Deep Learning Model Protection via Segmented Confidential Computing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep learning model protection methods face challenges in copyright attestation, protecting confidential information, and comprehensive protection against model forgery and unauthorized use, particularly due to vulnerabilities in watermark-based methods and encryption schemes that allow unauthorized users to bypass protections through knowledge distillation and key leakage.
Innovation Solution
A method employing a two-stage process involving a lightweight data preprocessing model in a confidential computing environment and an inference model in a common environment, where the preprocessing model is encrypted and attestation is performed remotely to ensure only authorized users receive decryption keys, thereby preventing unauthorized inference and protecting intellectual property.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermark-based protection methods are used to protect deep learning models, then model copyright verification is enabled, but unauthorized users can bypass protection through model pruning, migration, and knowledge distillation
Solution Approach 1:
The deep learning model is divided into two separate components: a data preprocessing model deployed in a confidential computing environment and an inference model deployed in a common environment. This segmentation ensures that the critical preprocessing functionality remains protected while allowing controlled inference usage.
Solution Approach 2:
A confidential computing environment acts as an intermediary between the model owner and unauthorized users. This intermediary layer provides remote attestation capabilities and cryptographic protection, preventing direct access to the preprocessing model while enabling authorized inference operations.
2Reliability
If encryption is applied to the entire deep learning model to protect copyright, then model security is improved, but decryption keys must be shared with authorized users which creates key leakage risks
Solution Approach 1:
The model encryption approach is segmented into two parts: the data preprocessing model is encrypted and deployed in a confidential computing environment, while the inference model remains accessible in a common environment. This eliminates the need to share decryption keys broadly while maintaining security for critical operations.
Solution Approach 2:
The decryption key management problem is extracted from the overall system by moving the encrypted preprocessing model into a confidential computing environment that provides built-in cryptographic protection. The key never leaves the secure environment, eliminating key leakage risks while still enabling authorized access.
3Reliability
If the data preprocessing model is deployed in a confidential computing environment, then remote attestation and copyright protection are achieved, but system complexity increases
Solution Approach 1:
The confidential computing environment serves as a standardized intermediary layer that provides remote attestation and cryptographic protection through established hardware and software mechanisms. This intermediary absorbs the complexity of secure verification, presenting a simplified interface to both model owners and users.
4Reliability
If the preprocessing model is encrypted and deployed in confidential computing environment, then unauthorized inference is prevented, but inference speed may be reduced due to additional security overhead
Solution Approach 1:
The model is segmented into encrypted preprocessing operations in a confidential environment and unencrypted inference operations in a common environment. This segmentation allows the time-consuming secure verification to occur only once during deployment, while the actual inference operations proceed at normal speed without repeated security overhead.
Data Source
AI summary
The present invention discloses a method for protecting a deep learning model based on confidential computing. In this solution, a use process of a deep learning model is divided into two stages: Data preprocessing and inference. At the data preprocessing stage, a data preprocessing model is mainly used to process inference data of an authorized user. The data preprocessing model is a lightweight processing module, which occupies less computing resources, and the data preprocessing model is deployed in a confidential computing environment. At the inference stage, an inference model is used to perform inference on preprocessed data, and the inference model is deployed in a common computing environment. In the entire process, copyright attestation of the deep learning model can be implemented without affecting inference accuracy of the model, and the infringement of the model copyright can be effectively resisted through model forgery, transfer learning, knowledge distillation, and the like.