Secure Neural Network Inference Through Irreversible Layer Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The widespread application of AI/ML technologies has highlighted the need for secure and reliable data protection in machine learning operations, particularly in scenarios where sensitive data is involved, such as assisted/autonomous driving, to prevent data leakage and ensure privacy.
Innovation Solution
A method and device for inference that partitions a neural network model into parts deployed inside and outside a trusted security zone, determining irreversible weight matrices to ensure secure deployment, using encrypted inference data to protect data integrity and confidentiality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire neural network model is deployed inside a security space, then data security and privacy protection are improved, but device complexity and resource consumption increase
Solution Approach 1:
The neural network model is segmented into multiple parts: irreversible weight matrices are deployed inside the security space while reversible weight matrices are deployed outside. This segmentation allows the system to maintain data security for critical components while reducing the overall complexity and resource requirements by placing only essential elements in the secure environment.
2Reliability
If the entire neural network model is deployed inside a security space, then data security is improved, but computing resources and inference time increase
Solution Approach 1:
The model is divided such that only irreversible weight matrices requiring security protection are placed inside the security space, while reversible weight matrices can be processed outside. This reduces the computational burden within the security space and allows parallel processing of non-critical components, thereby improving inference speed while maintaining necessary security protections.
Solution Approach 2:
Instead of protecting all weight matrices equally, the system applies security protection only to the extent necessary - specifically to irreversible weight matrices that cannot be recovered from intermediate results. Reversible weight matrices are processed without the overhead of security space operations, achieving adequate security with reduced computational cost and faster inference.
3Reliability
If intermediate parameters are protected completely, then data security is improved, but model performance and accuracy may deteriorate
Solution Approach 1:
The system segments weight matrices into irreversible and reversible categories based on their security requirements. Irreversible weight matrices are protected within the security space to prevent inference attacks, while reversible weight matrices can be exposed outside the security space. This selective protection maintains model accuracy by allowing necessary parameters to be accessed while protecting only those that would compromise security if exposed.
Data Source
AI summary
Embodiments of the present disclosure relate to a method, a device, and a computer program product for inference. The method includes determining, for a layer in a neural network model, whether a weight matrix of the layer is an irreversible target matrix. The method further includes partitioning, in response to determining that the weight matrix of the layer is the target matrix, the neural network model into a first part and a second part, wherein the first part includes the layer and a previous layer before the layer and is deployed inside a security space, and the second part includes a subsequent layer after the layer and is deployed outside the security space. The method further includes acquiring an inference result by using the partitioned neural network model based on encrypted inference data.