an intermediary component (input reconstruction unit) between the external data source and the DNN model. This intermediary applies obfuscation transformations that act as a mediator, converting legitimate input into a protected form that the model can process only with proper authorization, thus enhancing both prevention and detection.
2Reliability
If additional encoder and decoder are added to protect input data, then protection scope is improved, but device complexity deteriorates
Solution Approach 1:
The input reconstruction unit performs multiple functions within a single component: it applies obfuscation transformations, manages reversible encoding, and enables controlled data reconstruction. By consolidating these functions into one multi-functional unit rather than separate encoder and decoder components, the patent reduces overall system complexity while maintaining comprehensive protection scope.
Solution Approach 2:
The patent merges the encoding and decoding functionality into a unified reversible obfuscation process within the input reconstruction unit. This consolidation combines multiple protective mechanisms into a single integrated component, reducing the number of separate elements in the system while preserving the full protection scope across both input and output data.
3Reliability
If input data is encoded to restrict unauthorized usage, then protection effectiveness is improved, but ease of operation deteriorates
Solution Approach 1:
The reversible obfuscation system is designed to be self-service in that the input reconstruction unit automatically applies the appropriate transformations and reconstruction rules without requiring external intervention. The system self-manages the encoding and decoding processes, maintaining protection effectiveness while simplifying operation by eliminating the need for manual encoding/decoding management.
Solution Approach 2:
The patent employs parameter changes in the form of reversible mathematical transformations that dynamically adjust the data representation. These parameter transformations maintain protection effectiveness by changing the data state, while the reversibility ensures that ease of operation is preserved through automatic restoration of the original data state when needed.
4Reliability
If reversible obfuscation is applied to both input and output, then comprehensive protection is improved, but processing time deteriorates
Solution Approach 1:
The obfuscation transformations are applied in advance to the input data before it enters the DNN model processing pipeline. By performing the protective transformation preliminarily and using efficient reversible algorithms, the patent minimizes additional processing time while ensuring comprehensive protection covers both input and output stages of the model execution.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
An apparatus according to an embodiment is provided. The apparatus comprises an input reconstruction unit 110 configured to receive modified input data that has been generated from first data according to a first modification rule, and configured to reconstruct the first data according to a first reconstruction rule from the modified input data. Moreover, the apparatus comprises a machine-trained processing unit 120 for receiving the first data from the input reconstruction unit 110, and configured for generating resulting data from the first data.