On-Device Machine Learning Model Access Control via Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for implementing machine learning models on-device leave them vulnerable to extraction and uncontrolled use, and encryption methods require significant computational processing and may violate legal requirements.
Innovation Solution
Generate a derivative of the machine learning model using an obfuscation key based on user and device-specific information, allowing the model to operate without encryption by modifying its weights and adding operations that require the obfuscation key at runtime for proper functioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption methods are used to protect machine learning models, then model security against extraction and uncontrolled use is improved, but computational processing requirements increase significantly
Solution Approach 1:
The model protection mechanism is segmented into two distinct components: encrypted model weights and separate decryption keys. This segmentation allows the model structure to remain protected while enabling efficient computation when authorized, resolving the contradiction between security and computational efficiency.
Solution Approach 2:
A decryption key acts as an intermediary between the encrypted model weights and the computation process. The key enables authorized devices to decrypt and use the model without requiring the model owner's direct involvement, providing both security and computational efficiency.
2Reliability
If encryption methods are used to protect machine learning models, then model security against extraction and uncontrolled use is improved, but legal requirements relating to export restrictions may be violated
Solution Approach 1:
The system changes the protection parameter from cryptographic encryption to obfuscation through random weight modification. This parameter change maintains model security while avoiding the legal restrictions that apply to cryptographic export controls, thereby improving legal compliance.
3Reliability
If traditional encryption is used to obscure model structure, then protection against model extraction is improved, but model operation becomes impossible without encryption keys
Solution Approach 1:
The model weights are pre-modified with random values during the export process, and the corresponding random values are stored as decryption keys. This preliminary action ensures that the model appears obfuscated but can be easily operated on authorized devices that possess the stored keys, resolving the contradiction between protection and operability.
4Speed
If machine learning models are deployed on-device, then latency is reduced and privacy is improved, but models become vulnerable to extraction and copying
Solution Approach 1:
The system creates a copy of the model weights and modifies them with random values before deployment. This copied and modified model can be freely deployed on devices for low-latency operation, while the original unmodified weights remain protected on the server. The random modification acts as a copy protection mechanism that prevents extraction of the original model.
Data Source
AI summary
A system and method for controlling access to an on-device machine learning model without the use of encryption is described herein. For example, a request is received from an application executing on a device of a user. The request is to download a machine learning model to the device that enables a feature of the application, and the request includes information associated with the user and/or the device. The information is used to create an obfuscation key, and a derivative model can be generated using a reference copy of the machine learning model and the obfuscation key. The derivative model and the obfuscation key are then sent to the application. When the obfuscation key is provided to the derivative model at runtime, values derived from the obfuscation key are provided as additional inputs that enable the derivative model to function properly.