Neural Network Inference With Multiplicative Perturbation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network models face challenges in protecting data integrity during inference computations, as plaintext data is vulnerable to attackers, and current correction methods in trusted execution environments require significant computational overhead and can be intercepted.
Innovation Solution
Implement multiplicative perturbation in a rich execution environment and correct computation results in a trusted execution environment using multiplicative perturbation and intermediate result protection noise, reducing computational overhead while enhancing data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If additive perturbation is applied to protect model data, then data security is improved, but computational overhead increases significantly
Solution Approach 1:
The patent changes the perturbation approach from additive to multiplicative. Instead of adding noise to model parameters (additive perturbation), the patent multiplies parameters by random factors (multiplicative perturbation). This parameter transformation reduces computational overhead while maintaining security benefits, as multiplicative perturbation allows for more efficient correction and noise application in the TEE.
2Reliability
If computation is performed in REE with perturbed model, then data protection is improved, but computation accuracy deteriorates due to perturbation noise
Solution Approach 1:
The patent introduces a TEE as an intermediary between the REE and the final computation output. The TEE receives perturbed computations from the REE, corrects the perturbation effects, applies IRP noise for security, and returns accurate results. This intermediary structure allows the system to benefit from both the security of perturbed computations in the REE and the accuracy of corrected computations in the TEE.
Solution Approach 2:
The patent implements a feedback mechanism where computation results are corrected in the TEE based on the perturbation factors applied in the REE. The correction process uses the perturbation factors as feedback to reverse their effects, thereby recovering accurate computation results while maintaining the security benefits of the initial perturbation.
3Reliability
If IRP noise is applied to protect intermediate results, then security is improved, but data interception risk increases
Solution Approach 1:
The patent applies different protection strategies to different parts of the computation graph. IRP noise is selectively applied only to intermediate results that require protection, rather than uniformly across all computations. This localized approach maintains security where needed while minimizing the risk of data interception in other parts of the system.
Data Source
AI summary
A method includes performing, in a rich execution environment, computation for each convolution layer of a neural network model, based on multiplicative perturbation factors of the convolution layer and outputting a computation result of each layer to a trusted execution environment (TEE), and in the TEE, correcting the computation result of a first layer of the layers based on the multiplicative perturbation factors, correcting the computation result of each remaining layer other than the first layer based on the multiplicative perturbation factors and intermediate result protection (IRP) noise correction factors corresponding to the remaining layer, inputting the corrected computation results of the layers into corresponding nonlinear layers of the neural network model, and applying IRP noise to an output of the nonlinear layer corresponding to each convolution layer other than a last convolution layer, and outputting the nonlinear layer to which the IRP noise has been applied to the REE.