Deep Learning Model Obfuscation for Edge Piracy Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep learning models on edge devices are vulnerable to piracy due to their use of public formats and APIs, posing a threat to intellectual property without compromising accuracy.
Innovation Solution
Obfuscation of deep learning models by altering the structure of operation layers, adding redundant layers and weights, and changing execution order, while maintaining model accuracy through a compiler that can optimize the obfuscated model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If deep learning models use public formats or public APIs, then ease of operation and compatibility are improved, but vulnerability to piracy and loss of intellectual property increase
Solution Approach 1:
The patent segments the deep learning model into multiple functionally equivalent but structurally different operation layer sequences. By dividing the model into interchangeable computational paths that produce the same output, the system maintains compatibility through public APIs while obscuring the original model structure to prevent piracy.
Solution Approach 2:
The patent changes structural parameters of the operation layers (such as layer connectivity, operation ordering, and intermediate representation formats) while maintaining functional equivalence. This allows the model to interface with public APIs using standard formats while the altered internal parameters prevent reverse engineering and protect intellectual property.
2Reliability
If the structure of operation layers is changed to obfuscate the model, then protection against piracy is improved, but model accuracy may deteriorate
Solution Approach 1:
The patent creates multiple copies of the deep learning model with different operation layer structures but identical functional behavior. These copied models are structurally obfuscated versions that maintain the same predictive accuracy while preventing piracy through structural complexity and equivalence.
Solution Approach 2:
The patent modifies structural parameters (layer connections, operation sequences) while carefully maintaining functional parameters (weight distributions, activation patterns) to ensure accuracy is preserved within acceptable tolerances despite structural obfuscation.
3Difficulty of detecting and measuring
If redundant operation layers are added to obfuscate the model, then difficulty of detecting and measuring the original model increases, but device complexity increases
Solution Approach 1:
The patent segments the model into multiple operation layer groups where redundant layers are distributed across different segments. Each segment contains functionally equivalent operations that can be interchangeably executed, increasing reverse engineering difficulty while managing overall complexity through modular organization.
Solution Approach 2:
The patent adds a controlled amount of redundant operation layers beyond the minimum needed for functionality. This excessive structural complexity serves to obfuscate the original model while the redundancy is managed to prevent excessive growth in device complexity through efficient representation and execution.
Data Source
AI summary
A method for obfuscating deep learning (DL) models includes the step of training a DL model to obtain weights of operation (OP) layers in the trained DL model. The DL model includes an interface to a public application programming interface (API) that provides access to a compiler of an artificial intelligence (AI) processor. The method further includes the steps of obfuscating the DL model by changing a structure of the OP layers to produce an obfuscated DL model, and publishing the obfuscated DL model for access by devices. The obfuscated DL model is executable by the AI processor after compilation by the compiler on an edge device.