Deep Learning Model Partitioning for Secure Open Distribution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning models consume significant memory, storage, and processing resources, and securing them from unauthorized access is cumbersome, often requiring encryption, which increases latency and limits the distribution and use of proprietary models.
Innovation Solution
Partitioning machine learning models into private and public domains, where the private domain applies a scrambler to transform input data, making it usable only for the public domain, thus allowing secure distribution of the public model without encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning models are encrypted to prevent unauthorized access, then security is improved, but processing speed and memory access are degraded
Solution Approach 1:
The machine learning model is segmented into two distinct parts: an encrypted private domain portion containing sensitive weights and parameters, and an unencrypted public domain portion containing less sensitive components. This segmentation allows the public portion to be processed quickly without decryption overhead while the private portion remains protected, thus resolving the contradiction between security and processing speed.
2Reliability
If machine learning models are encrypted to prevent unauthorized access, then security is improved, but memory and storage resources are increased
Solution Approach 1:
By dividing the model into encrypted and unencrypted segments, only the essential private domain portion requires encryption and associated memory overhead. The public domain portion can be stored and accessed without encryption overhead, reducing total memory and storage resource consumption while maintaining security for critical model components.
3Reliability
If machine learning models are encrypted to prevent unauthorized access, then security is improved, but device complexity is increased
Solution Approach 1:
The model segmentation approach concentrates encryption and decryption operations only on the private domain portion during input preprocessing and output postprocessing. The public domain portion requires no encryption operations, significantly reducing overall device complexity compared to encrypting the entire model while maintaining adequate security for sensitive components.
4Reliability
If machine learning models are distributed in proprietary formats, then model security is improved, but adaptability and ease of use are degraded
Solution Approach 1:
The model is distributed in a hybrid format where the public domain portion uses open, standardized formats (such as ONNX) that ensure broad compatibility and ease of use across different platforms and frameworks. The private domain portion is distributed separately in an encrypted format that maintains security. This segmented distribution strategy resolves the contradiction by providing both format compatibility and model security.
Data Source
AI summary
Apparatus and methods are disclosed for using machine learning models with private and public domains. Operations can be applied to transform input to a machine learning model in a private domain that is kept secret or otherwise made unavailable to third parties. In one example of the disclosed technology, a method includes applying a private transform to produce transformed input, providing the transformed input to a machine learning model that was trained using a training set modified by the private transform, and generating inferences with the machine learning model using the transformed input. Examples of suitable transforms that can be employed include matrix multiplication, time or spatial domain to frequency domains, and partitioning a neural network model such that an input and at least one hidden layer form part of the private domain, while the remaining layers form part of the public domain.