ML Model Protection Through Secure-Enclave Post-Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for protecting machine learning models from model extraction attacks are ineffective against sophisticated adversaries and compromise API usability, while digital twins containing sensitive user data face risks of unauthorized access and cloning.
Innovation Solution
Implementing a secure enclave in user equipment to install a post-processing module that randomizes and personalizes the output of machine learning models, using biometric or environmental data as a random seed to obfuscate responses and prevent model inversion attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing protection methods (watermarking, query detection, API limitations) are applied to protect ML models, then model security is improved, but API usability deteriorates or protection is ineffective against sophisticated adversaries
Solution Approach 1:
A post-processing module is introduced as an intermediary component that sits between the ML model and the user. This module receives the original model output and transforms it through randomization and personalization functions, preventing direct model extraction while maintaining useful functionality. The intermediary layer adds security without requiring changes to the core model or significant API modifications.
Solution Approach 2:
The patent changes the parameters of the model output by applying randomization functions seeded with biometric or environmental data. Instead of returning identical predictions, the system returns transformed outputs that vary based on user-specific parameters. This parameter transformation prevents model inversion attacks while preserving the essential predictive information needed for API usability.
2Reliability
If API access is limited to prevent model extraction, then model security is improved, but API usability deteriorates
Solution Approach 1:
Instead of limiting API access, the system changes the parameters of the output data. By applying randomization and personalization transformations to the model predictions, the system allows full API access while preventing meaningful model extraction. Users can still query the API freely, but the transformed outputs do not reveal the underlying model structure or enable accurate cloning.
3Reliability
If sophisticated protection mechanisms are implemented, then model security is improved, but system complexity increases
Solution Approach 1:
The protection system is segmented into distinct functional components: the original ML model, the post-processing module, and the randomization functions. This segmentation allows each component to be optimized independently and simplifies the overall system architecture. The post-processing module can be implemented as a separate, lightweight layer that does not significantly increase the complexity of the core model or infrastructure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosure relates to methods, a user equipment, a network node and non-transitory computer readable media for protecting a machine learning (ML) model hosted in a network node. The method comprises sending an original request to the ML model hosted in the network node, receiving, from the network node, a request for establishing a secure connection to a post processing module to be installed in a secure enclave of the UE. The method comprises installing the post processing module in the secure enclave and receiving in the secure enclave a response to the original request. The method comprises processing the response to the original request in the secure enclave and obtaining the processed response from the secure enclave, for use by the UE.