Neural Network Structure Secrecy Using Split Architecture Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network structure search methods require significant time and cost, and the resulting structures are vulnerable to theft, compromising competitive advantage and business security due to large size and reliance on external memory for storage.
Innovation Solution
A structure-secret neural network model generation apparatus that generates supernet information, trains it using a training dataset, and creates subnet information by replacing parameters in the supernet information with those from an additionally trained subnet, keeping the neural network structure secret by storing critical information in internal memory and encrypting it.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If the neural network structure is stored in external memory, then the large capacity requirement is met, but the security against theft and reverse-engineering deteriorates
Solution Approach 1:
The patent segments the neural network structure into two parts: architecture information (stored in internal memory) and parameter information (stored in external memory). This segmentation allows the critical architectural blueprint to remain secure in internal memory while only storing larger parameter data externally, resolving the contradiction between storage capacity and security.
Solution Approach 2:
The patent introduces architecture information as an intermediary that acts as a key to interpret the parameter information. Without this intermediary stored securely in internal memory, the parameter information in external memory cannot be properly utilized or reverse-engineered to reconstruct the neural network structure, thus enhancing security while maintaining external storage capability.
2Reliability
If encryption is used to protect the neural network structure, then security is improved, but the complexity of the system increases
Solution Approach 1:
The patent extracts the critical security element (architecture information) from the complete neural network structure and stores it separately in internal memory. This extraction approach provides security without requiring complex encryption algorithms, as the architecture information itself serves as the protective mechanism. The system complexity increases minimally compared to implementing full encryption schemes.
3Quantity of substance
If the complete neural network structure is stored in external memory, then storage capacity is sufficient, but the risk of malware theft and cold boot attacks increases
Solution Approach 1:
The patent segments the neural network structure into architecture information and parameter information, storing the critical architecture component in internal memory which is protected from malware and cold boot attacks. Only the parameter information resides in external memory, which without the architecture information is insufficient for reconstructing the neural network, thus reducing theft risk while maintaining adequate storage capacity.
Solution Approach 2:
The architecture information stored in internal memory acts as a protective intermediary that prevents unauthorized access to the complete neural network structure. Even if parameter information is stolen from external memory through malware or physical attacks, the missing architecture information renders the stolen data useless for reconstructing the functional neural network.
Data Source
AI summary
The subnet generation unit generates architecture information, which is information that identifies one candidate structure for each block, and subnet information determined by the architecture information, based on architecture parameters in trained supernet information. The subnet additionally training unit generate additionally trained subnet information by updating parameters in subnet information, by training using a training data set. The structure-secret model information generator generates structure secret model information by replacing parameters of a part that corresponds to the subnet information among parameters included in the trained supernet information with parameters included in the additionally trained subnet information after excluding the predetermined module and the architecture parameters from the trained supernet information.